Nelta runs on Solana Devnet with test funds only. It has not been audited. Don't use it with real funds.

Please report security problems privately, not in a public issue:

1. Open Report a vulnerability on this repo.
2. Say what you found, how to reproduce it, and what it could affect.

We aim to reply within 3 days and to fix confirmed problems before talking about them in public. There is no bug bounty.

• The Nelta program (programs/nelta, program ID 9Rk99npY6kwtEX7MVuq2SWyr1WQQ7f9S9i8mXY4iJ4R on Devnet).
• The keeper (scripts/src/worker.ts, run on GitHub Actions).
• The Android app (app/) and the signed nelta.apk releases.

The most important rules are that only the owner can ever receive their SOL or collateral, a rule runs at most once, and the owner can always recover without the app or keeper. Anything that breaks one of these rules is a serious problem.

Out of scope: bugs in Velocity, Solana, or wallet apps themselves (report those to them), and Devnet outages or slow fills.

Only the latest release gets fixes.

The checked-in Android dependency tree still reports these advisories:

• decode-uri-component: Expo Router uses it through CommonJS query-string. The patched decoder is ESM-only, and npm proposes an Expo Router 58 upgrade. That needs a separate SDK migration and Android verification.
• braces: used by the Metro/build file-matching tools. The latest available version, 3.0.3, remains affected.
• node-forge: used by Expo's development and code-signing tools. The latest available version, 1.4.0, remains affected.

Npm counts affected parent packages as well as the packages named above. Those counts do not establish that each warning is reachable from the APK. We have not demonstrated an exploit through Nelta. Do not apply npm's proposed Expo 44 downgrade to clear the build-tool warnings.

Rust's bincode 1.x also has an unmaintained-package warning. It is an Anchor dependency; replacing its serialization format requires upstream compatibility work.

Run npm audit in both app/ and scripts/ to check the installed lockfiles again. Dependency findings can change as upstream publishes fixes or advisories.

The sign-only fill path simulates the signed transaction before broadcast. The sign-and-send fallback checks an unsigned transaction before asking for approval, then requests skipPreflight: true. The wallet controls that submission, and market conditions can change while the user approves it. A failed transaction can cost a network fee even when the position does not change.

A wallet submission error without a returned signature does not always prove that nothing was broadcast. Nelta keeps that outcome uncertain and asks the user to check the receipt before retrying. Wallet-specific preflight failures need reliable evidence that no broadcast occurred before they can be treated as safe automatic retries.

Only install Nelta from this repo's Releases. Official APKs are signed with one release key, so Android will refuse an update signed by anyone else.