Security model.
The useful question is not whether we would take your tokens. It is whether the code lets us. Everything below points at a function you can read rather than a promise you have to accept.
Non-custodial, precisely#
The locker and the vesting contract hold tokens. That is custody in the literal sense, so the claim worth making is narrower and checkable: no function exists that lets anyone other than the rightful party withdraw them.
| Contract | Who can move tokens out | Under what condition |
|---|---|---|
| Locker | The lock's owner, and nobody else | At or after the unlock time |
| Vesting | The beneficiary, and nobody else | As the schedule releases |
| Burner | Nobody — ever | Tokens go straight to the dead address and never rest in the contract |
Note the absence rather than the presence. There is no rescue, no
sweep, no emergencyWithdraw and no pause that redirects funds. A backdoor you
cannot find is usually a backdoor that is not there, and you can check, because all three contracts are
verified on Blockscout.
What admin can actually do#
Each contract has an admin key. Its reach is deliberately narrow.
| Admin can | Admin cannot |
|---|---|
| Change the fee for new records | Touch any existing lock, schedule or balance |
| Change the fee collector address | Withdraw, redirect or freeze user tokens |
| Transfer the admin role | Alter an unlock date or a vesting schedule |
Two asymmetries worth knowing rather than discovering:
- Vesting has a hard fee cap of 0.05 ETH, written as a contract constant. No admin action can exceed it.
- The locker and burner have no such cap. The admin can set any fee for new records. Existing locks are never re-priced and withdrawal is always free, but the ceiling is not enforced in code.
The vesting contract uses a two-step admin transfer — transferAdmin then
acceptAdmin, so a mistyped address cannot strand the role.
Verify it yourself#
This takes about five minutes and does not require trusting anything on this page.
- Open a contract from the contract reference — the links go straight to the verified source tab.
- Confirm the source is verified. If it were not, nothing else here could be checked.
- Search the source for
withdraw. Read every match and confirm each is gated on the owner or beneficiary. - Search for
onlyAdmin. Read what those functions touch. You should find fees, the collector and the admin key, and nothing else. - Check that the fee constant matches what the app charges you.
How to read a contract on Blockscout covers the mechanics if you have not done it before.
Token quirks the contracts handle#
| Quirk | How it is handled |
|---|---|
| Fee-on-transfer tokens | The amount recorded is the balance the contract actually gained. Simple fee-on-transfer is recorded correctly; rebasing and reflection tokens are not supported and can leave the shared per-token pool short of what it owes. |
| Tokens that return no boolean | Transfers use a safe wrapper in the vesting contract rather than a raw require. |
| Overpaid fees | Refunded by the locker and burner. Not by vesting, which requires the exact fee. |
| Non-contract token addresses | Vesting rejects an address with no code, so a typo cannot create an empty schedule. |
What this does not protect you from#
Being clear about the boundary matters more than the reassurance.
- A malicious token contract. Locking a token that can be minted at will does not constrain the minting. Read the token, not just the lock.
- A compromised wallet. If someone controls the lock owner's key, they control the lock when it expires.
- Bad distribution. A locked balance says nothing about the other 95% of supply — check the holder list.
- Phishing. We will never DM you, never ask for a seed phrase, and never ask you to “verify” a wallet. Reach the app by typing the domain.
Reporting an issue#
If you believe you have found a vulnerability in any of the three contracts or in the site, report it privately before disclosing it publicly. A responsible report gives us a chance to protect the people currently using the contracts, which a public one does not.