What we can stand behind
Kadia is unaudited. The DEX is live on Ergo testnet, the explorer reads mainnet, and lending is in development. This page says what the apps and this site do today, and nothing more.
Audits
No audit reports are published. The review planned before mainnet is a final audit by the strongest available AI agent model, not by an outside firm, and it hasn't been run yet. Its report will be linked here with its scope and date. Until then, treat all Kadia software as unaudited.
This website and the apps
- Static files with no third-party scripts, fonts or trackers, and no cookies or analytics.
- A strict content security policy: no inline or remote code, and the apps talk only to the site that serves them.
- The lending app runs one WebAssembly module. It must match a pinned hash before it runs, and it can't reach the page, the network or the clock.
- Reproducible builds: anyone can rebuild the apps and compare every file's hash.
- No Kadia app ever asks for a seed phrase or a private key, and none ever will.
Wallets and signing
- Keys stay in your wallet. A wallet connects only when you choose it.
- Every action stops at a plain-language review before anything is signed.
- Before sending, the app checks that the wallet signed exactly the transaction it built.
- Signing is on for the DEX on Ergo testnet only. Mainnet signing is refused by design, and lending and explorer signing stay off.
Reporting a problem
A security contact and a disclosure policy haven't been published yet. They will appear here, and in this site's security.txt, once they exist.