Security audits
Hinkal mitigates smart contract risk through three ways: independent audits of the code, transaction screening of the funds that enter it, and standing bounties.
Audits
Hinkal's contracts and circuits have been reviewed by six independent firms: zkSecurity, Zokyo, Quantstamp, Secure3, Hexens, and Neodyme. The reviews cover the Solidity contracts, the Circom circuits, and the interaction between them - the zero-knowledge layer is audited separately from the on-chain layer, since a bug in either would break the privacy guarantees.
KYT screening - Continuous
Every deposit is screened against Chainalysis before it enters the private balance, and depositor addresses are re-screened continuously as sanctions and risk data update. Funds from sanctioned or high-risk addresses cannot be transferred privately; they can only be withdrawn publicly to the address they came from.
This protects the protocol as well as its users: no legitimate user's funds are ever commingled with flagged funds, and anything leaving Hinkal can be treated by exchanges and counterparties as pre-screened. Screening is of wallet addresses, not identity - no KYC, no personal data collected.
See Compliance for the mechanics.
Bug Bounties
Hinkal's contracts and circuits are open to independent researchers through public bug bounty programs, with rewards based on severity.
Researchers who find an issue should report it to the Hinkal Team rather than publicly.
Last updated