Why the source is private

The short version

PoolPort LiquiFi's source code is not public. This is a deliberate choice, not an oversight. We recognize that it removes a common way for users to verify what they're running. This page explains why we made the choice, what we're doing to compensate, and what you can still verify yourself.

Why we're not publishing the source

1. The fee and routing logic is the product.

The interesting engineering in PoolPort LiquiFi is not "call a DEX." It's the specific routing decisions across six EVM chains, Solana, and Bitcoin — which swap path to take, when to skip a token, how to handle dust, how fee collection is structured. That logic took real work to get right. Publishing it hands competitors a free blueprint, and there are already a handful of copycat products in this space.

2. Frontend bundles are trivially decompiled.

Even if we wanted to obfuscate only the "secret sauce," our app is a client-side bundle. Anyone can load it, prettify it, and read the minified source in about five minutes. The only way to keep the routing logic proprietary is to keep it out of a public repo entirely.

3. We're a small team, and publishing is a commitment.

Open-sourcing is not just "push to GitHub." It means triaging issues from strangers, reviewing pull requests, responding to security reports, and maintaining a public changelog forever. We'd rather focus that energy on shipping the product and supporting paying users. If we open-source later, we want to do it properly, not performatively.

What this means for you

We are honest about what you lose by not having public source. You lose:

• The ability to read the code yourself before trusting it with a mnemonic
• The ability to fork it and run your own version
• The ability to verify that no hidden behavior was added in a release
• The ability to contribute fixes directly

Those are real losses. If any of them are non-negotiable for you, don't use PoolPort LiquiFi. That's a fair decision, and we respect it.

What you can still verify

1. Nothing leaves your browser.

This is the most important claim, and you don't need source code to check it. Open DevTools → Network. Paste a mnemonic. Run Preview. Run a dry sweep. Watch every network request. No request contains any part of your phrase, any derived private key, or any signed transaction data beyond what's broadcast on-chain.

2. The bundle you're running matches what we published.

Every release publishes a SHA-256 hash at /releases/latest.txt. You can verify the bundle you actually received matches it:

curl -s https://liquifi.poolport.xyz/app.js | openssl dgst -sha256

The output should match the sha256_hex in latest.txt. If it doesn't, something is wrong and you should not use the app.

The HTML also pins a Subresource Integrity (SRI) hash on the <script> tag. This defends against tampering in transit or by a third-party CDN — if an intermediary alters app.js between our server and your browser, the browser refuses to run it. It does not defend against a compromise of our origin server, because an attacker with origin write access could alter the HTML and the JS together. The curl | openssl check above is the authoritative verification, and it only helps if you compare against a hash you obtained independently of our server.

3. Every signature is yours, on your device.

If you're using a hardware wallet (Ledger or Trezor), you see every transaction on the device screen before you approve it. If you're using a mnemonic, you can verify the resulting on-chain transactions on any block explorer afterward. No server has the ability to sign on your behalf, because no server ever sees your keys.

4. The on-chain footprint is public.

Every token approval, every swap, every transfer shows up on the blockchain. If the app ever did something unexpected, it would leave a permanent, public trace. You can check any address you've swept against Etherscan, Solscan, mempool.space, or any other explorer at any time.

What we will never do

Even without source code, we can commit to certain invariants — and these commitments are enforceable in ways that are more meaningful than source review:

• We will never transmit your mnemonic, seed, or private keys. If we did, you would see it in DevTools → Network instantly. This is checkable.
• We will never sign transactions on your behalf. We can't — we don't have the keys. This is architectural.
• We will never take custody of your funds. The only addresses we control are our fee wallets, and their activity is public on-chain.
• We will never add telemetry that includes wallet contents or addresses. Currently Sentry and Plausible are disabled; if enabled, all payloads are scrubbed of addresses, hashes, and mnemonic-shaped strings before transmission.
• We will publish the SHA-256 of every release and pin the SRI hash in the HTML, so users can detect transit and CDN tampering. (The published SHA-256 is what defends against origin tampering, and only if compared against an out-of-band copy.)

If you need source access

For security researchers, enterprise users, or anyone with a specific need to review the code:

We can grant read access to the private repository under a standard mutual NDA. Reach out at info@poolport.xyz with a brief description of who you are and what you need to review. We've granted access to independent researchers before and are happy to do so again.

The honest summary

If our reasoning sounds like "we want to protect our business," that's because it is. We're not claiming security through obscurity makes the app safer — it doesn't. We're claiming that publishing the source would cost us more than it costs our users, given that the app's trust properties can be verified independently without it.

If you disagree with that trade-off, don't use the app. If you want source access for a legitimate reason, ask. We're not trying to be secretive for its own sake.