Security

The contracts are on chain

Every Rare package is published on Sui mainnet, and its bytecode can be read by anyone. The package ids are in the contracts overview, each with a Suiscan link.

The Move source is not in a public repository yet. Source verification is coming, so that anyone can check the published bytecode against the source. Until then, each contract page documents the modules, objects, functions, abort codes and events in full.

Audits

No third-party audit of the Rare packages has been published. When one is, it will be linked here.

Who controls what

• Admin and upgrade caps are held by a single Rare address today. They can pause new orders, change fees within the on-chain caps and upgrade the packages.
• Fee changes are timelocked. Marketplace and launchpad fee changes are queued on chain and apply only after 48 hours. Fees are capped in the contracts: 3% for the marketplace and 5% for the launchpad. See Fees and royalties.
• Pauses never lock funds. A pause stops new orders, mints and unlocks. Cancels, refunds, withdrawals and payouts never check the pause switch.
• Listings stay in your kiosk. A kiosk listing holds an exclusive purchase cap on the item, not the item itself. Delisting returns full control.

Report a vulnerability

Email [email protected] with the details: what is affected (a contract, rare.market, the API or Rare OS), the steps to reproduce it, and the impact. Please do not test against other people's funds or disclose the issue publicly before it is fixed. You will get a reply as soon as the report has been read.