Hardened by design.

HabitProofX is a decentralized, non-custodial interface. The highest-value control is that this product does not hold user funds, does not request seed phrases, and does not request ERC-20 token approvals. A compromised website still cannot move tokens it was never allowed to spend. You must still protect your wallet and verify every signature.

After testing and completion, HabitProofX smart contracts are deployed immutable: no proxy, no admin key, no upgrade path. That removes rug-style admin risk and also means we cannot patch a live contract in place.

Transport and browser policy. Responses set Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy (camera, microphone, geolocation, payment, USB disabled), Cross-Origin-Opener-Policy (same-origin-allow-popups), and related headers. Framing is restricted to this origin and Grok preview hosts — not the open web.

Outbound allowlist. New-tab links are restricted to an explicit host list. ProveX ramps are built only as https://app.provex.com with sanitized query parameters. Official DEX hosts (Uniswap, PulseX, Aerodrome, Jupiter, Cetus), Robinhood, MetaMask, and Phantom download hosts are on the same allowlist so Dashboard trade and wallet links can open. javascript: and credential-in-URL tricks are rejected.

Chain and token pin. PulseChain chain ID 369 and $PRVX 0xF6f8Db0aBa00007681F8fAF16A0FDa1c9B030b11 are hardcoded. $PRVX balances are queried only when the wallet reports PulseChain. Unknown networks lock write actions until you switch.

Wallet policy. Registry commits and vault claims are 0-value transactions to pinned addresses, after the live chain ID is re-read. When the vault is live, stake may request an ERC-20 approve of the exact stake amount to the pinned vault only — never unlimited, never permit / signTypedData. Approve, stake, unstake, and claim are fail-closed until the vault address is pinned. Value on those txs is hardcoded to 0x0. Calldata is hex-checked.

Untrusted client state. localStorage habits are schema-validated (amount, method, network, dates). Invalid payloads are discarded. Streaks are labeled device-local and are not an input to any payable vault.

Fee display. Fee math in the client is an estimate. The browser is not treated as the collector of protocol fees.

RPC. Reads use a fallback set of PulseChain HTTPS endpoints rather than a single URL. Operators of those endpoints remain independent.

IPFS metadata. Verified source, ABI, and legal hashes are packed as CIDv1 UnixFS and served locally at /ipfs. A public pin of the current pack has been announced; re-pin after every address or ABI change. Durable pinning on a long-lived service remains a production-launch step. User habits are not stored on IPFS. Live CIDs: /ipfs.

Multiple source-code audits of this interface and the unpublished contract drafts are published and dated. Newest first: Security audits. These are independent-methodology repository reviews, not paid named-firm certifications of deployed bytecode.

Latest outcome (HPX-VAULT-2026-08-21): Streak Vault hostile review (later mechanic supersedes the 4-token wad split described in that write-up). Live design: isolated destination-token pools; any ERC-20; fees follow the token being bought; claim pays stablecoin without unstaking; self-attested cycles cannot change the split. Not a named-firm bytecode certification. Full write-up: HPX-VAULT-2026-08-21.

Issues found across the series (cycle spam, fee black hole, wrong-chain commits, immortal multiplier, OAuth on a no-account dApp, DexScreener any-chain price, shared localStorage, stale IPFS) were patched in this build. Full write-ups: /security-audit.

THESE CONTROLS DO NOT MAKE HABITPROOFX, PROVEX, PULSECHAIN, ETHEREUM, $PRVX, OR YOUR WALLET “UNHACKABLE.” Software has bugs. Dependencies can be compromised. Users can be phished. Chains can reorg. Zero-knowledge systems can have implementation flaws. A content-security policy reduces some classes of attack; it does not stop a malicious browser extension, a stolen seed, or a fake ProveX domain you type yourself.

No named-firm (Trail of Bits, OpenZeppelin, etc.) audit of this interface, of ProveX, or of deployed bytecode is claimed. A repository source-code audit is published at /security-audit; that is not a substitute for an independent firm review of deployed contracts. The Streak Vault may go live before an independent firm audit. That is a launch policy, not a safety guarantee. Unaudited immutable contracts cannot be patched in place. Absence of a listed bug bounty is not permission to attack production systems outside a coordinated disclosure.

Smart-contract risk, oracle and RPC lying about state, ProveX counterparty or escrow failure, front-running, key compromise, malware, SIM-swap of accounts you use to sign in, DNS or certificate attacks, supply-chain attacks on JavaScript dependencies, and loss of local reminders if you clear the browser. Public chains are transparent: your address and commitments are visible.

The Streak Vault is not a live yield product until a contract address is pinned. Independent audit is recommended and is not required for launch. Do not treat marketing copy or local streaks as a claim on treasury.

Check that the site is served over HTTPS on the official HabitProofX domain.

ProveX must be app.provex.com — not a look-alike. Our interface will not open other ProveX hosts.

In Phantom or MetaMask, refuse any request that is not a 0-value transaction, any token approval, and any message you do not understand. HabitProofX will not ask you to “import a wallet” or type a seed.

Confirm chain ID 369 for PulseChain $PRVX reads. Confirm the token address above before treating a balance as $PRVX.

If you believe you found a vulnerability in this interface, contact the operators through the official Security page on this origin. Include steps to reproduce. Never send a seed phrase, private key, or wallet password. Do not include exploit code that would harm users in a public post before we have had a reasonable chance to patch. Do not attempt to access other users’ wallets, exfiltrate keys, or disrupt ProveX.

A dedicated security mailbox will be published on this page when the production domain launches. Until then, this page is the disclosure path. RPC operators you query (PulseChain HTTPS endpoints) can see your IP and JSON-RPC methods; they are independent of HabitProofX.

If you already signed a malicious transaction elsewhere, revoke approvals on-chain using a reputable revocation tool, move remaining assets from a new seed generated offline, and treat this interface as unrelated to recovery — we cannot reverse chain history.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HABITPROOFX AND ITS OPERATORS DISCLAIM ALL WARRANTIES THAT THE INTERFACE IS SECURE, ERROR-FREE, OR FIT FOR ANY PARTICULAR PURPOSE. USE IS AT YOUR SOLE RISK. SEE THE TERMS OF USE FOR LIMITATION OF LIABILITY. This Security page does not create a duty of care beyond those Terms, does not waive any defense, and is not an insurance contract or audit report.

Privacy Policy describes data handling. Terms of Use govern access. ProveX’s security model is documented by ProveX, not by us.