Skip to content
Hushd
Open app
04 / 04

Security

Where Hushd stands today, without the gloss: what protects you, what it rests on, and how to tell us when something is wrong.

Last updated 6 November 2026

Where it stands

Testnet onlyEvery contract runs on NEAR testnet, with test tokens that have no value.
Development proving keysThe Groth16 keys come from the public Perpetual Powers of Tau, one phase-2 contribution and a public beacon. Whoever made that contribution could have kept its entropy and forged proofs. Real value needs a multi-party ceremony first.
Not auditedThe contracts, circuits and services have tests and automated security scans, and every contract on testnet is a reproducible build anyone can rebuild from its commit. No external audit has been done.

What protects your notes

  • Only the holder of a note's spending key can spend it. The pool has no admin withdraw.
  • Every spend is a Groth16 proof the pool checks on chain, with NEAR's alt_bn128 host functions. A cash out's recipient, fee and refund note are bound into the proof.
  • Both legs of a spot deal settle in one call, or neither does.
  • Pool rule changes wait out a public timelock. The owner can pause new deposits, never cash outs.

What it rests on

  • The relayer can refuse or delay an action, never change it.
  • The matcher enclave keeps requests, limits and quotes private and applies your limit. That rests on its TEE (Intel TDX, run by OutLayer).
  • The intake model reads your words inside NEAR AI Cloud's attested TEE. It only drafts.
  • Hushd's API passes on sealed messages it cannot open, but sees IP addresses, timing and deal-room traffic. The matcher client builds the enclave's batch of quotes and could leave one out. The keeper alone reports whether a hedge filled, which releases or slashes the maker's bond.
  • The app you load handles your seed. It is open source, and you can build and run it yourself.

Each of these, and what happens if it fails, is in the threat model.

Report a problem

Open an issue on GitHub. If the problem could put someone at risk, write only that you found one and ask for a private way to share it. Please do not post details until a fix is out. There is no paid bug bounty.

Testing rules

  • Test against NEAR testnet or a local sandbox.
  • Do not degrade the shared faucet, relayer or API for others.
  • Do not try to read or move anyone else's data or notes.

In scope

The contracts in contracts/, the circuits in circuits/, the matcher in matcher/, the services in services/, the SDK and MCP server in packages/, and the app at hushd.net.

Back to home