Security

Official identity

Everything official about reel is listed here. Anything not on this page is not reel's.

A token's identity is its mint address, never its ticker, and a program's identity is its program id. A real address copied onto a fake page doesn't make the page real: check the hostname too.

reel has no airdrop

reel has no airdrop and no reward you need to "unlock". The only things you can claim are what a pool already owes your wallet, recorded on chain in your claim ledger, the fees your own positions have earned, and the Holder Pot earnings reel-hook has booked for your wallet.

• reel never asks for a seed phrase, a private key or a recovery code. Nobody needs them to help you.
• reel does not send direct messages for support, and never asks you to verify, migrate or "sync" a wallet through a link.
• Type the address yourself or use a bookmark. A lookalike hostname, an extra word or a subdomain you don't recognise is not reel.

Verification

reel and reel-hook were reviewed and verified end to end on Solana mainnet: every instruction ran against live accounts and its results were checked against the SDK's figures. reel-vaults, the periphery program, is verified on mainnet module by module before each module opens.

• The upgrade authority of reel and reel-hook is the reel treasury, BA9VJD2ux2XtQ1diiurBR9pmgqtb33ivs6H8fmSgNPXr, so the code can still change. reel-vaults' upgrade authority is still the deploy wallet while its mainnet verification finishes; it moves to the treasury after.
• A deposit cap is a per-pool setting the admin can set or clear; each pool's page shows its value.

What the admin can and cannot do

The reel program has an admin account. Every power it has is listed in the program spec, and the program refuses anything else.

The admin can:

• set fees for future pools: the treasury, the fee keeper, launch and root fees (at most 0.01 SOL and 1 SOL), the minimum fee (at most 1%), the protocol share floor, referral, recapture and integrator rates;
• list quote tokens and integrators, keep the NYSE holiday calendar, and admit market blocks;
• set deposit caps, which only block new deposits;
• pause new pools, launches or owned roots;
• through the fee keeper, move a pool's managed fee inside the cap that pool froze at launch.

The admin cannot:

• move user funds, or pay any fee bucket anywhere but its fixed recipient;
• change a pool's frozen settings;
• pause swaps, withdrawals, fee collection or claims;
• mint, freeze, or change a token's transfer hook.

The largest power is the program's upgrade authority: whoever holds it can replace the program's code. It is held by reel's operator and remains the largest power until it is revoked. You can read who holds it on any Solana explorer.

How to verify before you sign

1. Open the reel program id from this page on an explorer. Check that it is executable and see who holds its upgrade authority.
2. For a pool, check that both vaults are owned by VAULT_AUTH and that the pool account is owned by the reel program.
3. Read the pool's frozen settings (PoolParams): its Hook Blocks and what each charges.
4. Read the tokens' mints: authorities, Token-2022 extensions, and for reel launches the transfer hook pointing at reel-hook.
5. Simulate the transaction before signing. reel's app is designed to simulate every request first; your wallet may show a simulation too.
6. Compare your wallet's prompt with what you asked for: the program, the accounts, the amounts.
7. After sending, check the receipt on an explorer. An approval in your wallet is not a receipt.

Report a vulnerability

Report contact: Not published yet. Until a channel is listed here, reel has no security inbox, so any address claiming to be one is not ours.

• Don't publish exploit details or test against pools with other people's funds.
• Send only what is needed to reproduce: the program, the instruction, the accounts and the expected versus actual result.
• Never send a seed phrase, private key or signature with a report. Nobody handling a report needs one.

To report a phishing site or a fake account, report it to the platform hosting it first, and keep only its public link and a screenshot. Don't revisit it or connect a wallet to it.