Canonical public endpoints
- Production application
- https://dappster.fun
- Marketplace
- https://dappster.fun/explore
- Security contact
- dev@dappster.fun
- Security.txt
- /.well-known/security.txt
- Technical document
- Download the public PDF
Public contracts and operational wallets
| Role | Network | Address |
|---|---|---|
| Membership and credits | Base | 0xea7e37d45b6f75ae6826c1925d7b0ac314c7ecae |
| Owner and deployment fee recipient | EVM | 0x5D69C42A3a481d0CCFd88CFA8a2a08e2BF456134 |
| Owner | Solana | GxPoKNX26GCisuH8Sdr8rtfZY98L5t5eegKtDzSA9P6W |
| Technical deployer | Solana Mainnet | DDrEPN9RtKiLN39VT7wkeu4ZG6Ycgh8mrxhsYDyEPLFo |
| Technical deployer | Solana Devnet | DDrEPN9RtKiLN39VT7wkeu4ZG6Ycgh8mrxhsYDyEPLFo |
The same disclosed technical-deployer address is used on both Solana clusters. Mainnet and Devnet balances, transactions, and program accounts remain separate.
Never trust an address shown only in a social post or direct message. Compare it with this page and inspect the complete transaction in your wallet before signing.
What a legitimate Dappster prompt can do
- Connecting a wallet or signing in does not transfer assets. Dappster never asks for a seed phrase or private key.
- Credit purchases and memberships settle in native Circle USDC on Base and require an explicit transaction approval in the user's wallet.
- EVM deployments are contract-creation transactions signed by the user's wallet. The generated constructor atomically forwards the disclosed 0.001 native-token deployment fee.
- Credit consumption is authorized by the linked user wallet and protected by unique usage identifiers against replay.
- Solana deployment funding is tied to one job by cluster, sender, recipient, amount, signature, and unique memo before the technical wallet can act.
Defense in depth
The connected wallet signs and broadcasts EVM transactions. Dappster does not receive wallet secrets.
Backend checks validate chain, receipt status, destination, amount, emitted events, and deployed address before synchronizing state.
Supabase Row Level Security and linked-wallet ownership checks protect private projects, audits, payments, and deployment jobs.
Unique usage IDs, payment references, deployment job IDs, and Solana funding memos prevent reuse across actions.
Solidity imports are limited to bundled OpenZeppelin sources, while Solana builds run in an isolated environment.
Production responses use HTTPS, HSTS, Content Security Policy, anti-framing controls, and same-origin restrictions.
Report a security issue
Email dev@dappster.fun with the affected URL or component, reproduction steps, observed impact, wallet and transaction identifiers when relevant, and a safe proof of concept. Do not include seed phrases, private keys, passwords, or other secrets.
Please avoid privacy violations, service disruption, social engineering, and accessing data that does not belong to you. We will use the same email thread to acknowledge, investigate, and coordinate remediation.