OmnipairDocs

Security

V1 was audited in February 2026. The V2 program is not yet audited, runs only on devnet and can be rebuilt from source to match the deployed binary.

Updated Nov 9, 2026

The app's own security page is the canonical statement on Omnipair's security.

Audits

ProgramFirmScopeDate
V1 (omnipair-rs)Offside LabsCore protocol and programsFebruary 2026
V1 (omnipair-rs)AckeeFuzzing testsFebruary 2026
V2 (Dusk)——Not yet audited

Every finding from the V1 audits was resolved; the reports are public in the V1 repository.

Verifiable builds

Both the V1 and the V2 programs use Anchor's verifiable build system, so anyone can rebuild the program from a tagged source commit and compare the hash with the on-chain binary. The V2 repository keeps its build records under verifiable-builds/; the app pins the exact program ID, IDL hash and SDK artifact hash it was compiled against, listed on Addresses, and refuses to enable transactions when the live deployment does not match.

How the app protects you

  • Every quote is a simulation of the exact instruction, and every swap, borrow and withdrawal carries your minimum output on-chain.
  • Before enabling any transaction, the app verifies the deployment identity: cluster, program ID, IDL hash and protocol revision.
  • The app reads display state from the indexer, never from a fallback that could show a different market than it transacts with.
  • Wallets on a public blacklist are disconnected.

Reporting a vulnerability

Write to security@omnipair.fi. Please include the affected component, a reproduction, and the impact you believe it has. The commitments:

  • Safe harbour. Good-faith researchers who report responsibly will not face legal action.
  • Response time. Initial reports are answered within 24 hours, and researchers are kept updated throughout.
  • Coordinated disclosure. A disclosure timeline is agreed with the researcher and set to protect users.

In scope: smart-contract logic and state handling, frontend vulnerabilities that affect funds, cross-program reentrancy, and access control or privilege escalation. The app's security page carries the bounty terms.

Licence

The V2 protocol source is published under the Business Source License 1.1, with Omnipair DAO LLC as the licensor. Read the licence file for the additional use grant, the change date and the change licence. The SDK package is MIT.