Security

Nexrow never takes custody of your money. When a client funds an escrow, the USDC moves into an account owned by the Nexrow escrow program on Solana. It does not move into a Nexrow bank account, a Nexrow treasury wallet, or a pooled balance we control.

The practical test of a custodial service is simple: could the company run away with the money. For a custodial escrow, the answer is yes, and you are trusting them not to. For Nexrow, the program that is running today gives us no path to your funds — no admin key that drains an escrow, and no instruction that pays us anything the escrow’s own rules do not already allow.

There is one caveat, and you should hear it from us rather than discover it. The program can be upgraded, and the key that can upgrade it is, right now, a single developer key. Whoever holds that key could deploy a new version of the program with different rules, and a new version could reach escrows that are already funded. So the honest claim is not “Nexrow can never touch your money.” It is narrower and true: the code holding your money cannot be changed without that key, any change is a public on-chain transaction, and the version running today grants us no way in. Before mainnet, that upgrade key moves to a multisig, so no single person — us included — can change the rules alone.

We can:

• Build the transaction that funds an escrow, and hand it to your wallet to approve.
• Show you the state of an escrow by reading the chain.
• Take the platform fee at release, at the rate that was fixed when the escrow was created.
• Submit a dispute resolution to the program after an arbiter has decided one.

Under the rules of the program running today, we cannot:

• Move funds out of a funded escrow to ourselves, or to anyone the program's rules do not permit.
• Stop an auto-release from firing once its window has closed.
• Reverse a release, a refund, or any other confirmed transaction.
• Freeze your wallet, or spend from it, or sign anything on your behalf.
• Change the fee on an escrow after it has been funded.

Those limits hold for as long as the deployed program does. The one thing that could change them is a program upgrade, which the upgrade key described in section 1 currently makes possible for a single keyholder. That is the honest boundary of “we cannot,” and it is why that key is moving to a multisig before mainnet.

A funded escrow holds USDC in a program-derived account. The program releases it on exactly three triggers: the client approves, the auto-release window expires, or a dispute resolution is executed. There is no fourth path, and there is no manual override.

Every one of those movements is a public transaction with a signature you can check yourself on Solana Explorer. Nexrow links the signature next to every state change in the app precisely so you never have to take our word for what happened. Do not take our word for it. Check.

The escrow program is the security boundary of this product, so it is deliberately small and boring. It does one thing, its rules are fixed, and there is less of it to get wrong.

It has not been audited. An independent third-party audit is planned before mainnet, and we will publish the report in full, findings and all, when it is done. Until then, treat the program as unproven code. Nexrow is currently running on Solana devnet, which means the tokens moving through it are test tokens with no value. Do not treat devnet balances as real money.

No audit eliminates risk anyway. Any on-chain program can contain a defect nobody has found yet, and anyone who tells you their contract is impossible to break is selling something.

When Nexrow needs your authorization, we build a transaction and pass it to your wallet. Your wallet shows you what it does, you approve or reject it, and your wallet signs it with a private key that never leaves your device. Nexrow does not see that key at any point, and cannot, because it is never transmitted.

Sign in works the same way, except the thing you sign is a plain text message rather than a transaction. It proves you hold the key. It moves nothing and approves no spending.

Read what you sign. Nexrow will never ask for your seed phrase, and will never ask you to approve a token transfer or a delegate approval during sign in. Any site or message that does is trying to rob you, whatever it looks like.

Passwords are hashed, never stored in a form we could read. Sessions are listed in Settings under Security, with the device and last activity for each, and you can revoke any of them. Revoking a session invalidates its token immediately.

An authenticator app as a second factor is in progress. Wallet sign in already gives you a strong second factor today, since it requires possession of the key.

If you have found a vulnerability, we want to hear from you before anyone else does, and we will treat you well for telling us.

• Email us with enough detail to reproduce the issue. A proof of concept helps.
• Give us 90 days to ship a fix before publishing, or less if we ship sooner.
• Do not exploit the issue beyond what is needed to demonstrate it, do not access or modify anyone else's data, and do not degrade the service for other people.
• Test against devnet. Never against a real user's funds.

Stay inside those lines and we will not pursue legal action against you for the research. We will acknowledge your report within 3 business days, keep you updated while we work, and credit you when we announce the fix, unless you would rather we did not.