Security and trust
Zecpass keeps the trusted surface small and says exactly where it is. This page is the list.
Who you trust, and for what
| Party | You trust them to | If they fail | Bound |
|---|---|---|---|
| Zcash | keep the shielded pool sound | privacy is lost, not funds | none; out of scope |
| NEAR Intents and its solvers | fill the intent or refund | ZEC refunded to your transparent address, minus network fee | one order |
| Relay | pay the pass on Robinhood Chain | Relay refunds to the relayer on Arbitrum One; the relayer resends | one order |
| The Zecpass relayer (bridge mode) | forward the Arbitrum ETH to your pass | your one order's ETH stays with the relayer | one order, observable by everyone |
| The Zecpass relayer (instant mode) | only call deliver for real settlements |
vault ETH is spent on a fake order | maxPerOrder per call, dailyCap per day, and only ever the vault, never user funds |
| The hub owner (treasury) | not set a malicious market or fee | fee is capped at 2 percent by the contract; a bad market could route a sweep badly | withdraw is untouchable by the owner, so ETH in a pass is always recoverable |
| Pons | run the curve honestly | out of scope; the same trust every Pons buyer takes |
The important line is the second-to-last: nothing the owner or the relayer can do stops a beneficiary from taking the raw ETH out of their pass. No pause, no market change, no token change affects withdraw.
Keys
| Key | Lives | Holds | If leaked |
|---|---|---|---|
| Treasury | hardware wallet, offline | creator fees, hub ownership | attacker can pause, change fee up to 2 percent, change relayer, drain the vault; cannot touch passes or user tokens |
| Relayer | Fly secret | gas on both chains; user ETH for seconds on Arbitrum | attacker can spend the vault up to the daily cap on fake deliveries and steal in-flight Arbitrum ETH; rotate with setRelayer and redeploy |
| Deployer | local file, gitignored | dust after deployment | nothing |
The relayer key is the one to watch. It is never in git, never in the site, and Fly stores it encrypted. The daily cap is the reason a leak is an incident, not a catastrophe.
What the contract protects against
- Replay.
delivertakes an order id, and each id is spent once. - Reentrancy.
deliver,sweepandwithdraware guarded;receive()is not, because the market adapter refunds into it inside a buy. - Stranded tokens. Tokens forwarded are the balance delta, so a transfer tax cannot leave dust in the hub;
rescueTokenexists for anything else. - Griefing a pass. Anyone can send ETH to a pass; that only gives the beneficiary more. Anyone can call
sweep, which only buys tokens for the beneficiary. A malicious sweeper could sweep at a bad moment on the curve; the beneficiary who cares can sweep themselves with aminTokensOut. - Launch-block sniping via a pass. A sweep in the launch block would pay the 99 percent anti-snipe tax to the curve; the relayer never sweeps that early, and a user who does so by hand has been warned in the docs.
Failure modes, and what happens to the money
| Failure | Money is | Recovery |
|---|---|---|
| Relayer down | in the user's pass (bridge mode) or still on Arbitrum One (if it died between rails) | restart; the loop resumes from orders.json; nothing is resent twice |
| Fly volume lost | on chain, all of it | orders can be reconstructed from 1Click status by deposit address and from hub logs; the site's local storage keeps each user's order ids |
| Hub paused | in the user's pass | withdraw, or wait for unpause |
| Token never set | in the user's pass | withdraw |
| Pons rescues the launch | in the user's pass; sweeps revert NoMarket |
withdraw |
| Relay stops serving Robinhood Chain | on Arbitrum One with the relayer | the treasury bridges by hand through the Arbitrum canonical bridge, or Across, and pays the pass |
| NEAR Intents refunds | back on Zcash at the refund address | nothing to do |
What has been tested, and what has not
- The contracts have 16 tests on a fork of Robinhood Chain against the live Pons V2, including graduation to the Uniswap V4 pool. They have not been audited by a third party.
- The relayer's state machine is tested with recorded 1Click and Relay responses. It has not yet run a real order on mainnet; the first real passes will be the founders' own.
- The rails have been quoted live (dry) on 2026-09-20 and 2026-09-21. No real deposit has been made through Zecpass before launch day.
If you find something, write to the handle in the footer. There is no bounty programme; there is a treasury and a founder who would rather pay than read about it.