Security and trust
Trust assumptions, what each party can do to you, the caps that bound the damage, and what nobody has audited yet.
This page lists who can hurt you, how much, and what stops them. Read it before you send an amount you care about.
Parties and their powers
| Party | Can | Cannot |
|---|---|---|
| NEAR Intents and its solvers | fail to fill, which triggers a refund; quote a bad price within your 1 % slippage | redirect the payout away from the recipient in the signed quote |
| The HOOZ site | show you a wrong deposit address if compromised | take ETH already delivered |
| The courier (fallback road) | hold one order's ETH on Arbitrum One for seconds | touch the direct road, or any envelope |
| The Sorter owner | pause sweeps, change the fee up to 2 %, change caps | block withdraw, or move ETH out of an envelope |
| Anyone | call sweep on your envelope, which buys you $WHOZ | send the ETH anywhere but the purchase for you |
The trusted moments
- The deposit address. You trust that the site shows the address NEAR Intents generated. Check it in the tracker, which reads it from NEAR Intents, and compare it with the address in your wallet before you send.
- The fallback hop. On the Arbitrum road the courier holds your ETH between the settlement and the Relay deposit. Bounded to one order, visible on chain.
- Instant deliveries. When the courier calls
deliverfrom the vault, you trust it to do so only for real settlements. The caps bound the damage to 0.5 ETH per order and 5 ETH per day, and the vault is treasury capital, never yours.
Before launch
NEAR Intents pays your address directly. No HOOZ contract and no HOOZ key sit on the road.
Keys
- Courier key: hot, on the courier machine. Holds gas money.
- Treasury key: cold. Owns the Sorter.
- Privy App ID: public by design. The site uses wallet login only and no server secret.
Audits
None yet. The contracts follow the patterns described in Contract, and the repository carries a Foundry test suite in contracts/test. Treat HOOZ as unaudited software and size your envelopes accordingly.
Reporting a problem
Message the team on X. Do not post exploit details in public replies.