Security at The Hold

To report a suspected vulnerability in The Hold, email security@cryptodexlabs.com. No X account or connected wallet is required.

• Describe the affected page or feature, what happened, and the potential impact.
• Include minimal reproduction steps, the approximate time and time zone, and your browser or wallet version when relevant.
• Redact personal information and secrets from screenshots or logs. Share only the evidence needed to explain the issue.

Never email a seed phrase, private key, password, verification signature, signed transaction, session cookie, or recovery link. Do not send funds or approve a transaction to submit a report.

Report the issue privately rather than posting exploit details or other users' information publicly. Do not access other users' accounts, move funds, disrupt the service, or perform destructive testing. Sending a report does not authorize testing of The Hold or third-party systems.

For access, correction, deletion, or other privacy requests, use privacy@cryptodexlabs.com. Contact-message handling is described in the Privacy Policy.

Non-custodial does not mean risk-free. A malicious approval, compromised wallet, vulnerable third-party program, or user error can still cause loss.

The Hold issues a purpose-specific, short-lived verification message for the selected wallet and verifies the returned signature. This establishes control for a The Hold session without creating a swap or moving assets.

Verification data is bound to the expected The Hold origin and session flow. Technical anti-replay and abuse controls are intentionally not documented in bypass-useful detail.

The Hold validates confirmed fee-bearing acquisition receipts, lifecycle transitions, executed thresholds, ownership evidence, frozen rosters, and contest consent on the server. Browser claims and later wallet balances cannot mint official XP.

When required execution, fee, lifecycle, or ownership evidence is unavailable, the event fails closed rather than accepting an unverified score.

A private collector can choose to compete without opening their collector profile. The Monthly XP leaderboard then exposes only username, rank, XP, qualifying activity count, and contest or winner status. Wallet addresses, balances, portfolio value, exact holdings, private collections, showcases, and private achievements remain hidden.

Monthly Contest Participation starts off. Turning it off removes active standing and eligibility for any announced season prize while preserving private XP and achievements.

Jupiter is responsible for swap routing, transaction construction, slippage management, and managed execution. The Hold binds each Jupiter order to the verified wallet and session, requires its disclosed 0.50% integrator fee configuration, and prevents the same reviewed order from being approved as a replacement trade while execution is unresolved.

Phantom previews and signs the Jupiter transaction and may add its own wallet safety guards before signing. The Hold verifies the signer envelope and wallet signature, then Jupiter validates and executes the wallet-returned transaction against the original order request. After Jupiter reports confirmation, The Hold refreshes server-verified wallet holdings before collection or XP state changes. These boundaries do not eliminate market, token, third-party program, wallet, or network risk.

The Hold depends on Solana, wallet software, RPC and blockchain-data providers, price sources, swap and liquidity routing, hosting, and analytics infrastructure. An outage, compromise, incorrect response, or breaking change in one of these systems can affect availability or safety.

• Never share your seed phrase, private key, wallet recovery file, or device passcode.
• Verify the URL is cryptodexlabs.com before connecting or signing.
• Read every wallet message and transaction prompt; reject anything unexpected.
• Beware of fake prize claims, urgent direct messages, cloned websites, and unsolicited “support.”
• Keep your browser, wallet, operating system, and device security up to date.
• Review assets, amounts, slippage, fees, and destination details before approving a swap.

Use the official The Hold X account (opens in a new tab) to check public product and contest announcements. Never post or send a seed phrase, private key, signature challenge, session material, or other wallet secret through a public channel.