Security

What is enforced by the program, what Halo operates itself, and the risks of trading memecoins.

What the program enforces

Halo's launch, curve, fee split, graduation and liquidity lock run in Meteora's Dynamic Bonding Curve and DAMM v2 programs. Halo's configuration account fixes the supply, the curve, the 1.56% fee, the creator's share and the liquidity lock, and a coin that has launched keeps the settings it launched with. Creators claim their fees with their own wallet. Halo does not deploy its own smart contract.

What Halo operates

Some parts are run by Halo off chain and rest on Halo doing what it says:

• Buybacks and burns. Halo's job claims its share of each coin's fees and uses them to buy that coin back and burn it, and the treasury share does the same for the main coin. The Meteora program does not enforce this. Every swap and burn is a public transaction, so the on-chain record is the evidence of what was spent and burned.
• Indexing and the website. The board, charts, holder lists and burn totals come from Halo's indexer and API. The chain is the authority for balances and trades.
• Migration job. Anyone can send a migration transaction, and Halo runs a job to do it promptly.

The fee claimer wallet that performs these tasks holds fees only until they are spent on a buyback, and its address will be published at launch. Its key sits on Halo's server, so the loss or theft of that key is a real risk: an attacker could redirect fees that have been claimed but not yet spent. The job is off until Halo enables it at launch.

Risks

• Smart-contract risk. Meteora's programs hold the SOL and tokens in every pool. A bug or exploit in them would affect Halo's coins. Halo does not control those programs.
• Dependence on Meteora. Fees, protocol cut and migration rules come from Meteora's programs. Halo's 20% fee figure, for example, is Meteora's setting, not Halo's.
• Fees and burns depend on volume. Creator fees and burns come from trading fees and are not guaranteed. A coin that nobody trades pays and burns nothing, and a burn does not guarantee a price.
• First-block grabs are costlier, not impossible. See First-block pricing. Check a coin's holders and trade history before buying.
• The launch tax also hits honest buyers. Anyone who buys in the first moments of a coin's life pays it, including buyers who take a small amount. It fades to the normal 1.56% in under a second.
• Holders can sell. Locked liquidity keeps the pool's liquidity in place, and any holder can still sell their tokens.
• Operator risk. Buybacks and burns rely on Halo's wallet and infrastructure. A technical failure can delay a burn; the reserve is kept and spent on the next pass, and the on-chain transactions show what was bought and burned.
• Wallet safety. Never share your seed phrase. Halo never asks for it.
• Regulation. Rules for tokens and for buybacks differ by country. Check what applies to you.

Reporting a problem

If you find a security issue in the Halo app or API, send the details through the contact link on halo.onl. Please do not share vulnerabilities publicly before they are fixed.