MuTC's settlement layer is published in full. You don't have to take our word for what it does — verify in your own browser that the code deployed on-chain is exactly the code below. The check runs between your browser and the blockchain; MuTC's servers are not involved.
MuTC settles over two rails. Pick one — the check runs between your browser and the blockchain, with MuTC's servers out of the loop.
A vault contract holds both legs and settles them atomically; MuTC has no power over an open vault. This check fetches the live bytecode from a public node and compares it against the published build.
BTC legs settle through MuTC's desk under three published rules: a fresh single-use deposit address per trade, release only when both legs are confirmed, and an automatic full refund past the deadline. Every settlement is public on the Bitcoin chain — paste one and check the maths. Prefilled with a real settlement executed on Bitcoin's public test network.
A vault pays out to the two trading parties only. There is no withdraw, sweep, pause, upgrade or owner function anywhere in the contract — MuTC cannot move an open deposit.
The second confirmed deposit swaps both legs inside one transaction. Neither side ever holds both legs. _settle()
After the deadline, a funded party takes their deposit back in full — no approval, no counterparty cooperation. claimTimeout()
Both sides may consent to cancel before execution; deposits return in full. Consent is withdrawable. consentCancel()
Transfers tolerate ERC-20s that return no value — mainnet USDT among them — so settlement cannot strand on a token quirk.
A vault opens only with terms signed by the venue, so nobody can mint a trade against a stranger or fabricate a track record between wallets they control. createTrade()
A counterparty that refuses incoming ETH no longer stalls the trade: the swap completes and their payout becomes a credit they withdraw when they can accept it. withdrawOwed()
Every fund-moving path is protected and state transitions complete before value leaves the contract.
The audit covers the contract exactly as deployed — not a draft, not a branch. And it doesn't happen once: every week, an automated audit re-runs the full behavioural suite and re-verifies that the code on-chain still matches the published source, with the results public.
| Area | What the audit checks | Result |
|---|---|---|
| Operator custody | No function exists that lets MuTC withdraw, sweep, pause, upgrade or redirect an open deposit. A vault pays its two parties and no one else. | PASS |
| Atomic settlement | The second confirmed deposit swaps both legs in one transaction; neither side can ever hold both legs. | PASS |
| Reentrancy | Every fund-moving path is guarded, and state advances before value leaves the contract — on execution, cancellation, and timeout. | PASS |
| Exact accounting | Payout plus fee equals the deposit to the wei; a settled vault drains to zero with no dust retained. | PASS |
| Vault isolation | Concurrent trades cannot touch each other’s funds; each vault knows only its own trade. | PASS |
| Access control | Deposits from anyone but the two parties are rejected; double deposits and post-deadline deposits revert. | PASS |
| Reclaim & cancel paths | Timeout reclaim returns the full deposit unconditionally; mutual cancel refunds both sides; a lone consent does nothing and is withdrawable. | PASS |
| Non-standard tokens | Settlement tolerates ERC-20s that return no value from transfers — mainnet USDT included — verified against a misbehaving token in the suite. | PASS |
| Token legs are real tokens | An address holding no code answers every call successfully and moves nothing, which a naive transfer check reads as a completed deposit. Vault construction rejects such legs outright. | PASS |
| Denial of service | An undeliverable ETH payout becomes a withdrawable credit instead of reverting settlement, so no counterparty can hold a trade hostage. | PASS |
| Trade authenticity | Trades open only with venue-signed terms, each authorisation single-use and bound to this chain and factory. Forged, replayed, tampered and malleable signatures are all rejected. | PASS |
| Source ↔ chain integrity | The deployed bytecode is compared byte-for-byte against this source on every audit run — and by you, above, any time. | PASS |
Reproduce with npx hardhat test in the published repository.
loading…