Security

What the code can and can't do

Program ID

Ap6U2RPXFdQTdYNfKsiX8nu7tgh3rXF1ReMe1bn2DZXx

Network

Solana mainnet

Custody

None. Users keep ZCAT; the program is a delegate on ZEC only.

Fee

2% of the yield, hard-capped at 2% in code and enforced to only ever go down, never of principal

Protected floor

Per wallet, set at delegation to the ZEC already held; changes only with the user's signature

Slippage guard

1% below the reference Raydium pool's price, checked on-chain after the swap; the pool's recorded price history must cover the market's window (15 minutes at launch) and be fresh, or the compound is refused outright

Swap venue

Jupiter, program address pinned in code; the route is checked before the program signs

Upgrade authority

Deployer wallet until the first real compounds are verified, then burned: the program is frozen before public launch

Verified build

Pending

Audits

Adversarial AI audits by Fable (Anthropic Claude Fable 5.1) and Astra, two rounds each, reports published unedited on the audits page. No third-party firm audit yet.

Inspect the program on Solscan, read the source, or read the audit reports.

The guarantees

• Your ZCAT is never touched

  The program is approved on your ZEC account only. It is never approved on ZCAT, so it cannot move it.

• ZEC can only become your ZCAT

  The swap runs through Jupiter with your own ZCAT account as the destination, enforced on-chain. The program checks the route's amount, slippage and fee fields before it signs, and your balance after. There is no instruction that sends anything anywhere else.

• The floor moves only with your signature

  Your protected floor lives on your enrollment and changes through one instruction that only you can sign. It never drops on its own: not for the Slawth, not for the team, not because a payout landed.

• 2% of yield, never of principal

  The fee is 2% of the ZEC being compounded, hard-capped at 2% in the code: it can go down, never up. It is never taken from your ZCAT, and it lands in a fee vault that only the team can withdraw from and nothing else can touch.

• Frozen before public launch

  Once the first markets have run on real wallets, the upgrade key is burned. From then on nobody can change the program, including us. Until that moment this site says so, plainly, on the security page.

• Revoke in one click

  The approval is standard SPL delegation. Revoke it from Phantom, Solflare, or any wallet, without asking anyone.

• Same rules for every stonk

  Each token pair is a market on the same program: same code, same 2%, same floor, same one-click revoke. Nothing about a new pair is custom, so nothing about it is a surprise.

• Verified build

  Program ID published, source open. Verification badge reads “pending” until the reproducible build is registered.

The risks

• Payouts depend on ZCAT trading volume. No volume, no ZEC, nothing to compound.
• Every swap pays ZCAT's 3% transfer tax and the pool's trading fee, the same as any buyer on any DEX.
• Until the upgrade key is burned (planned before public launch, after the first real compounds are verified), you trust the deployer not to push bad code.
• Smart contracts can have bugs. This one is small, tested against snapshots of the real pools, and audited by two AI models with the reports published; it has not been audited by a third-party firm.

How to verify it yourself

1. Open your ZEC token account on Solscan. The delegate field shows the Vawlt's authority address and the allowance. Revoke it there any time.
2. Open the program on Solscan and confirm the upgrade authority matches what this page says.
3. Read the compound instruction in the source: the ZCAT destination is your associated token account, the Jupiter program address is a constant, and the floor on your enrollment is read, never written.