Security
No audit has been published yet. Until one is, this page is the honest description of how the system handles keys and money.
Connected external wallets
Phantom, Solflare, Backpack and other connected wallets keep their private keys inside the wallet extension. Bundly receives the public address and the signed transaction only. It never asks for their seed phrase or private key and cannot move funds from them without a signature you approve.
Managed Dev, sniper and account wallets
Bundly does hold the private keys for the Dev, sniper and account wallets it creates or that you deliberately import into the managed engine. New keys are encrypted at rest with AES-256-GCM, HKDF-SHA-256, a unique random salt and nonce per wallet, and authenticated access controls. Existing encrypted wallets remain compatible. Keys are decrypted only in memory for signing or an explicit owner-authorized export. They are never stored as plaintext or mixed with keys from Phantom, Solflare, Backpack or another connected external wallet.
What custody means
Funds sent to a managed Dev, sniper or account wallet can be signed by Bundly's execution engine for the actions you authorize. Keep only the amount required for the operation there and sweep or export it when finished. Funds that remain in a connected external wallet cannot be moved by Bundly without that wallet approving a signature.
Fees
Bundly takes 0.5% of the SOL a launch or bundle routes. The transfer is part of a transaction you sign yourself, to 8bHtSAC5KmQWzpmy7LP1gEPtmdpyGLdh25FkmWfagxZu, and every payment is listed on the Treasury page and checkable on Solana.
What is proven and what is declared
Mint authority, freeze authority, supply and the launch transaction are read straight from the chain on the Verify page. Rules the venue does not enforce, such as referral splits or launch protection, are marked declared, not proven. Bundly never labels something verified when it is not.
What can still go wrong
Multi-step launches and multi-hop funding are separate transactions. A failure in the middle can leave a half-finished state, which is why every step is recorded, reconciled against the chain hourly and shown to you with a recovery path.
Report a vulnerability
Send the details by direct message to @UseBundly. Please do not exploit an issue against other people's funds, and give us a way to reach you back. Reports that lead to a fix are credited publicly if you want that.