Security

This page explains plainly what is enforced by the blockchain, what the Pairity platform holds and controls, and the protections around both. Knowing the difference helps you decide how much to trust each part.

Your wallet stays yours#

• Non-custodial trading. Every trade and launch is a transaction your own wallet signs. The platform never holds your keys and never trades for you. This is the same for the website, the Agent API, MCP and Blinks: they only hand out unsigned transactions.
• Signed messages move nothing. Creator actions (AI tasks, saving skills or AI rules and roles, approving a proposal, generating an API key, publishing the AI site, linking Telegram, connecting X) and the AI chat sign-in ask your wallet to sign a text message, not a transaction. Each message names the action and the coin, includes a one-time code from the server that expires after 5 minutes, and works only once.
• Built-in checks. Transactions the API builds are checked to have your wallet as the only signer and fee payer before they are handed out.

What is locked on-chain#

What the platform holds#

Some shares of the split go to wallets that the platform controls. Their keys live on the platform's servers.

Protecting the platform's wallets#

• Escrow keys are encrypted at rest. Vault keys are derived from a server secret and each coin gets its own wallet.
• A paired account's escrow is bound to the account's permanent id when the platform can look it up, so a renamed or taken-over handle cannot claim it.
• Vault moves (AI float swaps, platform-fee splits and buybacks, AI actions) are recorded before they are sent, so a crash cannot send them twice.
• Buybacks use tight slippage and price-impact limits to make sandwich attacks unprofitable.

What an AI vault key will sign#

Each AI coin's vault key is derived from a server secret and the coin's mint. It signs only two kinds of things: x402 payments to the AI provider, and float swaps (SOL to USDC, and pair token to SOL). Both are checked before signing.

x402 payments

The provider's payment terms are refused unless every rule holds:

• x402 version 2, scheme exact, on the cluster's own Solana network (mainnet on mainnet, devnet otherwise).
• The asset is USDC of that cluster. Nothing else is ever paid.
• The receiver (payTo) is on the operator's allowlist (AI_PROVIDER_PAYTO). With no allowlist, the first receiver seen is pinned and every other one is refused. It can never be the vault itself.
• The amount is a positive whole number of USDC units, at most about 1.5 times the local price estimate (or the provider's minimum), and everything one request signs stays within its cap (rules, key limit, budget left, and the platform hard cap of $5 by default).
• A fee payer is named and it is not the vault (the provider's side pays the network fee).
• The payment timeout is at most one hour, and any memo is at most 256 bytes.

After signing, the transaction itself is decoded and refused unless:

• it uses no address lookup tables, and its fee payer is the named one, not the vault;
• it contains only compute-budget instructions, an optional memo, and exactly one USDC TransferChecked from the vault's USDC account to the receiver's USDC account, for exactly the agreed amount;
• the vault is a required signer and its signature is valid.

The recorded cost is always the signed amount, whatever the provider reports. Payments in flight are held against the vault's balance and the daily budget so parallel requests cannot all spend the same USDC, and the chain is the final guard: an unfunded transfer fails. The provider address must use https in production and on mainnet.

Float swaps

• The Jupiter quote must be SOL to USDC (or pair token to SOL), for no more than the planned amount, with a minimum out above zero.
• For SOL to USDC, the quote's minimum out must also match an independent SOL price, minus 1% slippage and a 2% margin.
• The instructions may only move the vault's SOL into its own wrapped-SOL account, sync and close its own token accounts (rent back to the vault) and create accounts the vault owns. Token transfers, approvals and closes to other wallets are refused.
• The swap is simulated first: the vault may lose at most the swap amount plus fees, and its own USDC account must grow by at least the quote's minimum.
• One refill per vault at a time, across server processes.

AI safety#

The prompt firewall

Text the AI reads (the coin's character, goal and description, creator requests, x402 questions) is screened first. It is refused when it:

• contains a wallet address or long encoded or hidden content;
• tries to override the AI's rules, change who it is, or uses chat-control markup;
• mentions private keys or seed phrases, or asks the AI to send, transfer, pay or airdrop funds;
• pretends to be an official message from the platform, a moderator or an AI company;
• (creator requests only) refers to hosting, the website's code or database, secrets, files, running code, changing the site, or other coins.

Accepted text is still wrapped as “untrusted” in the prompt, so the model treats it as content, not as commands.

The publish filter

Everything the AI publishes has links and domains, wallet addresses, keys, seed phrases and long encoded strings removed, plus HTML and remote images. ASCII art is reduced to plain ASCII with the same removals.

Money

• Content skills and the creator task box have no tools at all. They can only produce text.
• Role tools never move funds: the trading copilot only returns an unsigned transaction for the signed-in holder (at most 5 SOL per trade by default), and no tool takes a destination address. See AI roles.
• On-chain AI actions are off by default. When on, the AI can only propose, the creator must approve with a signature, and fixed limits are checked again before anything runs. No tool takes a destination address. See On-chain actions.
• A coin's AI can only spend the USDC in its own AI vault, within its per-request cap and daily budget.
• Creator API keys are stored only as a hash, are shown once, and only spend their own coin's AI vault, within the coin's rules and the key's spend limit.
• The AI-built coin site is rebuilt from an allowlist and served with a policy that blocks all scripts.

Rate limits and abuse protection#

• Public endpoints are rate limited per IP, for example 10 trade builds and 3 launch preparations per minute on the Agent API, 20 AI requests per minute on the creator task box and 30 chat messages per minute. Creator API keys are limited to 60 requests per minute per key.
• Request bodies are size-capped before they are read.
• Push notification endpoints are accepted only from known browser push services.
• Trading and launching are blocked from restricted jurisdictions.

What you should do#

• Never share your seed phrase or private key. No real support person will ask for it.
• Read what your wallet shows before you sign, every time.
• Bookmark the real site address. Links in posts, DMs and Blinks can imitate it.
• A coin paired with a famous account does not mean that account is involved.

Related#