Security & Trust
Security is layered through the platform — from smart contracts to API design to operational process.
Non-custodial by construction
- TBook never holds keys or funds. The API only ever returns unsigned transactions; signing happens in your wallet infrastructure (WaaS, your backend, or your multisig).
- Claims can only pay the account's own wallet. This is enforced by the vault contracts, not by policy.
- Transfers to third-party addresses (treasury withdrawals) require an allowlisted destination with a 24-hour activation timelock, and optionally dual approval by two different API keys.
Multi-signature operations
Vault operations are gated by on-chain multi-signature approval across separated operational roles. No single party can move funds or change vault parameters unilaterally.
| Role | Permissions | Purpose |
|---|---|---|
| Authority | Configuration, pause/unpause, role rotation | Governance |
| Curator | Sensitive settlement steps (bridging, settlement reporting) | Cross-chain operations |
| Operator | Routine cycle operations | Day-to-day processing |
Audited contracts
The Sui rcUSDP vault contract is independently audited by ScaleBit/MoveBit and has been live on Sui mainnet in production. Audit scope covered contract logic and state management, access control, fund-flow and accounting integrity, and edge-case behavior. Additional assets go through the same gate before production exposure: the XAUa AlphaVault (live on testnet today) requires its own audit before mainnet launch.
API-level protections
- Hashed API keys (only a SHA-256 hash is stored) with organization-scoped tenancy on every resource — one organization can never read another's accounts, webhooks, or events.
- Idempotency keys on all money-movement endpoints prevent duplicate submissions (same-key replays return the recorded response for 24 hours).
- Webhook signatures (HMAC-SHA256 with timestamp) let you verify every delivery; secret rotation dual-signs deliveries during a 24-hour grace window. See Webhooks.
- Rate limiting per key, with explicit
X-RateLimit-*andRetry-Afterheaders.
Pause & rollback safety
- Vaults can be paused by multisig: new deposits/redemptions stop, but claims always work — paused funds are never trapped.
- If a settlement cycle must be aborted, it is rolled back: deposited funds return as claimable balances in depositors' own wallets, and webhooks notify every affected account. See Core Flows.
On-chain verifiability
All vault state is public and verifiable: total shares, vault balances, share-price history, every cycle settlement, and individual holdings. The underlying contract addresses are published in the open-source SDK configuration (@tbookdev/vault-sdk-sui) so you — or your auditors — can verify independently.
24-hour timelocks
Treasury allowlist additions activate only after a 24-hour timelock at the API level, and sensitive vault configuration changes are similarly timelocked on-chain. This guarantees a review window before any sensitive change takes effect.