Security

Security is the foundation of the platform. From audited contracts to a wallet we cannot open, here is how the network protects your assets — and how you can help.

1. Smart-contract security

Every YACoin contract is reviewed before deployment using a hybrid approach: static analysis tools to catch known vulnerability patterns, and AI-driven review to surface subtle logic flaws. The full report — including findings by severity, function surface, and standards coverage — is published openly on the main site in the Audit section.

Key findings from the latest audit have been addressed or are tracked for remediation. We re-audit after any material change to the contract code.

2. Key custody

The YACoin wallet is self-custody. Keys are generated on your device inside secure hardware storage and never transmitted to us, which means we cannot move your funds, freeze them, or recover them on your behalf.

Multi-signature and biometric recovery are available so that losing a single device does not mean losing access to everything.

3. Bridge and swap safeguards

Cross-chain transfers are the highest-risk surface in any Web3 platform, so bridge contracts run under rate limits, per-transaction caps, and a timelock on parameter changes. Swap routes are simulated before signing, and the client shows the exact amount that will leave your wallet.

4. Protocol treasury

• On-chain only. Treasury balances and every outflow are visible on-chain and reconcilable by anyone.
• Cold storage. The majority of treasury assets are held offline, with limited hot-wallet balances for operations.
• Multi-signature. Treasury movements require multiple approvals and follow a governance vote, removing any single point of failure.

5. Self-custody and key security

YACoin is non-custodial: only you control your keys. The official wallet supports biometric recovery and multi-sig to reduce the risk of losing access. Recommendations for keeping your keys safe:

• Write your seed phrase on paper and store it offline — never in a cloud note or screenshot.
• Use a hardware wallet for large holdings.
• Enable multi-sig so no single device can move funds alone.
• Never share your seed phrase with anyone, including support.

6. Network and infrastructure

• Encryption. All traffic is encrypted in transit (TLS). Sensitive data is encrypted at rest.
• Access controls. Internal systems use least-privilege access with mandatory multi-factor authentication.
• Monitoring. Infrastructure is monitored 24/7 for anomalies and attacks.
• Incident response. A documented runbook governs detection, containment, and disclosure of incidents.

7. Bridge security

Cross-chain bridges are among the most attacked surfaces in crypto. Yacoin bridges are secured by a multi-sig validator set, subject to per-transfer limits, and capped to contain blast radius. Always use the official bridge interface linked from the main site.

8. Responsible disclosure

If you discover a vulnerability, we want to hear from you. Report it responsibly and we will investigate promptly and reward valid findings.

• Email: security@yacoins.com
• Please do not exploit the vulnerability or disclose it publicly before we have remediated it.
• We acknowledge reports within 48 hours and aim to triage within 5 business days.

9. What to do if something goes wrong

• Suspected key compromise: move funds to a new wallet immediately, then contact support.
• Suspicious transaction: verify the contract address on the main site and official channels.
• Phishing: only interact with the official yacoin domain. Bookmark it.

10. Contact

Security questions or concerns? Email security@yacoins.com. For urgent matters, mark your subject line as URGENT.