How Ecrin keeps your money safe, and what's still missing.
Ecrin is a beta on test networks. This page says plainly what protects you today, what has been tested, and what has to happen before real money.
Status
Ecrin never holds your keys or your funds. Only your wallet can ask for a withdrawal.
Delays, the lock, the guardian and limits are enforced by the Solana program and the Ethereum contract, not by this website.
Every line is public on GitHub.
Rule tests, on-chain tests on a real Solana validator, contract tests and browser tests run on every push.
No independent firm has reviewed the code. Test coins only until that's done and fixed.
The program can still be upgraded by one key while it's tested. Before mainnet that key moves to a multisig, and later the program is made immutable.
The rules, and why they hold
- Every withdrawal to a new address waits your delay, from an hour to a year, and you can cancel it until it runs.
- Only your trusted addresses are instant, and adding one waits days (or needs your guardian).
- Loosening any rule waits; tightening applies at once. A stolen key can freeze your vault, never empty it.
- A guardian can only approve what you asked for: release a withdrawal you requested, or a trusted address you proposed. They can't start a withdrawal or choose where money goes.
- There is no receipt token, so nothing can be sold to get around the delay.
| Way around it | Why it fails |
|---|---|
| Import your key into another wallet | The key can only request a withdrawal. The program still enforces the wait. |
| Turn the rules off | Loosening any rule waits days, and never before a lock ends. |
| Add the attacker's address as trusted | New trusted addresses wait days, or need your guardian's approval. |
| Name a second wallet as guardian | Any guardian change waits days, so no one can approve their own withdrawal. |
| Sell a receipt token for instant SOL | Unlike liquid staking, there is no token to sell. |
| The developer changes the code | The program will be made immutable after its audit. |
What is tested
- The rules (crates/vault-core): every delay, cancel, guardian and limit case, in Rust and in the browser's copy.
- The Solana program on a real local validator, SOL and USDC token vaults included.
- The Ethereum contract: ETH, USDC, tokens that return nothing (like USDT), tokens that take a fee, refused transfers and re-entry attempts.
- The app, end to end in a browser against both local chains, and the alerts that watch every vault.
Official addresses
Only use Ecrin at ecrinprotocol.app. These are the programs and contracts the app talks to; check them in your wallet before you sign.
What Ecrin can't protect you from
- The coin's issuer. Circle can freeze USDC at any address, a vault included.
- Money already sent to a trusted address, which is instant by design. Trust only addresses you control.
- Not noticing. A delay only helps if you see the request: turn on alerts.
- Fake websites. Check the address bar, and bookmark ecrinprotocol.app.
Found a flaw?
Please tell us privately before telling anyone else, so it can be fixed first. Describe what you found and how to reproduce it; never test against other people's vaults.
A paid bug bounty starts with the mainnet launch.