SSS · TRUST CENTER
Trust should be inspectable, not implied.
This surface brings together SSS claims, system components, funding routes, authority boundaries, release evidence, risks, incidents, and governance. Unknown, stale, or unverified information stays visible as such.
System boundaries
One system, bounded planes, one financial judge.
The Trust Center is not a new business authority. It explains who owns each responsibility and what each plane must never do.
User intent
WWWExpresses actions; never judges financial success.
Financial kernel
CoreBalances, reservations, trades, liquidity, and final receipts.
External execution
Asset Hub + GatewaysRoutes, signing, broadcast, and finality evidence.
Read & evidence
Data API + PortalRebuildable views and public evidence; never rewrites finance.
PUBLIC CANISTER REGISTRY
Production components and public IDs
IDs are the stable baseline. Module hashes, controllers, and observation times are rolling evidence and remain Pending until collected.
Registry available; public-chain observation pending.This does not imply a canister outage or controller anomaly.
| Component | Canister ID | Authority | Evidence |
|---|---|---|---|
| CoreCanonical internal balances, reservations, trades, orders, liquidity, fees, and authoritative financial receipts. | dlhkk-raaaa-…yl5a-cai | FINANCIAL CORE | Observation pendingModule Hash / Controllers |
| WWWApplication frontend and user interaction surface. | dmgm6-4yaaa-…yl5q-cai | USER INTERACTION | Observation pendingModule Hash / Controllers |
| PortalBrand and public positioning surface. | bpfil-eiaaa-…lkrq-cai | CONTENT | Observation pendingModule Hash / Controllers |
| DocsTechnical and product documentation surface. | rmlok-daaaa-…lrea-cai | CONTENT | Observation pendingModule Hash / Controllers |
| Data APIRebuildable market, history, reporting, daily-close, and public-safe projections. | xobtb-pyaaa-…lrsq-cai | DATA PROJECTION | Observation pendingModule Hash / Controllers |
| Agent GatewayIntent interpretation, draft, preview, confirmation, callback, and nonfinancial orchestration. | yq5eu-qqaaa-…zaga-cai | AGENT INTENT | Observation pendingModule Hash / Controllers |
| Dataroom / GrowthContribution records, Growth programs, and nonfinancial operational records. | 5jtld-gaaaa-…eekq-cai | NONFINANCIAL PROGRAM | Observation pendingModule Hash / Controllers |
| Asset HubAsset-route registry, external funding evidence, route coordination, and supported external execution state. | 7uamq-xiaaa-…grha-cai | EXTERNAL EXECUTION | Observation pendingModule Hash / Controllers |
| EVM GatewayEVM signing, broadcast, submission journal, finality observation, and bounded recovery. | 7tbke-2qaaa-…grhq-cai | EXTERNAL EXECUTION | Observation pendingModule Hash / Controllers |
| Solana GatewaySolana evidence, signing, broadcast, finality observation, and bounded recovery. | za2zu-caaaa-…gwpa-cai | EXTERNAL EXECUTION | Observation pendingModule Hash / Controllers |
| ETH Bridge LedgerDefined Ethereum-side bridge or route ledger support; exact authority requires production review. | 5o4em-jyaaa-…gria-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
| BNB Bridge LedgerBNB-route bridge-ledger support. | zoyu4-zqaaa-…gwoa-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
| BTC Bridge LedgerBTC-route bridge-ledger support. | 43aff-eqaaa-…gwqa-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
| SOL Bridge LedgerSolana-route bridge-ledger support. | zjzsi-uiaaa-…gwoq-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
| USDC Bridge LedgerProduction USDC bridge-ledger support across configured routes. | 5j5cy-eaaaa-…griq-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
| USDT Bridge LedgerProduction USDT bridge-ledger support across configured routes. | 5a6je-siaaa-…grja-cai | FINANCIAL SUPPORT | Observation pendingModule Hash / Controllers |
FUNDING ROUTES
Configured does not mean currently healthy.
The current preview exposes the stable route catalog. Fees, finality, gateway health, canary, reconciliation, and freshness will be attached as rolling evidence.
EVM · Arbitrum
3arbitrum:ethETH → ETH
Evidence pendingarbitrum:usdcUSDC → USDC
Evidence pendingarbitrum:usdtUSDT → USDT
Evidence pendingEVM · Base
3base:ethETH → ETH
Evidence pendingbase:usdcUSDC → USDC
Evidence pendingbase:usdtUSDT → USDT
Evidence pendingEVM · BNB Smart Chain
4bsc:bnbBNB → BNB
Evidence pendingbsc:btcBTC → BTC
Evidence pendingbsc:usdcUSDC → USDC
Evidence pendingbsc:usdtUSDT → USDT
Evidence pendingEVM · Ethereum Mainnet
3ethereum:ethETH → ETH
Evidence pendingethereum:usdcUSDC → USDC
Evidence pendingethereum:usdtUSDT → USDT
Evidence pendingICP_ICRC · ICP
5icp:ckbtcCKBTC → BTC
Evidence pendingicp:ckethCKETH → ETH
Evidence pendingicp:ckusdcCKUSDC → USDC
Evidence pendingicp:ckusdtCKUSDT → USDT
Evidence pendingicp:icpICP → ICP
Evidence pendingSOLANA · Solana Mainnet
3solana-mainnet:solSOL → SOL
Evidence pendingsolana-mainnet:usdcUSDC → USDC
Evidence pendingsolana-mainnet:usdtUSDT → USDT
Evidence pendingCLAIM REGISTRY
Every public promise has an ID, status, and boundary.
LIVE, BETA, PARTIAL, TARGET, and RESEARCH are not interchangeable. Missing evidence can only downgrade a claim, never strengthen it.
CLAIM-PRIVATE-001PARTIALPrivate Trading System for the AI Era
SSS is building a Private Trading System for the AI Era.
BoundaryPublic Beta provides an application-level private-account foundation; public-detail, administrator, telemetry, support, governance, and cryptographic-privacy gaps remain.
CLAIM-EXPERIENCE-002BETACEX Experience
SSS is pursuing a CEX-style account experience with DEX trust boundaries.
BoundaryThe phrase describes product architecture and does not claim parity with leading centralized exchanges in liquidity, market breadth, institutional tooling, or service capacity.
CLAIM-TRUST-003PARTIALDEX Trust
DEX Trust means explicit financial authority, inspectable rules, production verification, visible dependencies, and governed upgrades.
BoundaryReproducibility, controller minimization, and SNS governance remain incomplete targets.
CLAIM-CROSSCHAIN-004BETASupported multichain funding
SSS supports published, allowlisted multichain funding routes.
BoundaryDeposits and withdrawals remain subject to chain, token, gateway, RPC, fee, evidence, and finality conditions.
CLAIM-SETTLEMENT-005LIVEInternal onchain settlement
Internal financial outcomes settle on ICP canisters.
BoundaryExternal deposits and withdrawals remain outside the internal-settlement scope until their evidence and finality conditions are accepted.
CLAIM-GASLESS-006LIVEGas-token abstraction for internal actions
Users do not need to prepare a gas token for every internal SSS trade or liquidity action.
BoundaryThe user-facing gas-token requirement is abstracted for internal actions; economic and external-chain costs may still apply.
CLAIM-BALANCE-007BETACanonical Balance
Supported funding routes feed canonical balances.
BoundaryCanonical balance is the internal financial identity used by trading, orders, liquidity, history, receipts, and permissions; route provenance and external risk remain.
CLAIM-VERIFY-008PARTIALPrivacy-preserving verification
SSS has foundations for separating public market information from owner records.
BoundaryComplete selective disclosure, institution viewer roles, operator restriction, and cryptographic verification remain target or research capabilities.
CLAIM-AGENT-009BETAPermissioned AI-agent intents
The Agent may interpret and prepare supported actions.
BoundaryThe Financial Core independently verifies permissions, balances, limits, and final financial state; the Agent has no independent financial authority.
CLAIM-THESIS-010LIVEYou should trade crypto on a blockchain.
You should trade crypto on a blockchain.
BoundaryThis is a product and market thesis, not an investment, security, or universal protocol guarantee.
CLAIM-INSTITUTION-011TARGETPrivate Trading for Institutions
SSS is designing Private Trading for Institutions.
BoundaryCurrent foundations support account, settlement, receipts, funding, and scoped Agent work; the complete institution product is not live.
CLAIM-GOVERNANCE-012TARGETSNS governance
SNS-governed financial and privacy rules are a target architecture.
BoundarySSS remains in a pre-SNS team/controller phase; launch depends on product, privacy, reproducibility, operational, governance, and distribution readiness.
CLAIM-CRYPTO-013RESEARCHCryptographic confidentiality
SSS is researching cryptographic confidentiality.
BoundaryResearch does not represent a current product capability or fixed delivery commitment.
RELEASE EVIDENCE
Observe facts during iteration; attest versions at release.
The main development line is still moving, so this page does not present an interim commit as the final production release. Full source, Wasm, and deployed-module binding happens at an explicit release point.
1
READY
Source-controlled registries and evidence contracts
2
PENDING
Anonymous module-hash and controller observation
3
DEFERRED
Local Wasm and production module-hash comparison
4
DEFERRED
Release attestation and reproducible-build evidence
RISK REGISTER
A public risk register is a trust surface.
This view exposes structural risks, current controls, and target controls. A risk remains OPEN until closure evidence exists.
RISK-CONTROLLER-001HIGHOPEN
Pre-SNS controller authority
Critical canisters remain upgradeable by current controllers before the SNS transition.
Current controls
- explicit production identities
- manual release review
- source and deployment records
Target controls
- public controller manifests
- reproducible builds
- proposal-based upgrades
RISK-REPRO-002HIGHOPEN
Incomplete reproducible production builds
Published source is not yet independently linked to every deployed critical Wasm.
Current controls
- source-controlled release records
Target controls
- pinned build environment
- deterministic builds
- public build manifests
RISK-PRIVACY-PUBLIC-003HIGHOPEN
Remaining public-detail privacy gaps
Some public transaction-detail or recent-trade paths may expose exact or fingerprintable information.
Current controls
- owner-oriented major read paths
- existing source audits
Target controls
- owner scoping
- public aggregate contract
- recent-trade minimization
RISK-PRIVACY-OPERATOR-004HIGHOPEN
Broad operator or administrator data access
Early-beta operational paths may expose more user-level information than the target model permits.
Current controls
- admin authentication
- manual operational controls
Target controls
- access inventory
- aggregate health
- user-authorized support
RISK-CROSSCHAIN-005HIGHOPEN
External-chain and gateway risk
Deposits and withdrawals depend on external chains, contracts, gateways, RPCs, signatures, fees, evidence, and finality.
Current controls
- route allowlists
- evidence
- finality thresholds
Target controls
- fresh route registry
- bounded execution
- stronger canary evidence
RISK-KEY-006HIGHOPEN
Signing and key-management risk
External execution depends on signing authority and key-management systems.
Current controls
- narrow operational procedures
- restricted identities
Target controls
- narrow signing scope
- rotation
- minimum-authority keepers
RISK-LIQUIDITY-007HIGHOPEN
Limited liquidity and execution quality
Public Beta liquidity does not yet match mature CEX or leading DEX markets.
Current controls
- current pools and market workflows
Target controls
- core-market depth
- measured spread and slippage
- market-maker program
RISK-STABLE-008HIGHOPEN
Upgrade and stable-state compatibility
Critical financial upgrades may create stable-state compatibility risk.
Current controls
- stable-state inventories
- targeted audits
- post-upgrade checks
Target controls
- versioned migrations
- upgrade simulations
- rollback boundaries
RISK-PROJECTION-009MEDIUMOPEN
Data freshness and projection mismatch
Projection lag may cause stale or contradictory displays relative to Core.
Current controls
- source cursors
- rebuildable projections
- existing freshness checks
Target controls
- visible freshness
- automatic refresh after recovery
- mismatch alerts
RISK-FRONTEND-010HIGHOPEN
Frontend, domain, and delivery risk
A compromised frontend or domain can mislead users even when canisters remain correct.
Current controls
- frontend security audits
- controlled domains
Target controls
- bundle hashes
- release manifests
- independent verification links
RISK-AGENT-011HIGHOPEN
Agent permission expansion
An Agent or integration may receive broader read or execution authority than intended.
Current controls
- confirmation flows
- current grant foundations
- Core execution
Target controls
- scopes
- limits
- nonce
RISK-TELEMETRY-012MEDIUMOPEN
Telemetry and browser-storage privacy
Telemetry, receipt caches, sessions, addresses, or device context may create user-data exposure.
Current controls
- current client isolation and diagnostics
Target controls
- data minimization
- purpose and retention
- expiry
RISK-INCIDENT-013MEDIUMOPEN
Incomplete public incident process
Operational events can be fragmented or underexplained without one versioned incident registry.
Current controls
- development and deployment records
Target controls
- severity model
- incident IDs
- timelines
RISK-ISSUER-014HIGHOPEN
Token issuer and contract risk
Stablecoins and wrapped assets depend on issuers, contracts, mints, bridges, or chain-key systems.
Current controls
- canonical route controls
- asset registry
Target controls
- contract disclosure
- route provenance
- pause and retirement process
RISK-CYCLES-015MEDIUMOPEN
Canister resource and availability risk
Cycles, memory, or operational health can affect availability.
Current controls
- cycles monitoring
- manual replenishment
Target controls
- public-safe health
- threshold alerts
- funding policy
RISK-GOVERNANCE-016HIGHOPEN
Premature or concentrated governance
Launching SNS before product, privacy, reproducibility, and distribution readiness may formalize weak or concentrated control.
Current controls
- pre-SNS controller phase
- readiness planning
Target controls
- launch gates
- public threat model
- distribution analysis
PUBLIC INCIDENTS
Incidents should be permanent, traceable, and correctable.
SSS has opened its first formal incident record. Facts, user protection, recovery status and unresolved boundaries remain visible while the audit continues.
SSS-INC-20260728CONTAINEDRECOVERY OPEN
July 28, 2026 CLMM exploit
The known exploit path has been contained. Seven affected assets were reconciled to atomic units, user liabilities remain fully covered, and the external proceeds are under continuing multi-chain monitoring.
7/7assets reconciled58external payouts matched≈95%team-owned impact0user haircut planned
Read dialogue and recovery noticeFull technical post-mortem pending audit closeout
AUTHORITY & GOVERNANCE
Who may do what—and what they must never do.
Governance is not an SNS badge. It is the verifiable combination of controllers, upgrade rights, financial authority, operational permissions, and emergency boundaries.
Current governance state: Pre-SNS.Controllers still require public observation. SNS control is a target, not a current fact.