Apsis is operator-run. The operator holds float on every chain and executes every settlement. The contract narrows what can go wrong around that, but it does not remove the operator from the trust path. See Trust model for the full picture.

​
Enforced on chain

  • Only allowlisted executors move float; only the owner withdraws it.
  • Swap outputs are checked against the minimum committed in the quote.
  • Surplus above a committed output stays in the vault.
  • Vouchers require a valid signature from the registered signer and redeem exactly once, only to the referrer address they name.
  • No operator wallet holds an allowance on user funds; payouts come from the vault’s own balance.

​
Depends on the operator

  • Custody of float on every chain.
  • Quote pricing and which pairs are offered.
  • Timely submission of fulfillments and refunds.
  • The owner keys that can pause, withdraw, and change allowlists.
There is no user-callable escape hatch on the contracts. A deposit that has been made and not yet settled depends on the operator continuing to operate.

​
Audits

The EVM contracts and the Solana program are the audited surface. The off-chain services are not part of an audit scope.

​
Reporting a vulnerability

Email with enough detail to reproduce. Do not open a public issue on for anything exploitable, and do not test against mainnet contracts with funds that are not yours.

​
Integration hygiene

  • Keep API keys server-side. A key in a shipped bundle is your rate limit and your attribution in someone else’s hands.
  • Never put a partner session token in a client. It grants key management and referral claiming.
  • Treat order state as the only settlement authority. A transaction hash means submitted, not confirmed.
  • Show min_amount_out, not just amount_out, before a user signs.
  • Fetch swap instructions immediately before sending a deposit; stale routing calldata is the most common cause of a failed deposit.