Architecture · v1.4 · 2026-08-01

From your device to a confirmed transaction, a clear chain of controls.

Every key path, execution boundary and fee path below is sourced from the deployed contracts and running backend. Each chain uses the execution path shown in the app; selected Solana and bring-your-own-RPC browser paths use the endpoint shown in the app, while automated Monad sniping uses the backend relay path.

Smart-contract source open on sourcify.dev · verified source. The trading engine stays proprietary; protection comes from the on-chain footprint, not from secrecy. Read it before you fund anything.

Open the app Security page

01 · Hot-path

PWA, signing, protected execution, on-chain.

A bounded chain of controls between a passkey confirmation and a landed block. Each layer below maps to one boundary.

+--------------------------------------------------------------------+
| L4   PWA shell                                                     |
|      React + Vite. Service Worker. iOS Safari / Android Chrome /   |
|      Desktop / mobile PWA. No app store, no extension.             |
+----+---------------------------------------------------------------+
     |  touch / Face ID / passkey ceremony
     v
+----+---------------------------------------------------------------+
| L3   Signing                                                       |
|      A random master seed is created in-browser and protected by   |
|      the passkey's WebAuthn PRF. The EOA key materialises only     |
|      after a fresh ceremony, signs one operation, then is dropped. |
|      First-block execution submits an EIP-712 order you signed;   |
|      no new key is left behind on the current execution path.                              |
+----+---------------------------------------------------------------+
     |  signed payload (no key material) over HTTPS
     v
+----+---------------------------------------------------------------+
| L2   Backend + protected execution path                            |
|      Rust (axum + tokio). Reads and submits through the configured  |
|      execution path. Backend sees ciphertext and signed payloads,  |
|      and no key of the user's — there is no mode that puts one     |
|      here.                                                         |
+----+---------------------------------------------------------------+
     |  signed payload through the supported private relay path
     v
+----+---------------------------------------------------------------+
| L1   Protected relay                                              |
|      The supported private relay path submits the signed payload   |
|      without a public-mempool fallback.                            |
+----+---------------------------------------------------------------+
     |  block N confirmation
     v
+----+---------------------------------------------------------------+
| L0   Ethereum mainnet                                              |
|      LOSURIA DEX + the major Ethereum pools (best quote). Anti-rug |
|      LP-monitor on tokens you hold; trip -> checks your owner-signed|
|      stop-loss authorisation. Without it, alert only; no server key.|
|      A heuristic, not a guarantee.                                  |
+--------------------------------------------------------------------+

02 · Wallet

Passkey, wallet, snipe auth.

Owner signing requires a fresh passkey ceremony. Derived key material is kept only for the operation and byte buffers are zeroed afterwards. First-block execution submits an order you signed; no server-held session key is created. A reusable EVM executor allowance may remain, but it has no spending effect without a matching Owner signature.

Passkey owner

Your authenticator or password manager protects the passkey credential. On wallet creation the browser generates a random 32-byte master seed and encrypts its server envelope with the passkey's private WebAuthn PRF output; the public credential ID is not accepted as a server wrapping key. A fresh ceremony unlocks derivation for one operation. Afterwards the app drops wallet references and zeroes the byte buffers it controls. LOSURIA does not receive the plaintext master seed or Wallet owner key.

↓ authorises

Your wallet

The secp256k1 address derived from that master seed is the wallet — a plain EOA. Recovery requires an enrolled or synced PRF-capable passkey that can open its envelope, an encrypted device-pair/vault path, or an independent export you created. Funds, tokens and approvals live on the EOA. Swaps and native sends route through immutable forwarders that settle the platform fee (1 % swap · 0.05 % send) atomically — no contract wrapper around your funds and no deployment step.

↓ authorises

Snipe authorisation

Signed order: wrapped-native remains in your wallet until fill. The immutable executor may hold a reusable allowance, but can pull only through a valid Owner-signed order and only for the amount and recipient it names. A no-exit fill settles directly to that recipient; a pre-signed exit plan keeps the purchased token in per-order isolated accounting until exit or Owner recovery. On Solana the buy and conditional order are built, checked and signed locally. Cancel on-chain or revoke the executor allowance without LOSURIA; revoking the shared allowance can stop all pending EVM orders that depend on it.

03 · Trust model

What you trust LOSURIA for vs. what is verifiable.

If a fact is on-chain you can prove it yourself; if it is operational we say so.

Verifiable on-chain · no operator trust required

Subscription is non-custodial, each payment transfers straight from your wallet to the immutable Treasury via LosuriaSubscription; the contract never holds funds and you can cancel anytime on-chain.
Subscription billed in DAI per 30-day period, Pro plan ≈€20, Whale plan ≈€200; each plan price is bounded on-chain to a 50–200 % corridor around its deploy value.
Fee destination: immutable per swap leg. On Solana the exact input fee goes to the fixed operator address — as wSOL for SOL input and in the respective mint for token input. The operator cannot redirect collected funds.
LSR token: 1B fixed supply, no mint(), no upgrade path.
Monad: swaps and snipes execute on the LOSURIA DEX, our own immutable DEX. Automated sniping uses an order signed by the User and relayed through the immutable on-chain executor; the backend watcher uses the configured execution RPC, so no browser-held signer, WSS endpoint or open tab is required. Manual Monad actions may use the endpoint shown in the app. The 1 % platform fee is charged inside the pool's swap() itself, with no admin, no upgrade and no fee-free route around it.

Operator trust · what we ask you to take on our word

Dedicated execution is measured on the live path and published at /latency; the page reports measurements, not infrastructure coordinates.
Trading engine source is proprietary. Every routed swap is listed at /trades with its tx hash, so the route and the fee leg can be checked on-chain against any of them.
Backend stores public passkey records, PRF-encrypted master-seed ciphertext and signed payloads, never the plaintext Wallet owner key. The current execution path receives no Wallet-owner key or server-held signing key. Every automation is bounded by the input, recipient, floor, fee ceilings and windows in the Owner signature. A reusable EVM executor allowance cannot replace or enlarge those signatures.
Operator authority is limited to the owner roles and bounded controls disclosed on the Verify page. Those addresses, powers and immutable fee destinations are independently readable on-chain.
RPC boundary: Each chain uses the endpoint and execution mode shown in the app. Selected Solana and bring-your-own-RPC browser paths expose requests to the endpoint shown in the app; manual Monad actions may do the same, while automated Monad sniping uses the configured execution path.

04 · Deployment

Addresses on Ethereum mainnet.

Every address has an explicit verification status on the open Sourcify registry; exact_match is the byte-for-byte source proof where available. Click any row for the lookup; the /audit page has the deterministic bytecode sha256s.

LOSURIA Subscription0x11Eb592D…35052dcc ↗

Conditional Snipe Executor · Ethereum · V50x4cfe1230…f5af6e4 ↗

Conditional Snipe Executor · Base · V50x7a7dffdd…f618b91 ↗

Conditional Snipe Executor · Monad · V50x5410f056…8c76981 ↗

Swap Forwarder · 1% fee0xa186b51B…4f172993 ↗

Send Forwarder · 0.05% fee0x87f4c561…2F22D313 ↗

LOSURIA DEX Factory0x43C27ccA…294c3cE7 ↗

LOSURIA DEX Router0x7076C08A…15060019 ↗

LSR token0xe9126022…b339db04 ↗

Source verificationsourcify.dev · verified source ↗

05 · Security posture

Every key path on the page.

If a key can sign for you, it appears in the table, with the holder and rotation path.

Key path

Scope

Holder

Rotation

WebAuthn passkey

Protects the encrypted wallet-seed envelope through private PRF output

Your selected passkey provider

Encrypted backup, pairing or passkey renewal

Signed snipe order

Only the input, recipient, floor, fees and windows in the signature

Signed on your device · no Wallet-owner key reaches the execution path · the immutable executor verifies it on-chain

Owner cancel recovers an open position; revoking the shared executor allowance stops dependent unfilled EVM orders

Relay submission

Submits only an owner-signed order within its encoded limits

No Wallet-owner key reaches the execution path

Order expiry, owner cancel or allowance revoke

Whale-plan subscriber

20 concurrent grids · 20,000 Intelligence requests per UTC day · programmatic trading API to the execution engine, rate-limited; every order retains its owner-signed gas ceiling

You · your passkey-protected wallet

Cancel anytime on-chain

Fee Collector

Receive ETH · sweep to treasury

No admin · immutable

Impossible by design

LSR

1B fixed supply · ERC-20 Permit

No mint() · supply fixed at deploy