Security overview

This page summarizes the security guarantees Tachyon stands behind. For the integrator-facing privacy breakdown, see privacy guarantees.

Properties Tachyon guarantees

Property	What it means
Confidentiality	Intent contents are end-to-end encrypted. Only the user (via viewing key) and the assigned solver can read an intent.
Integrity	Settlement transactions are verifiable on-chain. The protocol guarantees an intent settles for the user it was signed by, to the recipient and amount the user authorized.
Availability	A diverse network of solvers means no single party is required for delivery. If solvers don’t fill, users are refunded via the on-chain escape mechanism.
Censorship resistance	The protocol cannot selectively block valid signed intents. The escape mechanism guarantees recoverability of funds independent of any operator’s cooperation.
Compliance compatibility	Confidentiality does not prevent auditability. Selective disclosure lets users grant scoped read access to designated counterparties.

What Tachyon (the organization) cannot see

Intent amounts
Intent sender or recipient addresses
Intent parameters (token pairs, TWAP slices, payroll amounts, x402 merchant addresses)
User viewing keys or viewing permission lists

This is by design. The organization is not in a position to leak data it doesn’t hold.

Threat model summary

Threat	Tachyon’s answer
Chain-watching adversary	Sees only stealth-address activity, no linkage.
Solver trying to read foreign intents	Cannot, solvers only receive intents they have won.
Solver trying to leak intents they did win	Constrained by the protocol; misbehavior is detectable and economically penalized.
Operator trying to read intents	Cannot, protocol is designed so operators have no plaintext access.
Protocol halt	On-chain escape mechanism returns funds to users.
Future cryptanalysis (incl. quantum)	Hybrid cryptography designed to resist current and future attacks.

For the full per-threat treatment, see privacy guarantees → threat model.

Audits

Audits are in progress. Reports will be published here and linked from this page when complete.

Bug bounty

A formal bug bounty is not active today. Responsible disclosures are still welcome via the channel below.

Status and disclosure

Real-time status is surfaced directly in the user dashboard at testnet.app.tachyon.pe, there is no separate status page today. To report a security vulnerability, email sudeep@tachyon.pe. Please do not open public GitHub issues for security bugs.

Testnet caveats

Tachyon is currently on testnet. The architecture and guarantees are operational on testnet, but you should not use real funds or production data until mainnet launches.

Auditor access

How to wire designated auditors into your integration.

Overview

Concepts

Security

More

Security overview

Properties Tachyon guarantees

What Tachyon (the organization) cannot see

Threat model summary

Audits

Bug bounty

Status and disclosure

Testnet caveats

Auditor access

​Properties Tachyon guarantees

​What Tachyon (the organization) cannot see

​Threat model summary

​Audits

​Bug bounty

​Status and disclosure

​Testnet caveats

Auditor access

Properties Tachyon guarantees

What Tachyon (the organization) cannot see

Threat model summary

Audits

Bug bounty

Status and disclosure

Testnet caveats