Security
Overview
Security is foundational to SynthFi. While our platform accelerates smart contract development through AI, we take explicit steps to ensure that the generated code is:
Transparent
Reviewable
Flagged for risk
Never deployed without user oversight
This section outlines how SynthFi approaches security across the code generation process, Launchpad deployment flow, and user education.
What Security Risks We're Defending Against
Rug Pull
Contracts that allow only the creator/admin to withdraw funds
Honeypot
Users can deposit tokens, but are blocked from withdrawing
Authority Hijacking
A hardcoded admin can change rules or drain funds
Silent Failure
Critical features (like withdraw) are missing entirely
Unverified Closures
close_account without proper signer constraints
Security in Code Generation
Every generated SynthFi contract is built using:
The Anchor framework — which includes strong conventions for:
Signer validation
PDA-based account authority
Safe SPL token interactions
Clear instruction boundaries (
#[program],#[derive(Accounts)])Deterministic PDA seeds (based on wallet address + custom inputs)
Automatic rejection of contracts with
unsafe,eval, or external unknown crates
We focus on using well-understood, auditable patterns, not obscure or over-engineered logic.
Risk Scanning (Launchpad Layer)
When a contract is sent to the Launchpad, we run a risk scan (via client or API) that checks for:
Missing withdraw functions
Authority checks missing or misconfigured
Admin-only logic without fallback or delay
Potential honeypot behavior
Dangerous instruction combinations (e.g., init + close without signer)
If any red flags are detected, the UI:
Clearly shows the issue(s)
Disables the Deploy to Devnet button (or requires override confirmation)
Links to the exact code segment if applicable
Developer Responsibility
SynthFi is not a magic box, it’s a builder accelerator. Users are still responsible for:
Reviewing generated smart contracts before deploying
Verifying correct wallet address configuration
Avoiding use of unaudited code on Mainnet
Understanding the financial implications of token logic (e.g., reward inflation, early withdrawal rules)
Planned Security Enhancements
Function-level AI audit summaries
🔜 Coming soon
Verified deploy module templates
🔜
Community-flagged prompts or logic
🔜
Audit partner integrations (opt-in)
🔜
Deploy pre-check scoring system
🔜
GitHub-style code diffs (for changes post-prompt)
🔜
Last updated