RecheckableEllipsis Labs
ellipsislabs.xyz · Other · Solana · data checked 2026-10-21 07:49 (Stockholm)
Contact route: on-chain security.txt (program) ↗
Not claimed Automated from public data
Produced automatically from public data on 2026-10-21 (method v0.2.7). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.
Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.
Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →
- Onchain: strongest Audits; weakest Legal documents; missing data in Legal documents, Domain.
Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.
What was checked: addresses & sources
PhoeNiXZ8ByJGLkxNfZRnkUfjvmuYqLR89jjFHGqdXY(program) — source: https://raw.githubusercontent.com/Ellipsis-Labs/phoenix-cli/HEAD/README.md
Website ellipsislabs.xyz · GitHub https://github.com/Ellipsis-Labs. Addresses are used only if they appear verbatim on an official project page.
Programs taken from the project's own official address list or repository (process v1, docs/program-discovery-process.md); each exists on mainnet as an executable program.
Onchain track
Contract control weight 3022.5/30
- ◐ Partial
Upgrade authority PhoeNi…
Upgrade authority is 8mv7G3fJq5a5ej7E14vgcSGeQKH79emjU9fVfuhyitEq: Squads v3 multisig 6x3BDkL2… with threshold 2 of 3 voting member(s) (3 total) (established by re-deriving the vault address from the multisig; found in upgrade history tx 5CNSvXkm…). Member independence not established. Address taken from official source: https://raw.githubusercontent.com/Ellipsis-Labs/phoenix-cli/HEAD/README.mdraw.githubusercontent.com ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-21sha256 2475b0ff0c8d…sha256 57adcb5acfdd…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✓ Met
Build matches source (OtterSec registry) PhoeNi…
OtterSec registry reports a build from public source that matches the on-chain program (https://github.com/Ellipsis-Labs/phoenix-v1). - – N/A
Mint/freeze authority
No token mint submitted.source: calculated from the other checks checked 2026-10-21
Audits weight 1515/15
- ✓ Met
Audits found at official sources
Discovered automatically (method 0.2.2): 3 document(s) in Ellipsis-Labs/plasma (audits): Accretion, MadShield, OtterSec; 2 document(s) in Ellipsis-Labs/phoenix-v1 (audits): MadShield, OtterSec. Rated partial: found at the project's own GitHub organisation or website and naming Accretion, MadShield, OtterSec, but the program ID was not found in the readable text (PDF text is parsed when possible). Date vs. last upgrade not checked. Quality, scope and findings not assessed. Searched: GitHub Ellipsis-Labs: 28 of 28 non-fork repositories file-listed via GitHub API | ellipsislabs.xyz: 11 audit/security page address(es) fetched (docs sub-domains and homepage audit links included). Counted as Met (method 0.2.4): audits by at least 2 distinct firms (accretion, madshield, ottersec) were found at official sources of the project; the program ID is not required in that case. Quality, scope and date still not assessed.GitHub ↗GitHub ↗api.github.com ↗GitHub ↗ checked 2026-10-21sha256 91368f8205e9…sha256 6530fcf4169b…
Code openness weight 1515/15
- ✓ Met
Public repository
Ellipsis-Labs/phoenix-v1 public, created 2023-02-13, 6 contributor(s) (count only).GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 f94d75b66214…sha256 24d7140b6372… - ✓ Met
Licence
SPDX: MIT.GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 f94d75b66214…sha256 24d7140b6372… - ✓ Met
Activity last 90 days
Last push 2026-10-20 (0 d ago), latest across the Ellipsis-Labs organisation's non-fork repositories.GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 f94d75b66214…sha256 24d7140b6372… - ✓ Met
On-chain program source public
1/1 own program ID(s) found in public source: PhoeNi… in https://github.com/Ellipsis-Labs/phoenix-v1. Repos searched (shallow clone, text search for the program ID): https://github.com/https://github.com/Ellipsis-Labs (clone failed), https://github.com/Ellipsis-Labs/phoenix-v1. Does not prove the deployed binary matches (see the build check).
Onchain history weight 1010/10
- ✓ Met
Last deploy PhoeNi…
Last deploy 2023-11-21 (1064 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 2475b0ff0c8d…sha256 57adcb5acfdd… - ○ Not built
Program age / upgrade count PhoeNi…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 2475b0ff0c8d…sha256 57adcb5acfdd…
Team & contact weight 157.5/15
- ✕ Not met
Security contact (security.txt)
No valid security.txt at /.well-known/security.txt or /security.txt (404).What would show up as met
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
Contact:line, for exampleContact: mailto:security@your-domain. - RFC 9116 also asks for an
Expires:line. We look only forContact:, but addExpires:too so the file stays correct.
How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
- ✓ Met
Bug bounty programme linked
Program PhoeNi… embeds security.txt; its policy page (https://github.com/Ellipsis-Labs/phoenix-v1/blob/master/SECURITY.md) describes a bug bounty / reward.GitHub ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ checked 2026-10-21sha256 fb0426b99735…sha256 62b6eec5bc82… - ℹ Status only
Claimed / not claimed
Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.source: calculated from the other checks checked 2026-10-21 - ○ Not built
Team declared (voluntary, with consent)
Team declaration + consent flow not built — excluded.source: calculated from the other checks checked 2026-10-21 - ℹ Status only
Components declared complete by the project
Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.source: calculated from the other checks checked 2026-10-21 - ✓ Met
Program embeds security.txt
1/1 own program(s) embed a solana-security-txt block with contacts (PhoeNi…). - ✕ Not met
Official program address list
PhoeNi… published on third-party page (https://raw.githubusercontent.com/Ellipsis-Labs/phoenix-cli/HEAD/README.md).What would show up as met
- List your official program addresses on a page of your own domain (for example a docs page called “Addresses”). A list only on GitHub reads as partial, and one only on a third-party page as not met.
How we check: We use the pages the project itself publishes. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Legal documents weight 10 · 1 unknown0/10
- ✕ Not met
Terms & privacy policy present
Terms: not found; privacy: not found (homepage links, sitemap.xml, common paths, headless-Chromium render). Content not assessed.ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ checked 2026-10-21sha256 fb0426b99735…sha256 62b6eec5bc82…What would show up as met
- Link both a Terms page and a Privacy Policy page from the homepage, or list them in sitemap.xml.
- We check that the pages exist. We do not read or assess their content.
How we check: We look at homepage links, sitemap.xml and common paths. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ○ Not built
Registered legal entity
Not stated.source: calculated from the other checks checked 2026-10-21 - ? Unknown
Legal entity named in terms
No terms/privacy page found to read.source: calculated from the other checks checked 2026-10-21What would show up as met
- Name the legal entity behind the project in the terms or privacy text, for example “Example Labs Ltd” or “Example Foundation”.
- We do not check a company registry.
How we check: We read the terms and privacy text and look for a company-style name. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Domain weight 5 · 2 unknown3.8/5
- ✓ Met
HTTPS
https://ellipsislabs.xyz answered HTTP 200 over TLS.ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ checked 2026-10-21sha256 fb0426b99735…sha256 62b6eec5bc82… - ◐ Partial
Security headers
Present: HSTS. Missing: CSP, X-Content-Type-Options, X-Frame-Options.ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ellipsislabs.xyz ↗ checked 2026-10-21sha256 fb0426b99735…sha256 62b6eec5bc82…What would show up as met
- Send these four response headers on your homepage: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options.
- The check looks only at whether each header is present, not how strict it is.
How we check: We read the headers of one homepage request. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ? Unknown
Domain age
Registered 2022-08-31 (~1511 d), source: RDAP (rdap.org). Registrant data ignored. Not credited: the domain is not shown to belong to the submitted components.What would show up as met
- Nothing to configure: a domain registered more than a year ago reads as met, 90 days to a year as partial.
How we check: We read the registration date from the public domain registry (RDAP). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ? Unknown
Domain ↔ components consistency
No link found between the domain and the submitted program/repo/package (homepage, npm metadata, API host).source: calculated from the other checks checked 2026-10-21What would show up as met
- Publish your official program addresses on your own domain and link your GitHub organisation from the website, so the three can be tied together.
How we check: We compare what the project’s own pages say with the on-chain addresses and the GitHub organisation. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Snapshot hash of monitored fields: 98c35632901794a8
AI summaries
Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.
Template summary (deterministic)
Onchain track: band C (69/100, coverage 83 %, onchain v0.2.7). Strongest: Audits, Code openness, Onchain history. Weakest: Legal documents. 3 check(s) unknown (each costs 1.5 points); 0 not read (no points lost, lowers coverage); 3 not built yet (excluded).
Regulatory information
The project has not declared any regulated-activity types, so no rules are listed.
Law firms (free listing, alphabetical, no ranking)
- Delphi — Stockholm, Blockchain law (self-described)
- Gernandt & Danielsson — Stockholm, Fintech (self-described)
- Magnusson — Stockholm, Fintech (self-described)
- Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
- Setterwalls — Stockholm, Fintech (self-described)
- Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)
Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.
Score history
Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.
Solid line: offchain track. Dashed line: onchain track. ◆ = the method changed at that review.
◆ 2026-10-17: the scoring method changed from v0.2.1 to v0.2.5. A score change at that point can come from the method and not from the project.
◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.
◆ 2026-10-21: the scoring method changed from v0.2.6 to v0.2.7. A score change at that point can come from the method and not from the project.
Data table
| Review | Track | Score | Grade | Coverage | Method |
|---|---|---|---|---|---|
| 2026-10-16 | offchain | 62/100 | no grade | 67 % | v0.2.1 |
| 2026-10-16 | onchain | 50/100 | C | 83 % | v0.2.1 |
| 2026-10-17 | onchain | 67/100 | C | 83 % | v0.2.5 |
| 2026-10-19 | onchain | 69/100 | C | 83 % | v0.2.6 |
| 2026-10-20 | onchain | 69/100 | C | 83 % | v0.2.6 |
| 2026-10-21 | onchain | 69/100 | C | 83 % | v0.2.7 |
| 2026-10-21 | onchain | 69/100 | C | 83 % | v0.2.7 |
Check changes between reviews
History
- 2026-10-21 07:49Re-run (same result; evidence now cited for every negative row): onchain C (69, coverage 83 %)
- 2026-10-20 21:40Forced fresh run (same result; fresh evidence snapshots): onchain C (69, coverage 83 %)
- 2026-10-20 12:51Forced fresh run (same result; fresh evidence snapshots): onchain C (69, coverage 83 %)
- 2026-10-19 12:21Nightly re-run: onchain C (69, coverage 83 %)
- 2026-10-18 08:10Method 0.2.4: audits by 2+ distinct firms at official sources count as Met; an unreadable token mint is Not read. Re-scored from the stored checks, no new data.
- 2026-10-17 05:57Nightly re-run: onchain C (60, coverage 83 %)
- 2026-10-16 14:18Nightly re-run: onchain C (50, coverage 83 %)
- 2026-10-16 12:57Initial automatic review (indexed): offchain insufficient data (62, coverage 67 %)
Project's own statements and reply
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).
For project owners: badge
Status: Active. The badge says “no changes since review”, never “safe”.
Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page
Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.