Security

Wallet security

• Never share your seed phrase or private keys with anyone, for any reason.
• The Platform will never ask for them, and never asks you to “verify” or “migrate” a wallet.
• Read every signature request; if you cannot tell what it does, reject it.
• Keep approvals tight and revoke ones you no longer need.
• Use a separate wallet for trading, holding only what you intend to trade.

Smart contract security

Core contracts are non-upgradeable and vendored upstream components are unmodified where possible. A protocol configuration owner can change economic parameters for future activity but cannot resolve markets or take user funds.

Audits

No external audit has been completed. Internal test coverage exists in the repository, and that distinction is stated honestly on the audits page.

Bug bounty

There is no funded bounty programme yet. Reports are still very welcome and will be credited.

Responsible disclosure

1. Report it via the Contact page with a description, impact assessment and reproduction steps.
2. Do not exploit the issue beyond what is needed to demonstrate it, and do not touch other users' funds.
3. Give a reasonable window for a fix before public disclosure.

Phishing and official channels

Only the official domain kairo.market and the social accounts listed in the site footer should be trusted. Treat any other account claiming to represent this project as unverified.

Contact

Security reports: see the Bug bounty page. Everything else: the Contact page.