Security

Last verified on chain 21 September 2026

This page lists the programs Vulcx runs on Fogo, who can change them, what has and has not been audited, and how to report a problem. Where something is weak, we say so here instead of leaving you to find out.

In short

• Two programs run on Fogo mainnet: the aggregator, which executes routed swaps, and subscriptions, which bills paid Portal plans.
• Both are upgradeable, and each is controlled by one key, not a multisig.
• The aggregator has no third-party audit and its source is not public.
• The subscriptions program is a public fork of the Solana Foundation program, which Cantina audited. Our changes to it have not been audited.
• Neither deployed binary can yet be matched to its source by a reproducible (solana-verify) build.

Deployed programs

Values read from https://mainnet.fogo.io with solana program show and solana program dump on 21 September 2026.

The executable hash is the SHA-256 of the dumped program with its trailing zero padding removed, which is how solana-verify get-program-hash computes it. It tells you whether the code has changed since this page was written. It does not prove which source the code was built from; that needs a reproducible build, and neither program has one yet. The deploy dates come from our deploy records, because the public RPC no longer serves blocks that old.

Audits

Aggregator: no third-party audit has been done. After the current deploy we dumped the program and compared it with a local build of the commit we meant to ship (4ce6b4e): the code bytes are identical. That is our own check. It is not an audit, and because the source is private you cannot repeat it.

Subscriptions: the upstream code is audited; our fork adds unaudited changes. The program is a fork of the Solana Foundation subscriptions program at release program-v0.5.0. Cantina audited that code; the reports are in the repo's audits/ folder. Our fogo branch changes two things, and no auditor has reviewed either change:

• the program ID. The program hardcodes its own address, so the upstream binary cannot run at ours;
• how new accounts are funded for rent. Fogo's rent parameters differ from Solana's, and the upstream code would under-fund accounts on Fogo. The fix adds one helper file and changes a few call sites (about 120 lines in program/).

To see the whole difference, compare program-v0.5.0 with fogo in the fork.

Upgrade authority

Both programs are upgradeable. Whoever holds a program's upgrade authority can replace its code at any time, with no delay and no second signer.

• Aggregator. The authority Ct1DVK…fpG2 is a single keypair. The same key is admin in the program's on-chain config account (3YBXPNkeGoCr6CNpDQ67iF3jYQfcwMPgLSoov3NvwF11), so it can also change the protocol fee (15 bps today; the program caps protocol plus integrator fees at 100 bps), change the fee recipient, and turn swaps off.
• Subscriptions. The authority Diqk84…QD23 is a separate single keypair that does nothing else. We kept it apart from the aggregator key on purpose, for the reason below.

Why there is no multisig yet. On Solana, a program's upgrade authority would normally be a Squads multisig. On Fogo mainnet today, Squads v4 is not deployed. Squads v3 is deployed, but it is upgradeable, and its upgrade authority is a single wallet (ADSmJz…4Hc8) set at genesis. We don't know who holds that wallet. A v3 multisig would therefore be only as safe as that unknown key, which is why we have not moved to one. We will revisit this when Fogo has a multisig whose own code cannot be changed by one party.

What this means for you:

• Swaps. The aggregator holds no standing approval over your tokens. It can only move what you sign for in a given transaction. A malicious upgrade could therefore affect swaps signed after it, but it could not reach tokens you never put into a Vulcx transaction.
• Subscriptions. Subscribing makes an address controlled by the program (a PDA) the SPL Token delegate on your USDC.s account with an unlimited allowance (u64::MAX). That is how the upstream program works. The current code only lets a plan's listed puller collect up to the plan's price each period. A malicious upgrade could remove that limit and move USDC.s from any subscriber's account without a new signature. This is why the subscriptions key matters more than any other key we hold. Cancelling a subscription does not remove the approval; to remove it, revoke the delegate on your USDC.s account in your wallet.

What the API can and cannot do

• It builds transactions; it never signs them. The routing API at api.vulcx.xyz returns unsigned transactions or instructions. Your wallet signs them, and Vulcx never receives your private keys.
• It can still return a bad transaction. A bug or a compromised server could return a transaction you did not intend to sign. Check what your wallet shows before approving, including the programs the transaction calls and the amounts. A Vulcx swap calls the aggregator program above.
• Fees and slippage are enforced on chain. The program rejects protocol plus integrator fees above 100 bps, and it checks your minimum output after fees are taken. The API can quote whatever it likes, but a swap that breaks either rule fails on chain.
• API keys and rate limits are off-chain only. They control access to the API. They play no part in the on-chain programs.
• Billing uses one server key. A server-held puller key collects subscription payments. The program only lets it pull up to a plan's price each period, and only into the treasury account the plan names. If that key leaked, an attacker could trigger the normal per-period charge into that treasury, but could not take more or send it anywhere else.

Reporting a vulnerability

Contact us on Telegram at t.me/vulcxsupport before telling anyone else. This is the same contact as our security.txt. Please don't post exploitable details in a public channel or issue.

In scope: the two programs above, the routing API (api.vulcx.xyz), the Portal (portal.vulcx.xyz) and this website. Out of scope: the venues a route passes through, the Fogo runtime and its RPC nodes, and wallets.

Please include:

• what is affected: the program ID, endpoint or page;
• steps to reproduce, or a transaction signature or simulation that shows the issue;
• what you think an attacker could do with it;
• how you would like to be credited, if at all.

What to expect: we will acknowledge your report within 72 hours and tell you plainly whether we agree it is a problem. We are a small team, so fixes take as long as they take, and we will keep you told. There is no bug bounty programme today.

Check it yourself

These commands only read from the chain. They need the Solana CLI:

solana program show Vu1cUxynmbPUsFqVz51FJJ2y69vX2yrkTS13ajomd9D --url https://mainnet.fogo.io
solana program show Sub6S6TFFehq9QKvpBActTRYgopMcC3D56uVmjfNUFh --url https://mainnet.fogo.io

# executable hash, if you have solana-verify installed
solana-verify get-program-hash Vu1cUxynmbPUsFqVz51FJJ2y69vX2yrkTS13ajomd9D --url https://mainnet.fogo.io

If the authority, slot or hash you get differs from this page, the program has changed since we last updated it. Please tell us.