Open app ↗The smaller the trust surface, the smaller the failure surface.
LOSURIA chose constraints over features. Immutable contracts on Ethereum mainnet. No hidden admin keys, a minimal, bounded admin surface, no contract pause switch, no upgrade proxy.
The fee collectors, LSR token, DEX and both forwarders are owner-less. The Subscription owner has bounded pricing and programme controls; its separately readable referral manager can only toggle KOL eligibility. LOSURIA can fail closed by stopping its own new relay submissions, but cannot seize assets or rewrite signed orders; owner cancel, recovery and direct on-chain execution remain available. Private execution is used where the supported chain path provides it. Every claim below is independently verifiable.
Constraints, shipped on purpose.
Most security incidents in this market originate from controls the operator never should have shipped. We chose not to ship them.
- No hidden admin keys, no upgrade, no pause in the active release contracts. The fee collectors, the LSR token, the LOSURIA DEX and both forwarders are owner-less — any
owner()call reverts or no owner role exists at all. The Subscription isOwnableto the operator Treasury; its plan prices remain bounded to 50–200 % of their deployment values. A separate on-chainreferralManagerrole can only allow or disallow KOL addresses; it cannot move funds, change price or alter code. No on-chain operator role can pause execution inside those deployed trading contracts, drain user funds, mint new supply, or upgrade implementation bytecode. User assets remain reachable on-chain regardless. - No proxy / upgrade path. Every contract is a final-bytecode deployment. No delegatecall to a mutable implementation. The bytecode at the deployed address today is the bytecode forever.
- No contract-level pause; bounded relay stop. The immutable trading contracts contain no operator pause or upgrade path. The execution service does have one fail-closed switch that can refuse new LOSURIA relay transmissions before they are claimed or submitted. It cannot alter a signed instruction, revoke the owner's own authority, seize funds, or block owner cancel and recovery. This separates incident containment in the hosted service from custody or control over the wallet.
- No persistent custodial reserve. The backend persists no Wallet owner key and no raw API credential. Current execution uses your signed order; no new operational key or server-held session key is created or retained, and the value stays in your own wallet until the immutable executor fills that order under the on-chain allowance you granted. Revoking the allowance ends the current authority without LOSURIA. Current Wallets use a random master seed encrypted with a key from the passkey's private WebAuthn PRF output; owner keys are derived from that seed only in the browser.
- No off-chain fee path. All fees settle atomically inside the same transaction as the trade — Ethereum: the immutable DAI collector contract; Base: the treasury, in WETH; Solana: the immutable operator address receives native-input fees in its wSOL account and token-input fees in the corresponding input-mint account; Monad: charged inside the LOSURIA DEX pool's
swap()itself, to the fee recipient fixed immutably at deploy. Solana receipts are recorded only after the exact on-chain fee delta is confirmed. No off-chain settlement, no IOU ledger, no rebate accrual that depends on the operator staying online. - Stablecoin in the Ethereum fee sink. The Ethereum collector sinks to DAI; see the per-chain table above.
Live on Ethereum mainnet, every byte verifiable.
Each active-release entry below resolves to the live bytecode at its address on its respective production network. The Verify page links every address to its public source record; Sourcify exact_match is the byte-for-byte source check where available.
Every listed active-release address has a public verification status and its network is stated in the table and on the Verify page. The Subscription's bounded owner and referral-manager roles, immutable fee destinations and absence of owner roles on fee collectors, LSR token, DEX and forwarders are independently readable on-chain. Current first-block orders are Owner-signed and bind amount, recipient, output floor, fees and windows. An EVM wrapped-native allowance to the immutable executor may be reusable, but it cannot move funds without a matching signature. A no-exit fill settles directly to the signed recipient; a pre-signed exit plan keeps its token in isolated executor accounting until exit or Owner recovery. The KOL rev-share can never pay more than the amount credited on-chain.
Verify it yourself, no third party required.
Addresses with a Sourcify match are source-verified on the open, free, decentralised registry; an exact_match is the strictest grade Sourcify issues (constructor args + metadata hash both line up).
Open the LOSURIA Subscription lookup and you see the Solidity source side-by-side with the on-chain bytecode, with an exact_match at 0x11Eb592D…35052dcc.
An Etherscan verification badge is an additional public verification surface; Sourcify remains the canonical trust signal for the current release because its status is linked above. The bytecode-pinning table below makes the verification provider irrelevant, you can verify without trusting any third-party verifier.
For the spot-check from a terminal, the on-chain bytecode is one cast call away, no clone required:
cast code 0x11Eb592D0771B2b0c80571728534838135052dcc \ --rpc-url https://eth.llamarpc.com # any mainnet RPC works # The result is content-addressable, so future verifiers get the # same bytes regardless of which RPC they ask.
For a deterministic spot-check, every contract's runtime-bytecode sha256 is pinned below. Each hash was recorded at mainnet block 25 512 495 (July 11, 2026) and can be reproduced from the public chain state; non-upgradeable contracts are immutable, so the hash matches forever. Pipe cast code into sha256sum and the digest must match this table, line-for-line.
# Verify any row deterministically: cast code <ADDRESS> --rpc-url <ANY_RPC> \ | tr -d $'\n' \ | sha256sum
Full 64-character digests, no abbreviation, in table order: 4990c3c09abb896c84b42c0459da0ab4723aded98da8783f3de1bca7b9e21236 · 0006b47982155ba8a7eddd0176c456b4b3617d6ba3d7a3f04a26790b93bebeda · 0d67e6705cb54b08a3f9043ff089da1cc2292c5f64096cccb879deeb3b66dc7a · 7d4df3a1390fdd0ad3379d85062b156ea7efcb0f94c7f8daed3b45fccd8d926d · db4ba781de10a3f28cf8368845b2a9cfdc93db58260a93347f36efe7340d9872 · acd8cf2c77a2c545d846b1ce0b89780a6d684901bcbf6bb37e608a47b5b70e3b.
If you find a source-vs-bytecode mismatch on any address above, that is a security incident. File it in-app under Settings · Support; the ticket is bound to your wallet, the reply lands as a push notification, and the operator reads every one.
A full source repository mirror is part of the post-launch transparency roadmap; until then the Sourcify exact-match record is the canonical third-party artifact.
Live evidence, not slogans.
Three pages anyone can open right now. No selection, no curation, sourced from the live system.
/trades lists every executed swap, with the tx hash and Etherscan link. No selection, no curation. /latency shows p50 / p95 / p99 per chain over the last hour, day, week, measured on the live execution path — Ethereum swaps on the dedicated execution path, snipe detect-to-submit on the RPC endpoint bound to that order — not a marketing claim. /architecture documents every component of the platform with its threat-model boundary and the test that proves it, updated whenever the stack changes.
Verify against source, not against a logo.
No independent third-party security audit of LOSURIA's deployed contracts has been completed or publicly commissioned. Until an independent report is published, the security model stands on three claims that anyone can check against the deployed bytecode and, where available, its matched source today.
- The contracts are immutable. There is no path for the operator to introduce a bug after deployment.
- Where a deployment has a Sourcify
exact_match, its source matches the bytecode. That strict verification means an outside reviewer can read exactly what executes; the Verify page names deployments whose source match is still pending. - The bug-class surface area is small. The disclosed Subscription owner has bounded price/programme controls, and the disclosed referral manager can only toggle KOL eligibility. Neither role can drain user funds, mint supply, pause a deployed trading contract or upgrade bytecode. The separately disclosed server switch can only stop LOSURIA's own new transmissions; owner cancel and recovery remain reachable.
No independent reviewer or scope has been publicly confirmed for a formal Tier-1 review. If an independent review is commissioned, its final report and material findings will be published. Until then, the source itself is the available proof: read exactly what executes and verify it against the bytecode.