// TRUST CENTER
Trust & Security
This page is the authoritative source for verifying Vault. It establishes which domains are official, how funds are held, what Vault can and cannot do with them, how to confirm a message really came from us, and where to report phishing, impersonation or a vulnerability. If a claim about Vault contradicts this page, this page is correct.
// Official Domains
The only domains Vault operates
Check the address bar before you connect a wallet or sign anything. A domain that does not appear in this list is not operated by Vault, no matter how closely it resembles one that is.
Official public website. Product information, protocol documentation, legal terms and this trust center. No wallet is ever connected here.
Official Vault application. The only Vault surface that connects a wallet, requests a signature, or moves SOL.
Official technical documentation for integrators and contributors. Read-only reference material.
Alias of vault.ky. Redirects permanently to the apex domain.
Legacy domain of Vault's predecessor, DexVault. It forwards visitors to the current Vault website and is not a place to connect a wallet or contribute to a campaign.
app.vault.ky is the only Vault surface that will ever ask you to connect a wallet or approve a transaction. vault.ky is informational and never mounts a wallet connection. If a page claiming to be Vault asks you to connect anywhere else, it is not Vault - report it to [email protected].
// Phishing & Impersonation
Report phishing and fake accounts
Crowdfunding attracts impersonation. Vault will not always find a fake site or account before you do, so reports genuinely matter - they are what let us get a domain taken down.
Vault will never ask for your seed phrase, recovery phrase, or private key. No Vault page, email, direct message, support agent or team member will ever request one, for any reason. There is no recovery process, verification step or migration that requires it. Any request for one is an attempt to steal your wallet.
Vault will never DM you first asking you to connect a wallet. We do not run wallet verifications, airdrops, token sales, snapshots or refund-recovery processes over direct message.
Vault support will never ask you to move funds. No legitimate support process involves sending SOL to a “safe” wallet, an address given in chat, or an address to “validate” a refund.
// REPORT THIS
- A site that looks like Vault on any domain not listed above
- An app or wallet-connect page claiming to be Vault
- An account impersonating Vault, DexVault, or a team member
- A message asking for a seed phrase, private key, or a signature
- A campaign soliciting funds to a wallet address outside Vault escrow
- A browser extension or search advert pointing at a lookalike domain
// HOW TO REPORT
Email [email protected]. Include whatever you have - a partial report is still useful:
- The exact URL, handle, or address involved
- A screenshot, if you have one
- Where you encountered it (search, advert, DM, group chat)
- Whether you connected a wallet or signed anything
If you have already signed something, move your remaining assets to a new wallet first, then report. Vault cannot reverse a signature you approved.
// Communications
How to verify a message is really from Vault
These are the only channels Vault communicates through. Treat anything else as unverified until you confirm it against this list.
Founder account. Product announcements and protocol updates.
Founder account. Direct contact and community questions.
Email. Official Vault email comes from an address ending in @vault.ky. A display name can be forged, so check the actual sending address, not the name shown. Vault email never contains a wallet-connect link or a request to sign a transaction.
Links. Every link in an official Vault message resolves to a domain in the list above. Hover a link and read the real destination before clicking it.
Announcements. Anything material - a protocol change, an incident, a domain change, an audit result - is published on vault.ky as well as being announced on the accounts above. If an announcement exists only in a chat message and appears nowhere on vault.ky, treat it as unverified.
When in doubt. Forward it to [email protected] and wait. Nothing legitimate from Vault requires you to act within minutes, and urgency is the most reliable sign of a scam.
// Domain Migration
DexVault and dexvault.xyz: verifying the relationship
Vault was previously called DexVault and operated at dexvault.xyz. The product, the team and the operator are the same; the name and the domain changed. We publish this because a rebrand is exactly the situation impersonators exploit - a stranger has no way to tell a legitimate migration from a hijacked brand unless the current operator states it plainly.
All current Vault activity happens on vault.ky and app.vault.ky. dexvault.xyz is a legacy domain. It is not where you contribute to a campaign, and you should not connect a wallet there. Historical DexVault campaign records are preserved on this site under the legacy archive.
The DexVault rebrand did not migrate contributor balances. Vault campaigns run on the escrow programs described on this page, and no legitimate process will ever ask you to “migrate”, “claim” or “re-validate” funds from DexVault by connecting a wallet or sending SOL anywhere. Any message offering that is a scam - report it to [email protected].
The full history of why the product changed is on About Vault.
// Custody
Funds live in escrow, not in a company wallet
Every contribution lands in that campaign’s escrow address on Solana - a program-controlled account. No Vault operator key can sign transfers out of it. Release conditions (goal met, timing windows) are checked inside the program on every state transition, not attested to off-chain by Vault.
SOL leaves escrow only through the program, and only three ways: settlement to fulfill the campaign on success, refund to contributors on failure or cancellation, and fee collection at settlement or refund. No other exit path exists.
// Operator Boundary
What Vault can and cannot do
// Refund Guarantee
Refund automation
Eligible refunds are normally processed automatically when a campaign enters its refund state. The underlying protocol is designed so that refund rights do not depend solely on Vault manually deciding whether to return contributor funds.
You may not get back every lamport. A processing fee is deducted from your refundable principal, and contribution fees and tips are non-refundable - see the fee schedule.
If a successful campaign is not settled before its execution deadline, it falls back to refunding. Failure always wins over an unsettled execution - you keep a refund exit even after funding.
// Wallet Safety
Your wallet is yours
Vault will never ask for your seed phrase, recovery phrase, private key, or wallet credentials, and will never ask for remote access to your device. If a website, account, email, Telegram message, or any other communication claims to represent Vault and requests one of those, treat it as fraudulent, do not respond, and report it to [email protected].
Every action you take on Vault - contributing, tipping - is a transaction you sign in your own wallet. Read the transaction preview before you approve.
Check the domain before you sign. Vault wallet interactions occur at app.vault.ky. The public information site is vault.ky.
// Audit & Status
Where we are
An internal security review has been completed. No third-party audit has been completed to date. External audit results, when available, will be published here with the auditor’s report. Until then, the internal review is the only audit claim Vault makes.
// On-Chain Verification
Verify the program you are interacting with
You do not have to take Vault’s word for how escrow behaves. The programs below are the on-chain code that holds and moves campaign funds, and their behaviour is verifiable directly on Solana by anyone.
Global configuration, fee parameters and campaign registry.
Per-campaign escrow custody, contributions, settlement and refunds.
What the programs control
Vault’s on-chain programs govern:
- Campaign-specific escrow custody - each campaign's funds sit in its own program-derived account, not a pooled or operator-owned wallet.
- Funding state - contributions, amounts raised, and whether a campaign has met its goal.
- Settlement and refund paths - the conditions under which funds may leave escrow, and where they may go.
- Time guards - the deadline, the waiting window, and the execution window that decide which path a campaign takes.
- Fee parameters - the rates and caps locked onto each campaign when it is created.
Campaign funds are held in program-controlled on-chain escrow, and Vault operator keys do not have arbitrary withdrawal authority over campaign escrow. Every path that moves funds out of escrow is defined in the program and checked on each transition: settlement to fulfill the campaign, refunds to contributors, and fee collection at settlement or refund. Cancelling a campaign routes its funds to contributors, not to Vault.
Technical detail on accounts, instructions and derivations is in the documentation, and the protocol model is described on the protocol overview.
// Contributor Protection
What contributor protection means
When you contribute through Vault, your contribution is not simply sent to the campaign creator. Contributions are held in campaign-specific on-chain escrow while the campaign is active, and the campaign’s outcome determines what happens next.
If the campaign succeeds, funds are used to fulfill the campaign’s stated purpose - Vault purchases or arranges the associated service or deliverable according to the campaign. If the campaign does not succeed, eligible refunds are processed automatically according to the campaign and protocol rules.
This removes the need for contributors to rely solely on a campaign organizer’s promise to voluntarily return unused funds.
// Charity Campaigns
Charity campaigns refund differently
A charity campaign qualifies at a 20% minimum threshold. Reaching 100% before the deadline succeeds normally; if it expires at or above 20% of its goal, the amount raised qualifies for fulfillment rather than being refunded. Below 20% at expiration, contributions are automatically refunded. Charity campaigns also skip the waiting window.
If you contribute to a charity campaign that ends at or above 20% of its goal, you are not eligible for a refund, even if the full goal is never reached. This is not the all-or-nothing model most contributors expect - check the funding policy before you contribute.
// Unsupported Assets
Send SOL only
Campaign escrow accounts hold SOL only. Sending any other asset - SPL tokens, NFTs, or anything from another blockchain - to a campaign escrow address is not supported. The program has no instruction to retrieve or transfer non-SOL assets, so there is no recovery path. If you send an unsupported asset it may be permanently inaccessible. Only send SOL using the Vault application.
// The Bottom Line
What this protects, and what it does not
// PROTECTS
- Campaign funds during the funding period
- Defined campaign outcomes
- Failed-campaign refund eligibility
- Transparent on-chain activity
- Purpose-bound successful funding
// DOES NOT COVER
- The future price of a token - Vault does not protect against loss of value in any token or project.
- The legitimacy or future conduct of a project - a funded campaign does not guarantee the project, creator, or beneficiary performs.
- Investment returns - contributing is not an investment - it entitles you to no return, equity or dividend.
- Wallet compromise - Vault cannot protect you from phishing, key theft, or signatures you approve unknowingly.
- Unsupported assets sent incorrectly - campaign escrow holds SOL only; anything else has no recovery path.
- Failures originating from third-party services - fulfillment may depend on providers outside Vault's direct control.
- Every possible smart-contract or blockchain risk - programs have undergone internal review only; no third-party audit to date.
- A guarantee that the underlying project will succeed - escrow protects the funding process, not the outcome.
// Contact
Official Vault contact addresses
These are the official Vault addresses. Each has one defined purpose, so a report reaches the right people without being forwarded around.
Help with a campaign, a contribution, a refund, or your account.
- Questions about a contribution or refund you are expecting
- A campaign that appears stuck, mispriced, or misdescribed
- Problems using the application
Vulnerability reports, phishing, impersonation and suspicious domains.
- Suspected vulnerabilities in Vault programs, applications or infrastructure
- Phishing sites, fake applications, or any domain not listed as official
- Accounts impersonating Vault, DexVault, or a member of the team
- Messages claiming to be from Vault that request a seed phrase or a signature
Legal notices, disputes, data-protection requests and law-enforcement enquiries.
- Legal notices and disputes under the Terms of Service
- Data access, correction and deletion requests under the Privacy Policy
- Intellectual-property and trademark matters
- Law-enforcement and regulatory enquiries
Partnerships, integrations, custom campaign requirements and media.
- Projects, charities and communities wanting to run campaigns
- Integrating Vault escrow into another product
- Custom campaign requirements outside the standard flow
- Press and media enquiries
// Responsible Disclosure
Reporting a vulnerability
If you believe you have found a vulnerability in a Vault program, application or supporting infrastructure, report it privately to [email protected] before disclosing it publicly. Escrow holds contributor funds, so a public zero-day disclosure puts real money at risk while a fix is being prepared.
Please include:
- A description of the issue and the component affected
- Steps to reproduce, or a proof of concept
- An impact assessment - what an attacker could achieve
- Any addresses, transaction signatures, or program logs involved
- How you would like to be credited, if you want credit
What we ask of you. Give us a reasonable opportunity to investigate and remediate before publishing. Do not exploit an issue beyond what is needed to demonstrate it, do not access or modify data belonging to other users, and do not run tests that degrade the service for others. Test against devnet or your own campaigns rather than live contributor funds where that is possible.
What you can expect. We aim to acknowledge a report within three business days and to keep you informed while we work on it. Vault does not currently operate a paid bug-bounty programme, and we will say so plainly rather than implying a reward that does not exist. We are glad to credit researchers publicly once an issue is resolved.
// Legal
The binding documents
This page explains how Vault works and how to verify it. The documents below set the terms that actually govern your use of Vault. Where a summary here and a legal document differ, the legal document controls.
- Terms of Service - The agreement between you and Vault, including fees, campaign rules and dispute resolution.
- Privacy Policy - What data Vault collects, why, and how to exercise your rights over it.
- Risk Disclosure - The funding, technical, fulfillment and market risks of contributing through Vault.
- Restricted Regions - Where Vault is not available, and the eligibility you confirm by using it.
- Fee Schedule - Current contribution, settlement and refund fee rates.
// NEXT STEP
Protections are enforced by the protocol, not by our goodwill. See what communities are funding right now.