Security

How VisionSwap is designed to keep your funds under your control, what you rely on when you use it, and how to tell us about a problem. Each point describes VisionSwap as it runs today, and the Terms of use set out the risks.

Last updated October 15, 2026.

• How VisionSwap is built
• Your keys
• The code you run
• Upgrades and settings
• The trusted setup
• Audits and testing
• Reporting a security problem
• If something goes wrong
• Staying safe

How VisionSwap is built

• The pool. Shielded SOL sits in a vault owned by the VisionSwap program on Solana. It can leave only against a valid zero-knowledge proof (Groth16, verified by the program itself), or, while a deposit is still in the waiting room, back to the address that deposited it. No admin setting can move or redirect it, though an upgrade could change these rules (see Upgrades and settings).
• Notes and proofs. Your private balance is a set of notes in the pool's public note tree. Your browser downloads every note, finds your own with your viewing key, and builds each proof on your device. A proof shows that a payment is yours to make without saying which deposit paid for it.
• The relayer. A relayer submits each private payment to Solana and pays its network fee, which the payment repays. The recipient, the amount, the relayer fee and the highest pool fee you accept are bound into the proof, so the relayer can't change them. The program accepts any fee payer, so anyone can run a relayer; ours is the default, and you can also send a payment yourself with a fee payer of your own.
• One-time sending addresses. A private send to an address outside your own VisionSwap wallets goes through a one-time sending address made for that payment, which only your app holds the key to, and arrives as a standard SOL transfer.
• Screening. Deposits are screened and wait in a public waiting room before they join the pool, and flagged ones can only go back to the address they came from. The Compliance page explains how, and publishes our screening policy.

Your keys

• Your account's keys are made on your device: from your wallet's signature of one fixed message, from a passkey, or from a VisionSwap private key. Your spending and viewing keys never reach our servers, and our servers cannot spend your private balance.
• Vision wallets, deposit addresses, fee wallets and order keys each come from your account through their own one-way derivation, so none of them reveals your spending or viewing key.
• "Keep me signed in" seals your private key with a key that your browser made and can't export, so the saved copy opens only in that browser. It's off unless you turn it on.
• Orders are the one place our service holds a key over your funds, and only as far as you choose: an order's key can move only the amount you set aside for it (for a DCA, its whole budget), only from its own Vision wallet, and only until the order ends or you cancel it. The token program enforces that amount. Order details are stored encrypted, and an order's key is deleted from our records when the order ends.
• Nobody, including us, can recover a lost key. Keep your private key or a passkey account's backup key somewhere safe and offline.

The code you run

• The web app is loaded from visionswap.net each time you open it, so that code is part of what you trust. The site loads no third-party scripts, fonts or trackers, and a strict content security policy lets each page run only its own code.
• The Chrome extension carries its own copy of the app, published through the Chrome Web Store. It talks only to visionswap.net.
• The Android app opens visionswap.net full screen. Its signing certificate's SHA-256 fingerprint is DA:15:00:34:70:29:E5:73:EC:14:6C:28:7F:6E:EB:B3:9C:13:2E:47:0B:DF:4A:8E:28:93:5A:9D:A8:F3:00:43, also listed in /.well-known/assetlinks.json; Android installs an update only if it is signed with the same key.
• Our server writes no IP addresses or wallet addresses to its logs, keeps scheduled payments and orders encrypted, and limits how often each connection can call its API. Our hosting provider keeps its own connection records; the Privacy policy lists what each service sees and for how long.

Upgrades and settings

The program is upgradeable today, and the VisionSwap team holds the key that upgrades it. An upgrade can change the program's rules, and it takes effect when it is deployed. The team also manages the pool's settings: the pool fee (never above 1%), the deposit limits and pool cap, the waiting room (up to the program's cap), whether a deposit needs a screening pass and the key that signs those passes, the fee wallet, and a pause for new deposits. Setting changes take effect when they are made. The Terms of use, section 8, set out exactly what the team can and can't do.

Our plan is to move the upgrade key to a multisig and, once the code has been audited, to make the program permanent. That is a plan, not a promise, and a permanent program would still have the settings above.

Program

VSwJY1r9S7nNUyvBzWYr1rBkEMyTAjDFGtixxLGpmt6The VisionSwap pool program on Solana mainnet.

More on-chain details, including the vault, the note tree and the settings account, are in the Docs.

The trusted setup

The proving keys come from a two-phase trusted setup that builds on the public "perpetual powers of tau" (61 public contributions and a random beacon). Phase two was completed by the VisionSwap team and sealed with a final random beacon from a Bitcoin block, and its record is part of the public proving key the app downloads. As with any trusted setup, the proofs are sound as long as the randomness used in phase two was discarded; your payments' privacy doesn't depend on it.

Audits and testing

VisionSwap's program, circuit, server and apps have been tested extensively, including through an internal security review, but they have not yet had an independent audit. An independent security audit is on our roadmap. When one is done, we plan to publish its report, its scope, the version of the code it covered and what was fixed. Until then, treat VisionSwap as new software.

Reporting a security problem

If you find a vulnerability, please tell us privately before telling anyone else, and give us a reasonable time to fix it. Report it to support@visionswap.net. The same address is in our security.txt.

• In scope: the pool program and its zero-knowledge circuit, our server and its API, the website and app, the Chrome extension and the Android app.
• Out of scope: services we don't run (wallets, Solana itself, Jupiter and other providers), attacks that need a device that is already compromised, social engineering, and anything that disrupts the service for other people, such as denial of service or spam.
• Please: use only your own accounts and funds, with small amounts; never access, move, change or keep anyone else's data or funds (if showing the problem would need that, stop and describe it to us instead); and stop and tell us as soon as you have found it.
• Good faith: we won't take legal action against anyone who reports a vulnerability in good faith and follows these guidelines, and we're glad to credit you if you'd like to be named. This promise is ours alone: we can't make it for anyone else, and it doesn't cover taking or keeping funds.
• Rewards: there is no paid bug bounty at the moment.

If something goes wrong

• Official updates come from this website and from @VisionSwapSol on X.
• What the team can do: pause new deposits, stop relaying payments, send waiting deposits back to the addresses they came from and, while the program is upgradeable, upgrade it.
• No setting lets anyone move or redirect the funds in the pool; an upgrade could change the program's rules, as described above.

Staying safe

• Use VisionSwap only at visionswap.net, through the Android app downloaded from visionswap.net, or through the VisionSwap extension in the Chrome Web Store. Check the address bar before you connect.
• When your wallet asks you to sign, check that it names visionswap.net. The message that opens your account doesn't name the site, so only ever sign it on visionswap.net: anyone who has that signature can spend your private balance.
• Never share your wallet's recovery phrase or secret key, your VisionSwap private key or backup key, or the signature your wallet makes for VisionSwap, with anyone, whatever they tell you.
• VisionSwap's email addresses are support@visionswap.net and business@visionswap.net. Be wary of messages from other addresses that use VisionSwap's name, and never send keys, recovery phrases or signatures by email: we never ask for them.
• Turn on "Keep me signed in" only on a device only you use, and keep your browser and wallet up to date.
• Some records live only on your device, such as payments from your wallet waiting to go and your activity list. Clearing the site's data deletes them; your private balance stays on Solana and opens again with your keys.
• Check every address and amount before you confirm, and be wary of tokens and accounts that use VisionSwap's name. For your privacy, wait between steps, vary your amounts, and never send back to the wallet you deposited from.