Self-test

Every claim this terminal makes, checked against the live chain in your browser: the vault key really is non-extractable, the private keys really never leave the page, and a buy on each venue really does execute — the engine builds the exact transaction it would sign, then runs it through eth_call on the current block with your wallet's balance overridden. Nothing is signed and nothing is broadcast.

10 passed · 2 warnings · 0 failed · 1 not testable from this page

Vault & keysisolated frame on https://vault.dartterminal.fun

pass The vault frame is on another origin and this page cannot read itframe origin https://vault.dartterminal.fun (this page: https://Dart.gift); it answered from that origin; reading it from here was refused: frame.contentDocument → null · frame.contentWindow.localStorage → SecurityError · frame.contentWindow.indexedDB → SecurityError · frame.contentWindow.location.href → SecurityError isolated

pass This origin holds no vault ciphertext and no device keythe vault lives on https://vault.dartterminal.fun; this origin's localStorage and IndexedDB hold none of it clean

pass Trading engine loaded and openopens itself on load — no passphrase step 0 wallets

n/a Encryption key cannot be read out of this browserthe device key lives in the IndexedDB of https://vault.dartterminal.fun; this page cannot open that store (see the isolation check above), so its extractable flag is checked inside the frame, not here in the frame

pass Keys at rest are ciphertext, not private keysnothing key-shaped in this origin’s storage; the ciphertext is in the vault frame clean

pass No key material is exposed on the pagethe wallet list carries addresses and names only; decrypted keys stay inside the engine module closure clean

Transport & isolationwhere this page talks

warn Every request stays on this origin, the vault origin, the RPC nodes or the sign-in providerthis origin, the vault (https://vault.dartterminal.fun) and the RPC nodes, plus the sign-in provider for login only: https://explorer-api.walletconnect.com, https://auth.privy.io 4 origins

pass Content-Security-Policy locks scripts to this origindefault-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data: https://auth.privy.io https://*.privy.io https://*.privy.systems; connect-src 'self' https://rob script-src 'self'

pass RPC robinhood-rpc.publicnode.comblock 88,537,711 · gas 0.0209 Gwei 94 ms

pass RPC rpc.mainnet.chain.robinhood.comblock 88,537,706 · gas 0.0209 Gwei 179 ms

Feedthe indexer behind this board

pass Indexer health2597 markets tracked · 5/5 feeds live · 70 blocks behind head block 88,537,643

pass Prices and gasETH $2442.83 · recommended 0.046 Gwei · a 400k-gas trade costs $0.0449 $2442.83

Executionreal calldata, eth_call against the live chain

warn Dry runscreate a wallet first — the preflight signs nothing, but it needs an address to simulate from

Every check ran against the live chain just now. The dry runs used the same code path as a real trade and stopped one step before signing.