Resources > Security

Security

Provide production security guidance for Quovra operators and integrators.

Security

Quovra's security boundary is the settlement path.

Authentication

Wallet users authenticate to Solana by signing transactions. Quovra does not need usernames or passwords for deposit and claim actions.

Authorization

ActionAuthorization
DepositWallet signs token transfer and program instruction
SettleAny signer may submit a valid proof
ClaimWinning wallet signs claim
FaucetPublic endpoint, server mint authority required

Secrets management

Keep these out of source control:

  • QUOVRA_FAUCET_SECRET
  • TXLINE_JWT
  • TXLINE_API_TOKEN
  • SOLANA_KEYPAIR
  • any private wallet key

Key rotation

Rotate secrets when:

  • A local environment is shared.
  • A machine is compromised.
  • A maintainer leaves the project.
  • Logs or deployment metadata accidentally expose values.

Replay protection

  • Claims are blocked after position.claimed = true.
  • Settlement is blocked after market.resolved = true.
  • Deposit side is locked after the first position deposit.

Rate limiting

The faucet enforces a 30-second per-wallet cooldown in process. For public production, add host-level IP rate limiting and abuse monitoring.

Audit logging

Log:

  • faucet requests and errors
  • keeper dry-run decisions
  • settlement transaction signatures
  • claim transaction signatures
  • RPC failures
  • TxLINE proof failures

Never log secret values.

Compliance note

Quovra runs on devnet with test USDC. It is not a real-money wagering product. Treat mainnet deployment as a separate legal, compliance, and security review.

Related pages

Search keywords

security, secrets, key rotation, authorization, replay protection, compliance

Last updated: [YYYY-MM-DD]