Security
Your wallet, your rules.
MoonDraw is a non-custodial-first raffle arena: you keep your keys, and every request we make is small, specific and readable before you approve it.
Only sign on the verified domain
The only official address is moondraw.app. Preview and staging links (long random subdomains) have no reputation with wallet security scanners, so Phantom and Solflare will show a red “request blocked” warning there. That warning is about the unknown address, not a detected attack — and you should always take it seriously. If you see it, close the popup and reopen the app on moondraw.app.
Bookmark it. If a link claims to be MoonDraw on any other domain, treat it as fake.
A sign-in message
A plain text message proving you control the wallet. It is not a transaction, costs nothing and moves no funds.
An exact USDC transfer
One SPL token transfer for the exact top-up amount you typed, to the published treasury address, plus a memo holding your receipt reference. Amount, mint and destination are set server-side and re-checked on-chain before we credit anything.
What we will never ask for
- We never ask for your seed phrase or private key. Nobody legitimate ever will.
- We never request a token approval, delegate authority, or account-close instruction.
- We never ask you to sign a transaction that drains or transfers your whole balance.
- We never DM you first asking you to connect a wallet or 'verify' it.
Check us, don’t trust us
Every draw seed is committed before entries open and revealed against a finalized Solana blockhash, so anyone can recompute the winners. Every entry receipt and payout has an on-chain signature you can open in an explorer.
Report a security issue
Email security@moondraw.app with steps to reproduce. Please give us a reasonable window to fix an issue before making it public, and never test against other people’s funds or accounts.