Skip to content

Documentation · 06 / 06

Security considerations

Read-only by construction: no wallet, no signing, no keys in the browser.

  • Read-only. The server exposes eth_call only, rejects any function that is not view or pure, sends no from, no value and no state overrides, and caps gas.
  • No wallet. ENTROPY never connects a wallet, never asks for a signature and never sends a transaction. Generated code encodes calldata but does not sign or send.
  • No keys in the browser. RPC URLs and optional explorer keys are read on the server only. The browser talks to ENTROPY's own /api routes; the content security policy allows no other connections.
  • Untrusted text. Contract names, signatures, revert strings and generated code come from third parties. They are shown as plain text; hidden and bidirectional control characters are made visible as \u{…} with a note.
  • Server-side adapters. Explorer, Sourcify and signature-database calls run on the server with timeouts, bounded concurrency and caching.

Evidence, not proof

A selector or topic match is evidence, not proof. Check verified source before relying on a reconstructed interface.