Security

Security center

What runs on mainnet, what is local, and what is not available — with the evidence for each. ANON never holds your funds or keys, and makes no claim of guaranteed anonymity.

Live

Testnet

Simulated

Under review

Unavailable

Solana swaps via Jupiter (mainnet)

Livelive

Quote → simulate → fee-payer check → your wallet signs → recorded before broadcast → on-chain confirmation. Never auto-resent. No real swap confirmed end to end yet.evidence: src/test/swap.test.ts

Pump.fun launches (mainnet)

Livelive

Official SDK, exact fees from simulation, explicit real-money confirmation, recorded before broadcast; success only after the mint and bonding curve exist on-chain. No real launch confirmed end to end yet.evidence: src/test/platform.test.ts

Launch image & metadata hosting

Livelive

Content-addressed files on ANON's server; images checked by file signature; only public coin data is uploaded.evidence: src/lib/launch-assets.functions.ts

Solana lookups, balances, token search

Livelive

Read-only public RPC and Jupiter token API. Nothing is signed.evidence: src/test/tokens.test.ts

XMR / ZEC quotes

Livelive

Live quotes from SideShift, then Exolix as fallback. Quotes only.evidence: src/test/tokens.test.ts

Pump.fun devnet testing

Testnetdevnet

Same flow on devnet, with a throwaway in-memory test wallet.evidence: src/test/devnet-wallet.test.ts

Zero-knowledge core (commitments, range, balance, MLSAG ring spends, stealth addresses)

Simulatedsimulated

Real cryptography, tested with fuzzing and frozen vectors — but it runs only on the local in-browser testnet.evidence: docs/audit/SPEC.md

ANON Chain (3 validators)

Simulatedsimulated

Runs in your browser tab. Tolerates crashed validators, not malicious ones. No peer-to-peer network.evidence: docs/roadmap/NETWORK.md

Encrypted wallet vault & backups

Simulatedsimulated

PBKDF2 + AES-GCM in the browser; versioned backups; wrong-password and corrupted-file tests. Holds test units only.evidence: src/test/security.test.ts

Protocol spec, threat model, audit checklist

Under reviewuntested

Written internally. An internal review is not an independent audit.evidence: docs/audit/THREAT_MODEL.md

On-chain privacy pool (Solana program)

Unavailableblocked

Design only. No deposits, withdrawals or custody until independent review and controlled testing.evidence: docs/roadmap/PRIVACY_POOL.md

XMR / ZEC swap execution

Unavailableblocked

Would send funds to a third-party provider; needs a reviewed integration and licensing review.

Monero / Zcash wallets

Unavailableblocked

No reviewed browser library for their keys.

Independent security audit

Unavailableblocked

Not started. Nothing here has been audited by an outside firm.

Automated tests

114 tests pass: cryptographic proofs, adversarial and fuzz cases, consensus faults, backup recovery, swap/launch duplicate protection, never-resend rules, token and quote parsing.

Incident response

If a flaw is found: affected mainnet features are switched off in code and republished, a notice goes on this page and on X (@anonsol_x). Report issues via X DM. ANON holds no funds, so there is nothing to freeze or recover on ANON's side.

Local data

Testnet ledgers, notes and your encrypted vault live in this browser only.

Transaction & RPC monitor (this browser)

implemented

Failures, retries and confirmations from swaps and launches. Stored only in this browser; messages are redacted so keys can never be recorded. Submissions are never retried automatically.

No events yet.