Security

Understanding Brtr Protocol's security model and best practices for safe trading.

Trust Model

Brtr is designed to be trustless:

• No custody of user funds
• No admin control over trades
• No ability to freeze user assets
• Smart contract enforced settlement

What You Trust

1. Smart Contract Code — Open source, auditable
2. LayerZero Protocol — For cross-chain messaging
3. Blockchain Networks — Underlying consensus

What You Don't Trust

• The Brtr team
• Other traders
• Centralized services

Security Features

Escrow Model

All trades use smart contract escrow:

Seller creates order:
  → Tokens transferred to contract ✓

Buyer fills order:
  → Payment escrowed in contract ✓

Trade completes:
  → Contract releases tokens atomically ✓

No party holds the other's tokens outside the contract.

State Machine Protection

Orders follow a strict state progression:

Open → AwaitingConfirmation → AwaitingFinalization → Completed
  │
  └──→ Cancelled

• Can't skip states
• Can't go backwards
• Can't be manipulated

Cross-Chain Security

3-message protocol ensures atomic cross-chain settlement:

1. FILL_INITIATE — Buyer tokens escrowed, message sent
2. FILL_CONFIRMATION — Seller tokens locked (NOT sent), confirmation returned
3. FILL_FINALIZATION — Both parties receive tokens

Recovery Mechanisms

For edge cases (message failures, network issues):

• 30-minute timeout — Recovery functions only available after delay
• Buyer refund — Can reclaim escrowed tokens if confirmation never arrives
• Admin recovery — Owner can finalize/refund stuck orders after verification

Threat Analysis

Considered Threats

Not Protected Against

• Malicious tokens (e.g., tokens with transfer taxes, blacklists)
• User error (wrong addresses, amounts)
• Network-level attacks on underlying chains

Best Practices for Users

Before Trading

1. Verify contract addresses — Check against official docs
2. Research tokens — Ensure tokens are legitimate
3. Check liquidity — Make sure tokens are transferable

During Trading

1. Start small — Test with small amounts first
2. Verify amounts — Double-check before confirming
3. Monitor gas — Ensure enough ETH for cross-chain

After Trading

1. Verify receipt — Check tokens arrived in wallet
2. Track cross-chain — Monitor progress on LayerZero Scan
3. Keep records — Save transaction hashes

Common Scams to Avoid

Fake Token Scams

Scammers create tokens with similar names:

• Always verify token addresses
• Check on block explorer before trading
• Don't trade unknown tokens

Phishing Sites

Fake websites mimicking Brtr:

• Always verify URL: app.brtr.world
• Bookmark the official site
• Don't click links in DMs

Social Engineering

"Customer support" asking for access:

• Brtr support will never ask for private keys
• Report suspicious accounts

Emergency Procedures

If You Suspect a Problem

1. Don't panic — Most issues are temporary
2. Check status — Is the trade in progress?
3. Wait for timeout — Recovery available after 30 mins
4. Contact support — Join Discord for help

Contract Pause

In extreme circumstances, the contract can be paused:

• Only by owner
• Stops new orders/fills
• Does NOT affect in-progress trades
• Users can still cancel open orders

Reporting Security Issues

Found a vulnerability?

1. DO NOT disclose publicly
2. Email security@brtr.world
3. Include full details and reproduction steps
4. Wait for acknowledgment (24 hours)

See Contract Addresses for current security contact details.