$DARTSOON
Security Center · architecture transparency

security

Where your keys live, what Dart can and cannot touch, and eight checks you can run in this browser right now.

betano independent audit yetchecks · not run yet
Honestly: no independent audit has been done yet. Below is how the protection is built, what we tested and how, and what remains. When volume justifies it a certified firm audits Dart and the report lands here. Until then keep in your trading wallets only what you are actively trading.
01

where your keys are

hover or tap a point on the line

outside the key pathholds no keys · serves the page and the engine · the real risk is altered JavaScript

in your browserTrading walletsbrowser vault
generated
in your browser
stored
AES-GCM-256 ciphertext; the encryption key is a non-extractable CryptoKey in this browser's IndexedDB — it cannot be copied out, and it sits in the storage of vault.dartterminal.fun — a separate origin the pages' scripts cannot reach
signs
the engine, in the page — nothing leaves; exports and outside transfers need a 2FA code the engine itself verifies with the server
recovers
backup file (passphrase, PBKDF2 600 000 rounds) restores on any device; private-key export behind 2FA
hover a point · click to pin

Dart's own description of its architecture, drawn from the code — not an independent verification. The checks below test parts of it in your browser.

02

what Dart cannot — and can — do

cannot — while the page you run is the real one

Move your trading fundsthe server never holds those keys: they exist as ciphertext in your browser and in your backup file. Only altered page code could reach them — the right column is about exactly that.

Sign with your main walletsigning needs your Privy session and happens in Privy's enclave.

Read your private keys from the serverthey never travel there. In the browser the decrypted keys live inside the engine, not on window; the encryption key cannot be copied out of this browser, and since 13 Oct the vault runs on its own origin, vault.dartterminal.fun, whose storage this page's scripts cannot reach at all.

Change a transaction after Buycalldata is built, dry-run and signed in your browser; the server serves data and sees the signed transaction no earlier than the node does.

can — and how you would notice

Ship the page and enginea hacked server could ship altered JavaScript — the real risk of any web wallet, and the one every "cannot" rests on. The engine is hash-pinned (SRI), hashes are in /releases.json, CSP blocks inline and third-party scripts, and the engine itself asks the server to verify your 2FA code before an export or an outside transfer — a script that skips the page dialog still needs your code.

See your trading addressesthey are public on chain anyway; the page sends addresses, never keys.

Show a wrong price or routethe engine dry-runs every buy with eth_call first, so a broken route fails in the preview, not with your money. A deliberately wrong quote is not caught by that — compare the quote with the chart before Buy.

Go offlineyour keys stay in your browser and your backup file; export them and use any wallet.

03

sign-in · 2fa · signing

1

Sign-in

  • Privy session — email / Google / passkey / wallet
  • sessions expire; the page re-checks them
  • Dart stores no password of yours
2

Two-factor

  • TOTP app + ten one-time recovery codes
  • you choose the gates: outside withdrawals, key export, transfers, backups
  • a correct code opens the action for 10 min in this browser; repeated wrong codes lock 2FA for a while
  • the engine checks the code with the server itself, from inside the isolated vault origin, so page scripts cannot skip the gate
  • 2FA secrets sit encrypted on the server and can never move funds by themselves
3

Signing

  • trading wallets sign in the page — no pop-ups, no confirm step: speed is the point of a terminal
  • that is why 2FA sits on the exits
  • no method signs arbitrary calldata or messages: the engine composes every transaction itself
  • the main wallet signs through Privy's flow with your session
04

if something goes wrong

The server is hacked

  • No keys to steal there — the server holds your session, settings and encrypted 2FA secrets, never wallet keys
  • The danger is a modified page. The engine's hash is pinned in the page and published; compare it with the release file (the check below does)
  • Limitation, plainly: hashes published by the same server cannot prove the server is honest — that is what an independent audit and an open-source engine are for

The site is down or gone

  • Your trading keys are still here — in this browser's storage and in your backup file
  • export a private key (2FA) and import it into any wallet; the backup file opens with your passphrase in any browser via the restore flow
  • your Privy wallet is reachable through Privy, independently of Dart
05

checks you can run now

computed in this browser · nothing shows pass until it ran
a wallet in the vault makes more of them meaningful — create one in Wallets if you have none
not run
Local vault encryption

the trading keys are stored encrypted; the encryption key cannot be copied out of this browser and lives on the vault origin, not here

not run yet — press Run checks

not run
Nothing key-shaped in storage

this origin's storage holds ciphertext only — no private key, no mnemonic

not run yet — press Run checks

not run
No key material on the page

the wallet list exposes addresses only; nothing secret hangs on window

not run yet — press Run checks

not run
Browser isolation of the vault

does the vault run on its own origin, out of reach of the page's scripts?

not run yet — press Run checks

not run
Content-Security-Policy

scripts may only come from this origin — no inline, no third-party script hosts

not run yet — press Run checks

not run
Release integrity

the engine file served right now hashes to what the page pins and what /releases.json publishes

not run yet — press Run checks

not run
Two-factor protection

is 2FA enabled on your account, and which actions does it gate?

not run yet — press Run checks

not run
Transaction simulation

a real buy, built by the engine, run through eth_call with your balance overridden — nothing signed, nothing sent

not run yet — press Run checks

The fuller, more technical version is the self-test: it also dry-runs a real buy on every venue through eth_call without signing anything.

06

checked — and not yet

done

✓
Internal security review · 13 Oct 2026custody model, vault isolation, 2FA, CSP, server hardening, dependencies — findings and their status in the public summary
✓
Vault on its own isolated origin · 13 Oct 2026the keys live in a frame on vault.dartterminal.fun: a separate origin with its own storage and a policy that names the RPC nodes only; wallets made before were moved in once, encrypted
✓
2FA enforced inside the engineexport, backup and outside transfers need a code the engine verifies with the server; a script that skips the page dialog is refused
✓
308 automated testspin the signing paths, the vault protocol, the CSP and the release pinning on every deploy
✓
Browser self-test on every venuereal calldata, eth_call with your balance overridden, nothing signed
✓
Release integrityengine hash-pinned with SRI, hashes published per release

not yet

○
Independent auditplanned once volume justifies it; candidates: Trail of Bits, Cure53, Zellic
○
Public bug bountycoming; until then send a direct message to @dartterminal — serious findings are fixed first and credited here
○
Open-source enginebuilt from src/webEngine.ts; publishing it is the next transparency step
07

evidence

Security · 2FA Custody · keys and backups Self-test releases.json Security review · 13 Oct 2026 Security changelog Privy docs

Found a problem? Send the details by direct message to @dartterminal — please do not post them publicly; serious findings are fixed first and credited here.

15$3.5K0.046