Public contract source
Review the DCA engine, adapters, tests and deployment configuration without relying on a marketing badge.
Open contracts ↗SECURITY & TRANSPARENCY
Verify the system.
Then verify the order.
HoodFlow exposes the code, contracts, route rules and limitations that matter before a wallet signature. The independent audit is still pending; source review and responsible disclosure are open now.
Audit pending · source public · disclosure openINTERFACEMAINNET BETA
Direct Buy and Sell are enabled only for reviewed full-fill routes.
INDEPENDENT AUDITPENDING
No audit badge is shown before a public final report and remediation log exist.
CUSTODYSELF-CUSTODY
HoodFlow does not hold wallet keys or purchased tokens.
TRUST SIGNALS AVAILABLE TODAY
Audit pending does not mean
evidence unavailable.
Automated security checks
Contract and release suites run on each change. Code scanning helps catch regressions but is not presented as an audit.
View checks ↗Responsible disclosure
A public security policy defines private intake, scope, response target and safe-testing rules. No reward is implied before a funded bounty exists.
Read reporting policy ↗Team identity
The operator is currently pseudonymous and is not presented as doxxed or independently identity-verified.
Official X account ↗Addresses used by the interface
Universal Router0x8876789976dEcBfCbBbe364623C63652db8C0904 ↗
Minimum output
Minimum received equals the executable quote multiplied by one minus your selected slippage. The router call fails if the protected amount cannot be delivered.
Short-lived permission
Permit2 signs the selected amount with a ten-minute expiration. Review the token, spender, amount and deadline in your wallet.
Route gating
Watch-only assets remain visible but cannot be traded until a complete-input fork execution passes and a fresh quote is available.
Known limitations
- Smart contracts and interfaces can contain undiscovered vulnerabilities.
- The independent audit is pending; automated tests and public source do not replace it.
- No funded public bug bounty has been announced yet.
- The operator is pseudonymous and not independently identity-verified.
- The DCA engine is currently controlled by a single externally owned wallet; a multisig or timelock is not yet verified.
- Oracle reference prices can be delayed when underlying markets are closed.
- DEX liquidity can move between the quote and wallet confirmation.
- Stock Tokens are not shares and may be restricted by jurisdiction.
- Robinhood Chain, RPC providers, routers and wallets are third-party systems.