RecheckableRaydium
raydium.io · DeFi · Solana · data checked 2026-10-21 07:50 (Stockholm)
Contact route: on-chain security.txt (program) ↗
Not claimed Automated from public data
Produced automatically from public data on 2026-10-21 (method v0.2.7). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.
Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.
Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →
- Onchain: strongest Audits; weakest Legal documents; missing data in Contract control, Legal documents.
Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.
What was checked: addresses & sources
675kPX9MHTjS2zt1qfr1NYHuzeLXfQM9H24wFSUt1Mp8(program) — source: https://docs.raydium.io/reference/program-addressesCPMMoo8L3F4NbTegBCKVNunggL7H1ZpdTHKxQB5qKP1C(program) — source: https://docs.raydium.io/reference/program-addressesCAMMCzo5YL8w4VFF8KVHrK22GGUsp5VTaW7grrKgrWqK(program) — source: https://docs.raydium.io/reference/program-addresses- RAY token mint: not found on an official page → not checked
Website raydium.io · GitHub raydium-io/raydium-cp-swap. Addresses are used only if they appear verbatim on an official project page.
Onchain track
Contract control weight 30 · 1 not read7.5/30
- ◐ Partial
Upgrade authority 675kPX…
Upgrade authority is FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK: Squads v4 multisig tr8rgazU… with threshold 3 of 4 voting member(s) (4 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in authority history tx NUKtKFrd…). Member independence not established. Address taken from official source: https://docs.raydium.io/reference/program-addressesdocs.raydium.io ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-21sha256 2c4e25322f42…sha256 cd0723a6d8c3…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) 675kPX…
OtterSec registry: 5 build submission(s) exist (https://github.com/raydium-io/raydium-amm), but none matches the current on-chain program hash (d4cee0cd4f78…) — one possible reason is an upgrade after the submission. We found no registry record that the deployed code was built from the public source.OtterSec registry ↗OtterSec registry ↗GitHub ↗ checked 2026-10-21sha256 17a6ad913b9a…sha256 93dc19b59d5c…What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority CPMMoo…
Upgrade authority is FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK: Squads v4 multisig tr8rgazU… with threshold 3 of 4 voting member(s) (4 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in authority history tx NUKtKFrd…). Member independence not established. Address taken from official source: https://docs.raydium.io/reference/program-addressesdocs.raydium.io ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-21sha256 997b70199a2f…sha256 fa722e43430c…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) CPMMoo…
OtterSec registry: 3 build submission(s) exist (https://github.com/raydium-io/raydium-cp-swap/tree/cfdb70a8ca9ea62bb5c304d4492ac0fc371ae8ce), but none matches the current on-chain program hash (93cad2458ac7…) — one possible reason is an upgrade after the submission. We found no registry record that the deployed code was built from the public source.OtterSec registry ↗OtterSec registry ↗GitHub ↗ checked 2026-10-21sha256 8f8fd5a4e4fc…sha256 af725713c227…What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority CAMMCz…
Upgrade authority is FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK: Squads v4 multisig tr8rgazU… with threshold 3 of 4 voting member(s) (4 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in authority history tx NUKtKFrd…). Member independence not established. Address taken from official source: https://docs.raydium.io/reference/program-addressesdocs.raydium.io ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-21sha256 0f95a08b2e77…sha256 7c9f20617743…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) CAMMCz…
OtterSec registry: 5 build submission(s) exist (https://github.com/raydium-io/raydium-clmm/tree/119ed36bf9f33), one signed by the current upgrade authority, but none matches the current on-chain program hash (f78e9dbc0800…) — one possible reason is an upgrade after the submission. We found no registry record that the deployed code was built from the public source.OtterSec registry ↗OtterSec registry ↗GitHub ↗ checked 2026-10-21sha256 c88eb029cf49…sha256 d1a49c784b5c…What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ⊘ Not read
Mint/freeze authority (RAY token mint)
Not read: RAY token mint — no official page stating the address could be machine-confirmed, so the address was not used. This is not a finding about the project (method 0.2.4: an unreadable mint is Not read, no points lost, lower coverage). (reason: mint_unconfirmed)source: calculated from the other checks checked 2026-10-21What would show up as met
Nothing for the project to do. Our checker could not read the source this time, so the check is “Not read”: no points are lost. It is tried again at the next run. If you think the data behind it is wrong, send a correction.
Audits weight 1515/15
- ✓ Met
Linked audit
Document reachable; hosted by the project (own GitHub org or domain) and names an auditor (ottersec, halborn, kudelski), but the program ID is not in the page text (PDF text not parsed). Date vs. last upgrade not checked. Quality not assessed. Counted as Met (method 0.2.4): audits by at least 2 distinct firms (halborn, kudelski, madshield, ottersec, sec3) were found at official sources of the project; the program ID is not required in that case. Quality, scope and date still not assessed.
Code openness weight 1515/15
- ✓ Met
Public repository
raydium-io/raydium-cp-swap public, created 2023-12-29, 5 contributor(s) (count only).GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 7b3d93e3660b…sha256 f25573475843… - ✓ Met
Licence
SPDX: Apache-2.0.GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 7b3d93e3660b…sha256 f25573475843… - ✓ Met
Activity last 90 days
Last push 2026-10-20 (1 d ago).GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-21sha256 7b3d93e3660b…sha256 f25573475843… - ✓ Met
On-chain program source public
3/3 own program ID(s) found in public source: CPMMoo… in https://github.com/raydium-io/raydium-cp-swap; 675kPX… in https://github.com/raydium-io/raydium-amm; CAMMCz… in https://github.com/raydium-io/raydium-clmm. Repos searched (shallow clone, text search for the program ID): https://github.com/raydium-io/raydium-cp-swap, https://github.com/raydium-io/raydium-amm, https://github.com/raydium-io/raydium-clmm. Does not prove the deployed binary matches (see the build check).
Onchain history weight 106.7/10
- ✓ Met
Last deploy 675kPX…
Last deploy 2026-09-10 (41 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 2c4e25322f42…sha256 cd0723a6d8c3… - ○ Not built
Program age / upgrade count 675kPX…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 2c4e25322f42…sha256 cd0723a6d8c3… - ◐ Partial
Last deploy CPMMoo…
Last deploy 2026-10-01 (19 d ago). Upgraded within the last 30 days.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 997b70199a2f…sha256 fa722e43430c…What would show up as met
- Nothing to configure: a deploy more than 30 days ago reads as met, a more recent deploy as partial because the code changed recently.
How we check: We read the last deploy time on Solana. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ○ Not built
Program age / upgrade count CPMMoo…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 997b70199a2f…sha256 fa722e43430c… - ◐ Partial
Last deploy CAMMCz…
Last deploy 2026-09-29 (22 d ago). Upgraded within the last 30 days.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 0f95a08b2e77…sha256 7c9f20617743…What would show up as met
- Nothing to configure: a deploy more than 30 days ago reads as met, a more recent deploy as partial because the code changed recently.
How we check: We read the last deploy time on Solana. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ○ Not built
Program age / upgrade count CAMMCz…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-21sha256 0f95a08b2e77…sha256 7c9f20617743…
Team & contact weight 1511.2/15
- ✕ Not met
Security contact (security.txt)
No valid security.txt at /.well-known/security.txt or /security.txt (404).What would show up as met
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
Contact:line, for exampleContact: mailto:security@your-domain. - RFC 9116 also asks for an
Expires:line. We look only forContact:, but addExpires:too so the file stays correct.
How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
- ✓ Met
Bug bounty programme linked
Immunefi bug bounty 'Raydium' (max $505,000) – matched by exact project name.immunefi.com ↗raydium.io ↗raydium.io ↗raydium.io ↗ checked 2026-10-21sha256 38a69267c3fa…sha256 a3fb2e0712fd… - ℹ Status only
Claimed / not claimed
Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.source: calculated from the other checks checked 2026-10-21 - ○ Not built
Team declared (voluntary, with consent)
Team declaration + consent flow not built — excluded.source: calculated from the other checks checked 2026-10-21 - ℹ Status only
Components declared complete by the project
Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.source: calculated from the other checks checked 2026-10-21 - ✓ Met
Program embeds security.txt
3/3 own program(s) embed a solana-security-txt block with contacts (675kPX…, CPMMoo…, CAMMCz…). - ✓ Met
Official program address list
675kPX… published on project domain (https://docs.raydium.io/reference/program-addresses); CPMMoo… published on project domain (https://docs.raydium.io/reference/program-addresses); CAMMCz… published on project domain (https://docs.raydium.io/reference/program-addresses).
Legal documents weight 10 · 1 unknown0/10
- ✕ Not met
Terms & privacy policy present
Terms: not found; privacy: not found (homepage links, sitemap.xml, common paths, headless-Chromium render). Content not assessed.raydium.io ↗raydium.io ↗raydium.io ↗raydium.io ↗ checked 2026-10-21sha256 38a69267c3fa…sha256 a3fb2e0712fd…What would show up as met
- Link both a Terms page and a Privacy Policy page from the homepage, or list them in sitemap.xml.
- We check that the pages exist. We do not read or assess their content.
How we check: We look at homepage links, sitemap.xml and common paths. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ○ Not built
Registered legal entity
Not stated.source: calculated from the other checks checked 2026-10-21 - ? Unknown
Legal entity named in terms
No terms/privacy page found to read.source: calculated from the other checks checked 2026-10-21What would show up as met
- Name the legal entity behind the project in the terms or privacy text, for example “Example Labs Ltd” or “Example Foundation”.
- We do not check a company registry.
How we check: We read the terms and privacy text and look for a company-style name. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Domain weight 54.4/5
- ✓ Met
HTTPS
https://raydium.io answered HTTP 200 over TLS.raydium.io ↗raydium.io ↗raydium.io ↗raydium.io ↗ checked 2026-10-21sha256 38a69267c3fa…sha256 a3fb2e0712fd… - ◐ Partial
Security headers
Present: X-Content-Type-Options. Missing: HSTS, CSP, X-Frame-Options.raydium.io ↗raydium.io ↗raydium.io ↗raydium.io ↗ checked 2026-10-21sha256 38a69267c3fa…sha256 a3fb2e0712fd…What would show up as met
- Send these four response headers on your homepage: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options.
- The check looks only at whether each header is present, not how strict it is.
How we check: We read the headers of one homepage request. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✓ Met
Domain age
Registry date unavailable (rdap.org: HTTP 404; IANA RDAP bootstrap: no RDAP server for .io; whois: FileNotFoundError (port 43 likely blocked)). Domain demonstrably in use since at least 2021-02-10 (~2079 d), source: Wayback Machine first capture – a lower bound on age.web.archive.org ↗raydium.io ↗raydium.io ↗raydium.io ↗ checked 2026-10-21sha256 38a69267c3fa…sha256 a3fb2e0712fd… - ✓ Met
Domain ↔ components consistency
Linked: address 675kPX… published on raydium.io (https://docs.raydium.io/reference/program-addresses); address CPMMoo… published on raydium.io (https://docs.raydium.io/reference/program-addresses); address CAMMCz… published on raydium.io (https://docs.raydium.io/reference/program-addresses); GitHub org name matches domain (weak)source: calculated from the other checks checked 2026-10-21
Snapshot hash of monitored fields: 5765dae50cb6b25b
AI summaries
Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.
Template summary (deterministic)
Onchain track: band C (58/100, coverage 92 %, onchain v0.2.7). Strongest: Audits, Code openness, Domain. Weakest: Contract control, Legal documents. 1 check(s) unknown (each costs 1.5 points); 1 not read (no points lost, lowers coverage); 5 not built yet (excluded).
Grok (xAI)
Placeholder — no API key configured for this model in the PoC.
Claude (Anthropic)
Placeholder — no API key configured for this model in the PoC.
GPT (OpenAI)
Placeholder — no API key configured for this model in the PoC.
Regulatory information
The project has not declared any regulated-activity types, so no rules are listed.
Law firms (free listing, alphabetical, no ranking)
- Delphi — Stockholm, Blockchain law (self-described)
- Gernandt & Danielsson — Stockholm, Fintech (self-described)
- Magnusson — Stockholm, Fintech (self-described)
- Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
- Setterwalls — Stockholm, Fintech (self-described)
- Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)
Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.
Score history
Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.
◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.
◆ 2026-10-21: the scoring method changed from v0.2.6 to v0.2.7. A score change at that point can come from the method and not from the project.
Data table
| Review | Track | Score | Grade | Coverage | Method |
|---|---|---|---|---|---|
| 2026-10-15 | onchain | 58/100 | C | 92 % | v0.2.5 |
| 2026-10-19 | onchain | 58/100 | C | 92 % | v0.2.6 |
| 2026-10-20 | onchain | 58/100 | C | 92 % | v0.2.6 |
| 2026-10-21 | onchain | 58/100 | C | 92 % | v0.2.7 |
Check changes between reviews
- 2026-10-21 · onchain Last deploy 675kPX…: Partial → Met method changed Explorer ↗
- 2026-10-20 · onchain Last deploy 675kPX…: Partial → Met Explorer ↗
- 2026-10-19 · onchain Last deploy 675kPX…: Partial → Met method changed Explorer ↗
History
- 2026-10-21 07:50Re-run (same result; evidence now cited for every negative row): onchain C (58, coverage 92 %)
- 2026-10-20 19:40Forced fresh run (same result; fresh evidence snapshots): onchain C (58, coverage 92 %)
- 2026-10-19 14:19Nightly re-run: onchain C (58, coverage 92 %)
- 2026-10-18 08:10Method 0.2.4: audits by 2+ distinct firms at official sources count as Met; an unreadable token mint is Not read. Re-scored from the stored checks, no new data.
- 2026-10-15 10:16Method 0.2.1: the scope declaration and claim status are status-only (never scored). Re-scored from the stored checks, no new fetch. Before: D 48 (cov 88 %); after: D 49 (cov 92 %).
- 2026-10-15 07:36Initial review (operator-run): onchain D (48, coverage 88 %)
Project's own statements and reply
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).
For project owners: badge
Status: Active. The badge says “no changes since review”, never “safe”.
Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page
Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.