Security
Your wallet, your rules.
MoonDraw is a non-custodial-first raffle arena: you keep your keys, and every request we make is small, specific and readable before you approve it.
Cloudflare edge protection
moondraw.app is proxied end-to-end — the origin is never exposed directly.
DDoS absorbed at the edge
Volumetric floods are dropped in Cloudflare's network before they ever reach the arena, so live draws keep running under attack.
TLS 1.3 + always-on HTTPS
Every byte between you and MoonDraw is encrypted and the origin is only reachable through the proxy — no plaintext, no bypass.
Edge caching, origin shielded
Static assets and public pages are served from the nearest datacentre. Wallet, ticket and payout calls are never cached.
Bot & abuse filtering
Automated entry farming, credential stuffing and scraping are challenged at the edge, keeping arena odds honest.
Your connection right now
- Proxy
- Direct / unknown
- Edge datacentre
- —
- Region
- —
- Transport
- —
- Verified host
- —
- Ray ID
- —
If this ever says “Direct”, you may not be on the real moondraw.app — stop and check the domain before signing anything.
Only sign on the verified domain
The only official address is moondraw.app. Preview and staging links (long random subdomains) have no reputation with wallet security scanners, so Phantom and Solflare will show a red “request blocked” warning there. That warning is about the unknown address, not a detected attack — and you should always take it seriously. If you see it, close the popup and reopen the app on moondraw.app.
Bookmark it. If a link claims to be MoonDraw on any other domain, treat it as fake.
A sign-in message
A plain text message proving you control the wallet. It is not a transaction, costs nothing and moves no funds.
An exact USDC transfer
One SPL token transfer for the exact top-up amount you typed, to the published treasury address, plus a memo holding your receipt reference. Amount, mint and destination are set server-side and re-checked on-chain before we credit anything.
What we will never ask for
- We never ask for your seed phrase or private key. Nobody legitimate ever will.
- We never request a token approval, delegate authority, or account-close instruction.
- We never ask you to sign a transaction that drains or transfers your whole balance.
- We never DM you first asking you to connect a wallet or 'verify' it.
Check us, don’t trust us
Every draw seed is committed before entries open and revealed against a finalized Solana blockhash, so anyone can recompute the winners. Every entry receipt and payout has an on-chain signature you can open in an explorer.
Report a security issue
Email security@moondraw.app with steps to reproduce. Please give us a reasonable window to fix an issue before making it public, and never test against other people’s funds or accounts.