Security at KOLHUBZ

KOLHUBZ is in public beta. Escrow contracts currently run on test networks (Base Sepolia · BNB Smart Chain Testnet · Solana Devnet · Tron Nile). Amounts shown on the site — open budgets, escrow-locked value, settled deals — are testnet tokens with no real-money value. Mainnet launch follows the independent audit.

Deal budgets are held by the KolEscrow smart contracts on Base, BSC, Solana and Tron. Contracts follow checks-effects-interactions, use reentrancy guards and pausability, and every state change emits an on-chain event. Status: internally reviewed (multi-track) · an independent third-party audit is scheduled before mainnet. Until that audit is complete we do not call the contracts "audited".

There is no platform wallet holding user money. Release paths are fixed in the contract: mutual approval, auto-release, mutual cancellation or an arbiter ruling. Platform service fees for optional plans are simple wallet-to-address transfers, verified on-chain.

Hidden-profile identities are masked server-side and never sent to the client. Sensitive documents — KYB files, dispute evidence, message attachments — live in private storage, reachable only through short-lived signed URLs. Exchange API keys are stored encrypted with AES-256-GCM and are never displayed after entry.

All inputs are schema-validated server-side; every API route enforces authentication, role checks and rate limits. Anti-scraping protections — request throttling, enumeration quotas and canary profiles — guard the creator directory.