Trust & safety

Wallet actions should be boringly explicit.

DNA DAO is a Solana dApp for community-owned software. The site lets users connect a wallet, launch/link a real token for a collective, buy/sell through known wallet flows, and submit ownership-gated product changes.

Open DNA DAO Security contact
✓
No seed phrases. No private keys.DNA DAO never asks users to paste wallet secrets.
✓
Explicit launch funding transaction.Token launch asks for one visible SOL transfer to the configured launch wallet, then verifies it on-chain.
✓
Products are sandboxed.Collective products are served in CSP-sandboxed iframes with isolated origins.
✓
Ownership gate stays server-side.The browser can display results, but the server verifies signatures, stake, magnitude, moderation, and commit locking.

Wallet actions DNA DAO may request

  • Connect wallet: read public address only.
  • Message signature: bind a wallet to the current session or authorize a proposal.
  • Launch funding transaction: one native SOL transfer shown by the wallet before approval.
  • Buy / sell: external Jupiter routes or wallet-standard Solana transactions, shown before approval.

Wallet actions DNA DAO does not request

  • No seed phrase, private key, recovery phrase, or keystore upload.
  • No hidden wallet-drain transaction or blind unlimited approval flow.
  • No browser local-storage dependency for generated collective products.
  • No custom domain link is treated as live until DNA DAO verifies its response marker.

Generated product isolation

Each collective product is a self-contained HTML document served through /c/:id/raw with a restrictive CSP sandbox. Generated products cannot access DNA DAO cookies or same-origin APIs. User prompts and generated outputs are moderated before public serving.

Launch flow

A pre-launch collective becomes REAL only after a real token mint is linked or launched. For launch, the server creates a transparent payment transaction, the wallet signs/sends it, then DNA DAO verifies the transaction on-chain before starting launch automation.

Review notes for wallet security teams

Canonical domain: https://dnadao.com. Product route: https://dnadao.com/c/pixel. Security contact is published at /.well-known/security.txt. The app source and deployment are intentionally simple: one zero-dependency Node server, one self-contained frontend, and explicit Solana RPC verification for real-token state.

If you see a warning for DNA DAO, please review this page and the transaction contents shown in the wallet. If anything looks unexpected, do not approve the wallet request and report it through the security contact.