Docs
Threat model
Assets, trust boundaries, adversaries, and the risks we explicitly accept.
What we protect
- Your wallet keys. Never held by Vaelun; client-signed only.
- Session integrity. Cryptographically signed.
- Server-only credentials and signing keys.
- Your intent contents and balances.
Trust boundaries
- You and your wallet
- The wallet signs; the client never sees your keys.
- Client and server
- Untrusted input crosses here and is strictly validated and bound to your session.
- Server and third parties
- Secrets live only on the server side of this boundary.
Adversaries and mitigations
- Anonymous attacker spending the metered proxy: mitigated by gating, fail-closed rate limits, and strict validation.
- Authenticated user publishing for another account: mitigated by session binding of wallet family, signer, deadline, and action type.
- Malicious wallet altering signed bytes: mitigated by a diagnostic that shows exactly what was signed, and by a mainnet comparison before any launch.
- Network attacker replaying a valid intent: mitigated by short deadlines, salted nonces, and an auto-clearing diagnostic.