Security

Qubit never holds user funds. Trades execute on provider contracts; the only Qubit contract in the path splits one transfer and ends the transaction with a zero balance.

Rules the code enforces

Every money path is tested twice before users see it. Once on a mainnet fork against the live provider contracts, once with a live micro-transfer. Dry runs stop before the signature and never observe a revert, so they do not count as verification. The current state of that checklist lives with the deployment notes: CCTP fast, LayerZero OFT compose, Gas.zip refuel, Relay, LI.FI and Intents have all been executed for real.

Simulate before signing. Every transaction the engine builds is checked with eth_call from the sender's address first. A route that would revert never reaches a wallet prompt.

The chain is part of the transaction. chainId is written into the transaction itself, not merely checked before opening the wallet, so a network switch in another tab cannot cause a signature on the wrong chain.

Amounts are BigInt end to end. On-chain values never pass through floating point. Dollar figures exist only for ranking routes and computing points.

Fee fields are server-side. Routing terms are set on the server; fee fields arriving in a client request are discarded.

Contract safety

The fee ceiling is a constant in QubitGate, so a hostile message carrying an absurd feeBps is clamped rather than honoured. Cross-chain messages carry the source chain's token address, so the destination token is resolved through Circle's own registry — reading the address from the message would revert forever and freeze the transfer, which is exactly the bug an adversarial review caught before deployment. Malformed messages have an owner-only rescue path that delivers the funds without taking a fee. Ownership sits on a cold wallet; the deployer and relayer key has no owner rights.

Keys

Secrets live outside the repository. The relayer key holds only gas. Collector wallets receive fees and sign nothing. Compromising the hot key lets an attacker waste gas, not move user funds or change the contract.

What Qubit cannot protect you from

Provider contracts, relays and centralised venues are third-party code and third-party businesses. Their fees and delivery times change without notice, which is why every quote is read live and nothing is cached. A private route hides links between addresses from public analysis; it is not anonymity toward the venues executing the trade.

Found something? Write to Qubit Laboratory before publishing it.