Security & audit status
What protects your capital, what has and hasn’t been reviewed, and what you are taking on by depositing. Written to be checkable, not reassuring.
Not yet audited by a third party
WealthVille’s on-chain program has not been audited by an external security firm. Treat it as alpha software running with real capital. Do not deposit more than you are prepared to lose entirely.
What has happened: an internal security review of the perp and swap integration surface in May 2026, which produced 8 critical and high-severity findings. All were remediated in the program before that integration shipped — including mandatory minimum-output enforcement on every swap, explicit mint accounts on deposit and withdraw, and arithmetic overflow guards. An internal review is not a substitute for an external one, and we are not presenting it as one.
Non-custodial by construction
Deposits sit in an on-chain vault account that you own. WealthVille’s automation has authority to allocate that capital between whitelisted venues — it does not have authority to withdraw it to anyone else. There is no custodial wallet holding user funds, so there is no balance for us to freeze, lend out, or lose.
This removes an entire class of failure — the exchange-style shortfall — but it does not remove smart-contract risk. If the program itself has a flaw, non-custodial architecture does not save you. That is exactly why the audit status above matters.
The safety gates
Every automated action is wrapped in a fixed gate set that per-vault strategy logic cannot disable. Each of these exists because of a real production failure — they were discovered running live capital, which is why they are now structural rather than advisory. The design principle is fail safe: degrade to doing nothing rather than act on bad state.
Operational security
On-chain state is the authority
Capital-affecting decisions read decoded on-chain state rather than a database mirror that can drift. This closes the class of bugs where the system acts on a position it only believes it has.
Supervised automation
The engine runs on a fixed cadence with per-tick decision traces, so every action it took — and every action a gate blocked — is reconstructable after the fact.
AI is bounded, and off by default
The optional LLM-assisted layer only refines parameters inside hard-coded bounds. It cannot widen a limit, disable a gate, or authorise an action the rule engine rejected.
Resilient data reads
RPC access rotates across a key pool, and partial or inconsistent reads raise the data-quality guard instead of being treated as truth.
Risks that remain
- •Smart-contract risk in WealthVille’s own program, which has not had a third-party audit.
- •Smart-contract risk in every venue we route to — Orca, Raydium, Meteora, Jupiter, Jito, Kamino and Drift each carry their own.
- •Impermanent loss. Providing concentrated liquidity can leave you worse off than simply holding the two assets.
- •Market risk. Yields are variable, can fall to zero, and past performance says nothing about future returns.
- •Liquidation risk on hedged strategies that use perpetuals.
- •Operational risk. Automation can be wrong, and a gate that has not been written yet cannot block a failure nobody has seen.
The depositor edition of the whitepaper covers these in more depth, including how the risk profiles differ.
Reporting a vulnerability
If you find a security issue, please report it privately first and give us a chance to fix it before disclosing publicly. Email support@wealthville.net with steps to reproduce and the impact as you see it. We will acknowledge receipt and keep you updated on the fix.
We don’t currently run a paid bug-bounty programme. We’re glad to credit you publicly for a valid report if you want the attribution.
Note on scope: the public repository covers the MCP server and agent-framework plugins. The vault program and data pipeline are not currently open source.
Before you deposit
Read the depositor whitepaper, start with an amount you would be genuinely relaxed about losing, and check the published track record rather than taking performance claims — including ours — at face value.
