← Directory

Squads

Seal for Squads: onchain band A. Not claimed by the project.
Transparency score · worst track · not a security audit

squads.xyz · Wallets & tools · Solana · data checked 2026-10-20 20:18 (Stockholm)

Contact route: on-chain security.txt (program) ↗

Not claimed Automated from public data

Automated score · 2026-10-20 · method v0.2.6 · How this score is made
Produced automatically from public data on 2026-10-20 (method v0.2.6). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.

Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.

Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →

A
Onchain track · onchain v0.2.6
94/100 · Band A
coverage 100 % · 18 of 18 decided
0 unknown (−0 pts) · 0 not read (no points lost, lowers coverage) · 3 not built yet (excluded)

Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.

What was checked: addresses & sources

Website squads.xyz · GitHub Squads-Protocol/v4. Addresses are used only if they appear verbatim on an official project page.

Onchain track

Contract control weight 3030/30
  • ✓ Met

    Upgrade authority SQDS4e…

    Upgrade authority is revoked: program is immutable. Address taken from official source: https://github.com/Squads-Protocol/v4
    GitHub ↗Explorer ↗Explorer ↗RPC call (getAccountInfo) checked 2026-10-20 sha256 4491d706ff01… sha256 958db4d2b808…
  • ✓ Met

    Build matches source (OtterSec registry) SQDS4e…

    OtterSec registry: a build submission matches the current on-chain program hash (d48660833989…): https://github.com/Squads-Protocol/v4/tree/2a47b4cc76068fb8accec3d5a599e6020c50f796, signer sqdcVVoTcKZjXU8yPUwKFbGx1Hig1rhbWJQtMRXp2E1, last checked by the registry 2025-09-02. The default registry entry shown by /status is a different submission; the match is computed by the registry's rebuild, not by trusting the signer (method 0.2.5).
    OtterSec registry ↗OtterSec registry ↗GitHub ↗ checked 2026-10-20 sha256 fc4e11dad452… sha256 8f781b8cf9ac…
  • – N/A

    Mint/freeze authority

    No token mint submitted.
    source: calculated from the other checks checked 2026-10-20
Audits weight 1515/15
  • ✓ Met

    Linked audit

    Document reachable; hosted by the project (own GitHub org or domain) and names an auditor (ottersec, neodyme), but the program ID is not in the page text (PDF text not parsed). Date vs. last upgrade not checked. Quality not assessed. Counted as Met (method 0.2.4): audits by at least 2 distinct firms (neodyme, ottersec) were found at official sources of the project; the program ID is not required in that case. Quality, scope and date still not assessed.
    GitHub ↗ checked 2026-10-20 sha256 cb173a028df9…
Code openness weight 1515/15
  • ✓ Met

    Public repository

    Squads-Protocol/v4 public, created 2022-11-14, 22 contributor(s) (count only).
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 b15ce94f2100… sha256 34186d42d30c…
  • ✓ Met

    Licence

    SPDX: AGPL-3.0.
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 b15ce94f2100… sha256 34186d42d30c…
  • ✓ Met

    Activity last 90 days

    Last push 2026-10-19 (0 d ago).
    GitHub ↗api.github.com ↗api.github.com ↗ checked 2026-10-20 sha256 b15ce94f2100… sha256 34186d42d30c…
  • ✓ Met

    On-chain program source public

    1/1 own program ID(s) found in public source: SQDS4e… in https://github.com/Squads-Protocol/v4. Repos searched (shallow clone, text search for the program ID): https://github.com/Squads-Protocol/v4. Does not prove the deployed binary matches (see the build check).
    GitHub ↗ checked 2026-10-20 sha256 e0d0bff8cd0d…
Onchain history weight 1010/10
  • ✓ Met

    Last deploy SQDS4e…

    Last deploy 2024-11-20 (699 d ago).
    Explorer ↗RPC call (getAccountInfo)RPC call (getBlockTime)OtterSec registry ↗ checked 2026-10-20 sha256 4491d706ff01… sha256 958db4d2b808…
  • ○ Not built

    Program age / upgrade count SQDS4e…

    Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.
    Explorer ↗RPC call (getAccountInfo)RPC call (getBlockTime)OtterSec registry ↗ checked 2026-10-20 sha256 4491d706ff01… sha256 958db4d2b808…
Team & contact weight 159.4/15
  • ✕ Not met

    Security contact (security.txt)

    No valid security.txt at /.well-known/security.txt or /security.txt (404).
    squads.xyz ↗ checked 2026-10-20 sha256 493fda531200…
    What would show up as met
    • Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a Contact: line, for example Contact: mailto:security@your-domain.
    • RFC 9116 also asks for an Expires: line. We look only for Contact:, but add Expires: too so the file stays correct.

    How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

  • ✓ Met

    Bug bounty programme linked

    Program SQDS4e… embeds security.txt; its policy page (https://github.com/Squads-Protocol/v4/blob/main/SECURITY.md) describes a bug bounty / reward.
    GitHub ↗squads.xyz ↗squads.xyz ↗squads.xyz ↗ checked 2026-10-20 sha256 390984765972… sha256 493fda531200…
  • ℹ Status only

    Claimed / not claimed

    Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.
    source: calculated from the other checks checked 2026-10-20
  • ○ Not built

    Team declared (voluntary, with consent)

    Team declaration + consent flow not built — excluded.
    source: calculated from the other checks checked 2026-10-20
  • ℹ Status only

    Components declared complete by the project

    Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.
    source: calculated from the other checks checked 2026-10-20
  • ✓ Met

    Program embeds security.txt

    1/1 own program(s) embed a solana-security-txt block with contacts (SQDS4e…).
    Explorer ↗RPC call (getAccountInfo) checked 2026-10-20 sha256 efede4a751e3…
  • ◐ Partial

    Official program address list

    SQDS4e… published on project GitHub only (https://github.com/Squads-Protocol/v4).
    GitHub ↗ checked 2026-10-20 sha256 c86d62501fa7…
    What would show up as met
    • List your official program addresses on a page of your own domain (for example a docs page called “Addresses”). A list only on GitHub reads as partial, and one only on a third-party page as not met.

    How we check: We use the pages the project itself publishes. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

Domain weight 54.4/5
  • ✓ Met

    HTTPS

    https://squads.xyz answered HTTP 200 over TLS.
    squads.xyz ↗squads.xyz ↗squads.xyz ↗squads.xyz ↗ checked 2026-10-20 sha256 390984765972… sha256 493fda531200…
  • ◐ Partial

    Security headers

    Present: HSTS, X-Content-Type-Options. Missing: CSP, X-Frame-Options.
    squads.xyz ↗squads.xyz ↗squads.xyz ↗squads.xyz ↗ checked 2026-10-20 sha256 390984765972… sha256 493fda531200…
    What would show up as met
    • Send these four response headers on your homepage: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options.
    • The check looks only at whether each header is present, not how strict it is.

    How we check: We read the headers of one homepage request. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.

  • ✓ Met

    Domain age

    Registered 2025-01-31 (~627 d), source: RDAP (rdap.org). Registrant data ignored.
    RDAP ↗ checked 2026-10-20 sha256 3a95f64d2583…
  • ✓ Met

    Domain ↔ components consistency

    Linked: homepage links to github.com/squads-protocol; GitHub org name matches domain (weak)
    source: calculated from the other checks checked 2026-10-20

Snapshot hash of monitored fields: fbfc93fde6ca268b

AI summaries

Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.

Template summary (deterministic)

Onchain track: band A (94/100, coverage 100 %, onchain v0.2.6). Strongest: Contract control, Audits, Code openness, Onchain history, Legal documents, Domain. Weakest: —. 0 check(s) unknown (each costs 1.5 points); 0 not read (no points lost, lowers coverage); 3 not built yet (excluded).

Grok (xAI)

Placeholder — no API key configured for this model in the PoC.

Claude (Anthropic)

Placeholder — no API key configured for this model in the PoC.

GPT (OpenAI)

Placeholder — no API key configured for this model in the PoC.

Regulatory information

The project has not declared any regulated-activity types, so no rules are listed.

Law firms (free listing, alphabetical, no ranking)

  • Delphi — Stockholm, Blockchain law (self-described)
  • Gernandt & Danielsson — Stockholm, Fintech (self-described)
  • Magnusson — Stockholm, Fintech (self-described)
  • Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
  • Setterwalls — Stockholm, Fintech (self-described)
  • Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)

Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.

Score history

Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.

Score historyTransparency score by published review for Squads. onchain track: 2026-10-15 94/100, 2026-10-18 92/100, 2026-10-18 94/100, 2026-10-19 94/100, 2026-10-20 94/10002550751002026-10-152026-10-20

◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.

Data table
ReviewTrackScoreGradeCoverageMethod
2026-10-15onchain94/100A100 %v0.2.5
2026-10-18onchain92/100A94 %v0.2.5
2026-10-18onchain94/100A100 %v0.2.5
2026-10-19onchain94/100A100 %v0.2.6
2026-10-20onchain94/100A100 %v0.2.6

Check changes between reviews

History

  1. 2026-10-20 20:18
    Forced fresh run (same result; fresh evidence snapshots): onchain A (94, coverage 100 %)
  2. 2026-10-19 14:25
    Forced fresh run (same result; fresh evidence snapshots): onchain A (94, coverage 100 %)
  3. 2026-10-18 12:57
    Nightly re-run: onchain A (94, coverage 100 %)
  4. 2026-10-18 12:49
    Nightly re-run: onchain A (92, coverage 94 %)
  5. 2026-10-18 09:30
    Method 0.2.5: a build that any OtterSec registry entry matches to the current on-chain hash counts as Met. Re-scored from the stored checks plus a read of the public registry.
  6. 2026-10-18 08:10
    Method 0.2.4: audits by 2+ distinct firms at official sources count as Met; an unreadable token mint is Not read. Re-scored from the stored checks, no new data.
  7. 2026-10-15 10:16
    Method 0.2.1: the scope declaration and claim status are status-only (never scored). Re-scored from the stored checks, no new fetch. Before: B 70 (cov 95 %); after: B 71 (cov 100 %).
  8. 2026-10-15 07:19
    Initial review (operator-run): onchain B (70, coverage 95 %)

Project's own statements and reply

No reply published. Claimed projects can add their own statements and a reply next to any check — dispute a check or reply. These statements are shown beside the automated score and never change it.
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).

For project owners: badge

Recheckable: onchain band A, Active

Status: Active. The badge says “no changes since review”, never “safe”.

Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page

Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.