Security model

Hyndle prioritizes user funds, minted ownership, reservation priority, payment records, and namespace uniqueness.

Trust boundaries

• blockchain ownership is authoritative after mint
• frontend input is never trusted for wallet, price, status, eligibility, or normalized identity
• transaction hashes are candidates, not proof
• server-side authorization is bound to a reservation, name, recipient, duration, nonce, and deadline
• smart contracts independently derive price and verify signed fields

Replay protection

Reservation payments and minting use intent or reservation identifiers plus nonces. Successful contract execution consumes the relevant identifiers atomically.

Chain reconciliation

The backend verifies transaction destination, sender, value, calldata, receipt status, decoded events, and confirmation count. Mint event discovery allows the system to find a successful mint even when the browser never submitted its transaction hash.

RPC failures are inconclusive. They must not be converted into transaction rejection, name release, or proof that an event does not exist.

Database integrity

Partial unique indexes serialize active reservation and payment-intent races. Security-sensitive finalization writes reservation, name, authorization, blockchain event, and audit state in one transaction.

Audit status

The contracts have extensive automated tests, including fuzz and invariant tests, but automated tests are not a substitute for an independent security audit. No completed third-party audit is currently published.