Security

Non-custodial by design

• With a BNB Chain wallet, your wallet signs and sends everything you do. BRUNE never asks for or stores a private key.
• BRUNE prepares transactions and accepts them as yours only when they match what it prepared: sent from your wallet, to the expected contract, with the expected data and value.
• Coins cannot be changed after launch: the supply is fixed, the tax cannot be raised, and the fee split of each coin's vault is fixed forever.

Launch integrity

• Every launch goes through the BRUNE launcher contract, which accepts only launches that BRUNE's server signed (EIP-712) for that wallet, with a 10-minute deadline. It creates the token, its fee vault and your dev buy in one transaction, and records the coin so the bridge can tell a real BRUNE coin from any other Flap token.
• Before etching on Bitcoin, BRUNE checks the token, its supply, decimals, name, tax, vault, creator and the fee paid, all on chain. Any difference stops the launch for review.
• Every launch step is saved before the next one starts. A crash or restart resumes exactly where it stopped and never repeats a step.
• BRUNE's Bitcoin keys are held in Turnkey. The launch key can only pay for etchings BRUNE has checked, from the launch treasury.
• Every coin's Runes sit at its own 2-of-2 Bitcoin address. A payout needs BRUNE's bridge key (in Turnkey) and an independent co-signer on the Internet Computer. Both check every payout against a request locked on BNB Chain (the co-signer reads BNB Chain itself). Neither can move the Runes alone. See Verify custody.

BRUNE's contracts

• The launcher, the fee vaults, the bridge, the buyback, the platform treasury and the fee router sink cannot be upgraded. A change means a new contract, deployed in public.
• Their admin is a 2-of-3 Safe of hardware keys behind a 48-hour timelock. Every admin action emits an event and is public two days before it runs. A separate guardian key can only pause the bridge.
• Fee vaults have no owner: anyone can trigger a claim, and it always pays the fixed recipient. Their split is set when the coin is created and can never change.
• The platform treasury, which receives BRUNE's fees, forwards 25% of every BTCB it receives to the $BRUNE buyback before anything can leave it. BRUNE's operations key can withdraw the rest only to its own allowed wallets and within a rolling daily cap; the guardian can pause those withdrawals.
• The bridge can only lock and release; it cannot create tokens. Separate keys for each role: the attester records payouts and releases deposits (capped per coin per day, and in number per day), the registrar can only open the bridge for a new BRUNE coin with default limits (see The bridge), the guardian can only pause or cancel a queued release, and the admin cannot move tokens. Refunds need the co-signer's signature.
• Before any payout or release, BRUNE checks that the Runes in custody equal the tokens on BNB Chain plus pending requests plus burned tokens. If not, the bridge stops.
• All sources are published and verified on BscScan and Sourcify with their exact compiler settings.

What Flap can do

Every BRUNE coin is a Flap token traded through Flap's Portal. BRUNE does not control Flap, and Flap keeps admin powers you should know about:

• The Flap Portal (0xe2cE6ab80874Fa9Fa2aAE65D277Dd6B8e65C9De0) and VaultPortal (0x90497450f2a706f1951b5bdda52B4E5d16f34C06) are upgradeable. Upgrades are controlled by a 3-of-4 Safe (0x1f96BC88f0794060433Be5F3EC9159a9C4f08A3b) with no timelock. An upgrade could change fees, the curve or how taxes are paid out.
• A Flap role can redirect a coin's vault share of the tax (changeMarketWallet) without an upgrade. That share pays creators, routed recipients, the buyback and BRUNE. Holder dividends and BRUNE's integrator commission cannot be redirected this way.
• Flap can pause features, such as new launches or specific trading paths, and owns every token contract.

BTCB is custodial

Every BRUNE coin is priced in and paired with BTCB (0x7130d2A12B9BCbFAe4f2634d864A1Ee1Ce3Ead9c), Binance-Peg BTC. BTCB is issued by Binance and backed by Bitcoin that Binance holds; it is not Bitcoin itself.

• Its contract owner (0xF68a4b64162906efF0fF6aE34E2bB1Cd42FEf62d) can mint, burn and freeze BTCB.
• If Binance stopped redeeming BTCB or froze an address, the value of every BTCB-paired pool, fee balance and dividend would be affected. BRUNE cannot prevent that.
• The Runes on Bitcoin are not BTCB: they stay in their 2-of-2 custody whatever happens to BTCB.

Reserves

Two parts of BRUNE hold money for people: BTC accounts (people who trade with only a Bitcoin wallet) and BTC payouts (routed fees, holder rewards and invite rewards waiting for the next batch, and cash-outs paid from BRUNE's BTC float). The Reserves page shows both, refreshed on a schedule:

• The BTC BRUNE owes for payouts and cash-outs, against the BTC float and what is on its way to it, with the Bitcoin addresses so you can check them on mempool.space. Cold storage, where the float sweeps its excess, is shown too but does not count towards coverage.
• Every BTC account has its own BNB Chain wallet, so what it holds is what BRUNE owes it. The page shows their total, and BRUNE checks that every transaction of those wallets is one it sent for the owner.
• A shortfall, an unexplained transaction or a low float raises an alarm that pages BRUNE's operators.

Runes in custody are a separate check: every coin's Runes against its tokens on BNB Chain, on Verify custody.

Compliance

BRUNE follows sanctions law and the eligibility rules in its Terms:

• Regions. BRUNE does not serve people in countries and territories under comprehensive sanctions, or where it is not allowed. From those places the site still opens, but every action is refused and the site says so.
• Addresses. Before BRUNE prepares a transaction or sends a payment, the BNB Chain and Bitcoin addresses involved are screened against sanctions lists. A match is refused: nothing is prepared, signed or sent, and the site says why. If screening is unavailable for a moment, BRUNE refuses for now rather than skip it.
• Your own wallet is never touched: BRUNE cannot freeze or take tokens or Runes you hold. Screening applies to what BRUNE does for you (its website, API, BTC accounts, and the payouts and bridge transfers it signs).

The location check uses the country your connection comes from; see the Privacy Policy. Think a refusal is a mistake? Email support@brune.fun with the address.

Verify it on chain

Every BRUNE coin runs on public contracts. Anyone can inspect them on BscScan:

The website and API

• Actions that change anything are accepted only from the BRUNE website.
• Rate limits protect launches and every other action from abuse.
• The database is reached over verified TLS, with a separate least-privilege login for each part of the system.

Report a problem

Found a bug or a security issue? Email support@brune.fun with the coin address (CA) or transaction, and what happened.