Skip to content

Security

Trust starts in the code.

XSOIL's smart contracts are designed to grant only limited permissions, stay non-upgradeable and be verifiable on-chain. The presale contract holds no funds.

Pre-launch checklist

2/4done

  • Independent security auditPending
  • Contract source verification on BscScanPlanned
  • Automated tests (90+ scenarios, 100% line coverage)Available
  • Trial deployment on BSC testnetAvailable

Core principles

The rules are not a promise; they are written into the contract's code. See for yourself the lines that enforce each principle.

XSoilPresale.sol

01 / 06Enforced by the contract

Payments go straight to the treasury

The presale contract holds no funds. Each payment goes to a treasury address that can never be changed, in the same transaction.

The lines that enforce it

XSoilPresale.sol · L386–402
386function buyWithStablecoin(address coin, uint256 maxAmount, address beneficiary, uint256 minTokens, bytes32 tag)387    external388    nonReentrant389    returns (uint256 tokens)390{391    if (!stablecoinEnabled[coin]) revert UnsupportedStablecoin(coin);392    if (maxAmount == 0) revert ZeroAmount();393    address to = beneficiary == address(0) ? msg.sender : beneficiary;394    uint256 scale = _stablecoinScale[coin];395    uint256 usdSpent;396    (tokens, usdSpent) = _purchase(to, maxAmount * scale, minTokens);397 398    uint256 pay = Math.ceilDiv(usdSpent, scale);399    emit Purchased(msg.sender, to, coin, pay, usdSpent, tokens, tag);400 401    IERC20(coin).safeTransferFrom(msg.sender, treasury, pay);402}

Verbatim excerpt from the contract's pre-audit v2 development version. The deployed source will be verified on BscScan.

Permission limits

What can the owner of the presale contract do, and what can never be done?

Can

  • Pause the sale for a limited time: at most 7 days at once and 14 days per stage in total; the stage clock stops while paused
  • Move the start date later (never earlier), before the sale begins
  • Switch a troubled stablecoin off, and back on
  • Start First Claim Activation once the sale is final

These powers are needed to run the sale. On mainnet, ownership sits with the project owner's wallet; pausing and switching a stablecoin off (the guardian role) rest with the same wallet. The owner can also end a pause early, replace the guardian, set the oldest BNB price data it accepts between 1 minute and 1 hour, return tokens other than XSL sent to the contract by mistake, and hand over ownership in two steps. Each action leaves an on-chain event that anyone can see.

Cannot

  • XSoilPresale.sol · L343–349
    343function _stageConfig(uint256 i) internal pure returns (StageConfig memory) {344    if (i == 0) return StageConfig(40_000_000 ether, 1.e15, 1.e15, 375_000, 62_500, 10);345    if (i == 1) return StageConfig(50_000_000 ether, 1.e15, 1.e15, 350_000, 81_250, 8);346    if (i == 2) return StageConfig(60_000_000 ether, 1.e15, 1.e15, 300_000, 100_000, 7);347    if (i == 3) return StageConfig(70_000_000 ether, 1.e15, 1.e15, 280_000, 120_000, 6);348    return StageConfig(90_000_000 ether, 1.e15, 1.e15, 250_000, 150_000, 5);349}

Protect yourself

  1. 01

    Never share your recovery phrase or private key with anyone.

  2. 02

    Only transact on the official website, and check the address bar.

  3. 03

    Check the contract address against the one on this site and in official channels.

  4. 04

    The XSOIL team will never contact you first by direct message.