Where we are, honestly.

Pre-audit · contracts v3.0.0 · Use with amounts you can afford to lose

TrustlessKit — OTCVault, Token Locker, TokenLaunch, Vesting, Bounty Board, Staking and DCA Vault — is live on Arbitrum One, Base, Ethereum and BNB Chain with real funds and has not yet been audited by an external firm. We would rather say that plainly than imply otherwise.

Done

455 Foundry tests
Local + Arbitrum fork tests (real USDC blacklister, real Sablier Lockup v4, real Uniswap V3 pools) and invariant suites across every contract in the kit. Core escrow invariant: escrow balance == escrowed deposits + claimable balances + accrued fees; settled deals deliver exactly stable − fee and exactly the asset amount.
Internal audit remediated (v3)
Pull-based refunds (a blacklisted counterparty can no longer hold your deposit hostage), fees accrue in the escrow instead of being pushed, confirms are binding for 24h and revocable, makers pin the rail and the fee they reviewed, guardian pause blocks only new deals and funding.
Slither static analysis
0 High. 1 Medium (strict-equality sentinel in the registry) triaged as false positive; 1 Low reentrancy note accepted — state is SETTLED before any external call and confirm is nonReentrant.
Verified source
Every contract on every chain verified on the block explorer and Sourcify. No proxies.
Minimal admin surface
Owner can set the fee (≤1%), the rail for future deals, manage whitelist and registry (48h timelock on additions), sweep earned fees. Cannot move escrowed deposits.
Written listing policy
Whitelisted means: source verified, not fee-on-transfer, no symbol that collides with a registry stable or another listed token, no stable-sounding name unless it is USDC/USDT. Nothing about price, liquidity depth or the team. Tokens are revoked when they stop meeting the policy.
Deposit measurement
Every deposit is measured balanceAfter − balanceBefore and reverts on shortfall, so fee-on-transfer tokens fail loudly.

Not yet

External audit
Scheduled before the per-deal cap is lifted. Until then, treat the protocol as beta.
Multisig + timelock ownership
Owner: deployer EOA (interim) — Safe + 48h timelock migration planned. The v3 deploy scripts already wire a TimelockController; the live owner will be migrated once the Safe is set up.
Bug bounty
To follow the audit.

Contracts · Arbitrum One · Base · Ethereum · BNB Chain

Contract version 3.0.0 — identical source and bytecode on every chain (Arbitrum One live since 11 Sep 2026; Base, Ethereum and BNB Chain deployed 11 Sep 2026). Owner and guardian on every chain: deployer EOA 0x74a4…7aC2 (interim) — Safe + 48h timelock migration planned. Previous Arbitrum escrow 0xC2ac…Be10 (v2, deals 1–14) stays readable at /deal/v2/<id>. Deal links encode the chain: /deal/<chainId>/<id>.

Arbitrum One · chain id 42161 · stables USDC / USDT · Sablier Lockup v4 rail

OTCVault escrow (DeOTCEscrow)
0x7f271629F70BC2c7ACE8ba20bd49f1Ee3602DbcB
TrustlessKit #1. v3.0.0. Deals, fund, confirm (24h TTL, revocable), settle, cancel, pull-based claims, fee accrual, guardian pause. ReentrancyGuard, SafeERC20, Ownable2Step.
Arbiscan Sourcify
TokenWhitelist
0x443CC5b294054D057Fc30cAb45Fcaad0982664da
OTCVault allowlist of tradeable non-stable tokens; paid listing requests.
Arbiscan Sourcify
StableRegistry
0x7c1b6dd8B4f31b09A5fbd13694395dE576Ec38B3
USDC (6 dec) / USDT (6 dec) registry. 48h timelock on additions; instant removal.
Arbiscan Sourcify
SablierRail
0xF08F48FcBB1A1B2B67a0878949bf05Ada0b715a9
v3.0.0. Adapter → Sablier Lockup v4 createWithDurationsLL, cancelable = false; Sablier-parity schedule validation; maxVesting 5y (owner-tunable ≤10y).
Arbiscan Sourcify
FeeVault
0xFF27e5EdD20ef6254D388aA21F66222daE9CFacD
Holds protocol + listing fees. Owner sweep only.
Arbiscan Sourcify
TokenLocker
0x653906D173f6Ab96245F2E05a9DF5Fb045367B58
TrustlessKit #3. Time-locks; nobody can withdraw before the unlock date. $50 flat fee.
Arbiscan Sourcify
TokenLaunch (FairLaunch)
0x5F8C6ADF5653359Be4C5E2996855A5c4e306A78C
TrustlessKit #4. Escrowed sales, pull refunds on failure, 0.75% on finalize.
Arbiscan Sourcify
TokenLaunch rail (FairLaunchRail)
0x52d2Df3958d1fE6e18c63c16BFa48938B63E4eC5
SablierRail bound to TokenLaunch for vested delivery.
Arbiscan Sourcify
TrustlessKitFeeVault
0xFcceD6ed0BB0B41D12a73E5e8c57622A5486081B
Shared fee vault for tools #3/#4/#7/#8/#9. Owner sweep only.
Arbiscan Sourcify
BountyBoard
0x839868193e5aa4C47eeD7960ada90875BDc3D697
TrustlessKit #7. Escrowed bounties, exclusive assignment, burn-to-take stake, oracle / M-of-N verifier / resolver verification, 3-day appeal, pull payouts. 1% on approval (cap 3%).
Arbiscan Sourcify
VerifierRegistry
0x9806E47fA65c0EE3a3C5AA8fF67038969e612879
Oracle and verifier allowlists with a 500 USDC verifier stake, 14-day unstake delay, slashing on overturned votes.
Arbiscan Sourcify
BountyRail
0x4b239E9699d6A114E6870970A0E9df5Be191CBC6
SablierRail bound to BountyBoard for vested bounty payouts.
Arbiscan Sourcify
StakingFactory
0x5d7C9251d95E9b98C9045F90F6C7858075600aA5
TrustlessKit #8. Deploys per-project StakingPool contracts (Synthetix math + lock-tier multipliers). Never holds funds. Flat creation fee (cap 1000 USDC).
Arbiscan Sourcify
DCAVault
0x7e355A8B6c934e646d95AdC7eC5A5e3FB41dd914
TrustlessKit #9 (v1, legacy — serves its existing plans). Escrowed recurring buys through an allowlisted V3 router with a 30-min TWAP floor; permissionless execute; cancel and refund never pausable. 0.15% per execution (cap 1%).
Arbiscan Sourcify
DCAVaultV2
0x340AA3d13dFE3016be7B994B953f6D4a86754373
TrustlessKit #9 v2 (legacy — serves its existing plans). Trader model: total amount over a duration, 1-minute to 90-day intervals, per-plan TWAP floor or explicit no-floor. No keeper reward: runs while the TrustlessKit keeper pays gas.
Arbiscan Sourcify
DCASellVaultV2
0xAa2CA23709737E71A5e59DbDD9C0a2b6A9d00eF8
TrustlessKit #9 sell v2 (legacy). Recurring sells of any token into a registry stable; 0.15% carved from the stable received.
Arbiscan Sourcify
DCAVaultV21
0x84E2c9851930B5C3De6c6E5c61B8b4B99eab94dA
TrustlessKit #9 v2.1 — new buy plans are created here. v2 model + a per-execution keeper reward (≤ 5% of a tranche, fixed at creation) paid from the tranche to whoever calls execute(); Chainlink Automation-compatible (checkUpkeep/performUpkeep, per-plan isolation). Anyone may run the open-source keeper. Cancel and refund never pausable.
Arbiscan Sourcify
DCASellVaultV21
0xF48965D1fA21a061C4BC6829Dba5058dFbe594C6
TrustlessKit #9 sell v2.1 — new sell plans are created here. Same reward model, paid out of the stable received (bounded at execute: ≤ 5% of the gross stable out).
Arbiscan Sourcify

Base · chain id 8453 · stables USDC / USDT · Sablier Lockup v4 rail

OTCVault escrow (DeOTCEscrow)
0x8c373dcFB227E8C00a30718a7daf0270a960F8b7
TrustlessKit #1. v3.0.0. Deals, fund, confirm (24h TTL, revocable), settle, cancel, pull-based claims, fee accrual, guardian pause. ReentrancyGuard, SafeERC20, Ownable2Step.
Basescan Sourcify
TokenWhitelist
0x5C6bBFc72F352376339ad8B12805265f3FBaeDd4
OTCVault allowlist of tradeable non-stable tokens; paid listing requests.
Basescan Sourcify
StableRegistry
0x245c8E201b1e65Eba35F862aeC0Ae5219715A3E9
USDC (6 dec) / USDT (6 dec) registry. 48h timelock on additions; instant removal.
Basescan Sourcify
SablierRail
0x320911E8Cb49463e32fF123C1113eCa2760265Ee
v3.0.0. Adapter → Sablier Lockup v4 createWithDurationsLL, cancelable = false; Sablier-parity schedule validation; maxVesting 5y (owner-tunable ≤10y).
Basescan Sourcify
FeeVault
0x35CCc0a078Af070c5a4203a1aF43B7A99995D475
Holds protocol + listing fees. Owner sweep only.
Basescan Sourcify
TokenLocker
0x5631FFE7DDB79455b3669Bc4436bB7AefcFbAD17
TrustlessKit #3. Time-locks; nobody can withdraw before the unlock date. $50 flat fee.
Basescan Sourcify
TokenLaunch (FairLaunch)
0x4462b48D323A661ae206aeB13DB0D26bc35fA09A
TrustlessKit #4. Escrowed sales, pull refunds on failure, 0.75% on finalize.
Basescan Sourcify
TokenLaunch rail (FairLaunchRail)
0xE5617c65c60e1a3BEf21559496231aEfe4Ea9B09
SablierRail bound to TokenLaunch for vested delivery.
Basescan Sourcify
TrustlessKitFeeVault
0x9d911dCa9438F727a5F5Dde0400e08Fc81cB25dA
Shared fee vault for tools #3/#4/#7/#8/#9. Owner sweep only.
Basescan Sourcify
BountyBoard
0x6aC32772DD6d14c77496811A7957ae2C2c3e4f82
TrustlessKit #7. Escrowed bounties, exclusive assignment, burn-to-take stake, oracle / M-of-N verifier / resolver verification, 3-day appeal, pull payouts. 1% on approval (cap 3%).
Basescan Sourcify
VerifierRegistry
0x481C0F02608e092AB9Ab8CE3B13eCced67750Dd3
Oracle and verifier allowlists with a 500 USDC verifier stake, 14-day unstake delay, slashing on overturned votes.
Basescan Sourcify
BountyRail
0xCB94736272bb59C11a55aE3234AB427D39325785
SablierRail bound to BountyBoard for vested bounty payouts.
Basescan Sourcify
StakingFactory
0x82F987d7AdcC8ba7C763A9E18C5f097f311525f2
TrustlessKit #8. Deploys per-project StakingPool contracts (Synthetix math + lock-tier multipliers). Never holds funds. Flat creation fee (cap 1000 USDC).
Basescan Sourcify
DCAVault
0x6Ea6587e29aA2b99fB01B4a6D23E4223388B990c
TrustlessKit #9 (v1, legacy — serves its existing plans). Escrowed recurring buys through an allowlisted V3 router with a 30-min TWAP floor; permissionless execute; cancel and refund never pausable. 0.15% per execution (cap 1%).
Basescan Sourcify
DCAVaultV2
0xfB0409A924dC67692b8919a6f576ca5FFC6DD604
TrustlessKit #9 v2 (legacy — serves its existing plans). Trader model: total amount over a duration, 1-minute to 90-day intervals, per-plan TWAP floor or explicit no-floor. No keeper reward: runs while the TrustlessKit keeper pays gas.
Basescan Sourcify
DCASellVaultV2
0x5bCb7E4aff46409e85D6524044D2d7de83932763
TrustlessKit #9 sell v2 (legacy). Recurring sells of any token into a registry stable; 0.15% carved from the stable received.
Basescan Sourcify
DCAVaultV21
0x530b0b1409127f24CE8193A550b66E357A25384E
TrustlessKit #9 v2.1 — new buy plans are created here. v2 model + a per-execution keeper reward (≤ 5% of a tranche, fixed at creation) paid from the tranche to whoever calls execute(); Chainlink Automation-compatible (checkUpkeep/performUpkeep, per-plan isolation). Anyone may run the open-source keeper. Cancel and refund never pausable.
Basescan Sourcify
DCASellVaultV21
0x7bF08D3E57B93D4f476692e55740e92CD3317699
TrustlessKit #9 sell v2.1 — new sell plans are created here. Same reward model, paid out of the stable received (bounded at execute: ≤ 5% of the gross stable out).
Basescan Sourcify

Ethereum · chain id 1 · stables USDC / USDT · Sablier Lockup v4 rail

OTCVault escrow (DeOTCEscrow)
0xF1B4c8A0974C969F2801f52EB0C9d1FDfc2FC4dd
TrustlessKit #1. v3.0.0. Deals, fund, confirm (24h TTL, revocable), settle, cancel, pull-based claims, fee accrual, guardian pause. ReentrancyGuard, SafeERC20, Ownable2Step.
Etherscan Sourcify
TokenWhitelist
0x77926D8BEDa9987cdD3F979BFF0B56Cc9e88419D
OTCVault allowlist of tradeable non-stable tokens; paid listing requests.
Etherscan Sourcify
StableRegistry
0x44436AF008379dce1804a46823A3f051fE54C3C2
USDC (6 dec) / USDT (6 dec) registry. 48h timelock on additions; instant removal.
Etherscan Sourcify
SablierRail
0xc94f770cf88559e18521Abac169E7Ee4aEfCB9eE
v3.0.0. Adapter → Sablier Lockup v4 createWithDurationsLL, cancelable = false; Sablier-parity schedule validation; maxVesting 5y (owner-tunable ≤10y).
Etherscan Sourcify
FeeVault
0x2E239565D8516E8c743F5509186272E838b81d3B
Holds protocol + listing fees. Owner sweep only.
Etherscan Sourcify
TokenLocker
0x0267fc6C1Bacfd40a08344fB82F3baD8DFE785e0
TrustlessKit #3. Time-locks; nobody can withdraw before the unlock date. $50 flat fee.
Etherscan Sourcify
TokenLaunch (FairLaunch)
0xDF7Aa639c893465410fB77F51e85473643280388
TrustlessKit #4. Escrowed sales, pull refunds on failure, 0.75% on finalize.
Etherscan Sourcify
TokenLaunch rail (FairLaunchRail)
0x5B8e7B4A3B9e3CAc3465768FaeF12bBA5b7D3Af6
SablierRail bound to TokenLaunch for vested delivery.
Etherscan Sourcify
TrustlessKitFeeVault
0x4fd901d0f18d738142F86A82AC1895D4B0C6EBa5
Shared fee vault for tools #3/#4/#7/#8/#9. Owner sweep only.
Etherscan Sourcify
BountyBoard
0x5c8da374A41350e33daaa19f28c8Cb18eBD42a30
TrustlessKit #7. Escrowed bounties, exclusive assignment, burn-to-take stake, oracle / M-of-N verifier / resolver verification, 3-day appeal, pull payouts. 1% on approval (cap 3%).
Etherscan Sourcify
VerifierRegistry
0x4F81384c940Ff5F940e2312e93E88100D92052c4
Oracle and verifier allowlists with a 500 USDC verifier stake, 14-day unstake delay, slashing on overturned votes.
Etherscan Sourcify
BountyRail
0xf02DF26A2e7A056b35d956eAF5944a5f7898085d
SablierRail bound to BountyBoard for vested bounty payouts.
Etherscan Sourcify
StakingFactory
0x56Cb13172971335225Cb191E58CBaA82F5856d10
TrustlessKit #8. Deploys per-project StakingPool contracts (Synthetix math + lock-tier multipliers). Never holds funds. Flat creation fee (cap 1000 USDC).
Etherscan Sourcify
DCAVault
0x60527d8CC1dD619d27d890464925bB4c603D9951
TrustlessKit #9 (v1, legacy — serves its existing plans). Escrowed recurring buys through an allowlisted V3 router with a 30-min TWAP floor; permissionless execute; cancel and refund never pausable. 0.15% per execution (cap 1%).
Etherscan Sourcify
DCAVaultV2
0xC2acAa61C8813EaF1d3424c4651C7408B632Be10
TrustlessKit #9 v2 (legacy — serves its existing plans). Trader model: total amount over a duration, 1-minute to 90-day intervals, per-plan TWAP floor or explicit no-floor. No keeper reward: runs while the TrustlessKit keeper pays gas.
Etherscan Sourcify
DCASellVaultV2
0x6F1a7f05aE2eA8412Fdbc47C8058788e1AB3d686
TrustlessKit #9 sell v2 (legacy). Recurring sells of any token into a registry stable; 0.15% carved from the stable received.
Etherscan Sourcify
DCAVaultV21
0xcf27C2B41476b50D2a0AC2997e7FbCbE2919345a
TrustlessKit #9 v2.1 — new buy plans are created here. v2 model + a per-execution keeper reward (≤ 5% of a tranche, fixed at creation) paid from the tranche to whoever calls execute(); Chainlink Automation-compatible (checkUpkeep/performUpkeep, per-plan isolation). Anyone may run the open-source keeper. Cancel and refund never pausable.
Etherscan Sourcify
DCASellVaultV21
0xBC8F2E99b6Ca817F9E33f806E8e08399b6E7Bad1
TrustlessKit #9 sell v2.1 — new sell plans are created here. Same reward model, paid out of the stable received (bounded at execute: ≤ 5% of the gross stable out).
Etherscan Sourcify

BNB Chain · chain id 56 · stables USDT / USDC · Sablier Lockup v4 rail

OTCVault escrow (DeOTCEscrow)
0x320911E8Cb49463e32fF123C1113eCa2760265Ee
TrustlessKit #1. v3.0.0. Deals, fund, confirm (24h TTL, revocable), settle, cancel, pull-based claims, fee accrual, guardian pause. ReentrancyGuard, SafeERC20, Ownable2Step.
BscScan Sourcify
TokenWhitelist
0x35CCc0a078Af070c5a4203a1aF43B7A99995D475
OTCVault allowlist of tradeable non-stable tokens; paid listing requests.
BscScan Sourcify
StableRegistry
0xAe93040Cb272d9C7Aa6778297B1C05694C4D2D8f
USDT (18 dec) / USDC (18 dec) registry. 48h timelock on additions; instant removal.
BscScan Sourcify
SablierRail
0x5C6bBFc72F352376339ad8B12805265f3FBaeDd4
v3.0.0. Adapter → Sablier Lockup v4 createWithDurationsLL, cancelable = false; Sablier-parity schedule validation; maxVesting 5y (owner-tunable ≤10y).
BscScan Sourcify
FeeVault
0x245c8E201b1e65Eba35F862aeC0Ae5219715A3E9
Holds protocol + listing fees. Owner sweep only.
BscScan Sourcify
TokenLocker
0x5631FFE7DDB79455b3669Bc4436bB7AefcFbAD17
TrustlessKit #3. Time-locks; nobody can withdraw before the unlock date. $50 flat fee.
BscScan Sourcify
TokenLaunch (FairLaunch)
0x4462b48D323A661ae206aeB13DB0D26bc35fA09A
TrustlessKit #4. Escrowed sales, pull refunds on failure, 0.75% on finalize.
BscScan Sourcify
TokenLaunch rail (FairLaunchRail)
0xE5617c65c60e1a3BEf21559496231aEfe4Ea9B09
SablierRail bound to TokenLaunch for vested delivery.
BscScan Sourcify
TrustlessKitFeeVault
0x9d911dCa9438F727a5F5Dde0400e08Fc81cB25dA
Shared fee vault for tools #3/#4/#7/#8/#9. Owner sweep only.
BscScan Sourcify
BountyBoard
0x6aC32772DD6d14c77496811A7957ae2C2c3e4f82
TrustlessKit #7. Escrowed bounties, exclusive assignment, burn-to-take stake, oracle / M-of-N verifier / resolver verification, 3-day appeal, pull payouts. 1% on approval (cap 3%).
BscScan Sourcify
VerifierRegistry
0x481C0F02608e092AB9Ab8CE3B13eCced67750Dd3
Oracle and verifier allowlists with a 500 USDC verifier stake, 14-day unstake delay, slashing on overturned votes.
BscScan Sourcify
BountyRail
0xCB94736272bb59C11a55aE3234AB427D39325785
SablierRail bound to BountyBoard for vested bounty payouts.
BscScan Sourcify
StakingFactory
0x82F987d7AdcC8ba7C763A9E18C5f097f311525f2
TrustlessKit #8. Deploys per-project StakingPool contracts (Synthetix math + lock-tier multipliers). Never holds funds. Flat creation fee (cap 1000 USDC).
BscScan Sourcify
DCAVault
0x6Ea6587e29aA2b99fB01B4a6D23E4223388B990c
TrustlessKit #9 (v1, legacy — serves its existing plans). Escrowed recurring buys through an allowlisted V3 router with a 30-min TWAP floor; permissionless execute; cancel and refund never pausable. 0.15% per execution (cap 1%).
BscScan Sourcify
DCAVaultV2
0x66982660aBc7352A0AeC409BD6139467634d5767
TrustlessKit #9 v2 (legacy — serves its existing plans). Trader model: total amount over a duration, 1-minute to 90-day intervals, per-plan TWAP floor or explicit no-floor. No keeper reward: runs while the TrustlessKit keeper pays gas.
BscScan Sourcify
DCASellVaultV2
0xd3A4445Bb0CBD9B2115e63ce7C4d8BB5d6079b3e
TrustlessKit #9 sell v2 (legacy). Recurring sells of any token into a registry stable; 0.15% carved from the stable received.
BscScan Sourcify
DCAVaultV21
0x59d26275b14B6e3011cE7f916168694dC4E1f3b3
TrustlessKit #9 v2.1 — new buy plans are created here. v2 model + a per-execution keeper reward (≤ 5% of a tranche, fixed at creation) paid from the tranche to whoever calls execute(); Chainlink Automation-compatible (checkUpkeep/performUpkeep, per-plan isolation). Anyone may run the open-source keeper. Cancel and refund never pausable.
BscScan Sourcify
DCASellVaultV21
0xfB0409A924dC67692b8919a6f576ca5FFC6DD604
TrustlessKit #9 sell v2.1 — new sell plans are created here. Same reward model, paid out of the stable received (bounded at execute: ≤ 5% of the gross stable out).
BscScan Sourcify

What the owner can and cannot do

Can

Set the fee for future deals — never above 1.00%, and never above the cap the maker pinned at creation.
Set the vesting rail for future deals (existing deals keep theirs; makers pin the rail they reviewed).
Pause / unpause creating and funding new deals (guardian); block a token for new deals.
Approve / revoke whitelisted tokens.
Propose (48h) / execute / remove registry stablecoins.
Sweep earned fees from the FeeVault (fees reach it via permissionless pushFees).

Cannot

Move or freeze any escrowed deposit — confirm, cancel, refund and claim are never pausable.
Change the terms, fee, rail or schedule of an existing deal.
Upgrade any contract — there are no proxies.
Cancel or redirect a Sablier stream once created.
Recover tokens sent directly to the escrow (by design).

Dependencies

OpenZeppelin Contracts 5 (Ownable2Step, ReentrancyGuard, SafeERC20) · Sablier Lockup v4 (non-upgradeable, audited by multiple firms since 2019). Sablier Lockup v4: Arbitrum 0xD103…9C33 · Base 0xc19a…7C0A · Ethereum 0x93b3…BDCB · BNB Chain 0x6cd0…eD22.

Found something? Email security@trustlesskit.xyz. A formal bug bounty follows the audit.