Tongo (confidential ERC-20 on Starknet)

transfer Assessed on Starknet (starknet:SN_MAIN)tongo.cash

Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: Tongo runs only on Starknet. The docs instances page lists the mainnet v2 Vaults and Tongo ledgers (USDC, STRK, ETH, USDT, WBTC) and the legacy v1 instances. Unit: the v2 canonical ledgers and their Vaults, class hashes 0x072c…471e (Tongo) and 0x044d…121f (Vault), which match onchain at Starknet block 16117583. Excluded: v1 instances, the Sepolia deployments, tongo-evm (a separate repo with no mainnet deployment listed), and the optional Relayer. Starknet addresses do not fit the schema's address format, so `contracts` is empty and onchain reads are recorded in findings and the research log.

At a glance

Category: Protocols for privacy-preserving transfers
Chain: Starknet
CROPS tally: 17 of 23 hold up · 1 no evidence
Security audits: 1 published
Offered: Everywhere
Last edited: 2026-10-13 · History

Censorship Resistance1 WeakWeakest: Token and chain freeze risks disclosed
Open No evidenceWeakest: Contracts verified onchain
Free2 PartialWeakest: Protection against relicensing; No proprietary dependencies
Privacy1 WeakWeakest: Payments linkable onchain
Security1 WeakWeakest: Audits and bug bounty

Where it is offered

Offered everywhere, per the provider's code or documents. Checked 2026-10-09. Not scored.

The ledger and Vault contracts have no address or country check, and the SDK has no geolocation or country gate. tongo.cash links no terms page, and we found no first-party document listing countries. Judgment call: the closed demo frontend at demo.tongo.cash was not inspected and might geoblock; the SDK path does not depend on it.

Evidence (1)1 verified

Verified
fund, withdraw and ragequit check proofs, nonces and balances only; no caller, address or country restriction.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Censorship Resistance

Who can block valid use, and can users route around them?

1 WeakPillar rating: weakest of 5
4 of 5 Partial or better

What would raise this pillar

Token and chain freeze risks disclosed reaching Partial: Enumerated in code, assumptions not stated.

Admin pause or freeze powers

Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The settlement contracts have no pause, freeze, blacklist or upgrade path. At Starknet block 16117583, get_tongo_config on the USDC, STRK and ETH v2 ledgers returned owner 0x3bb4…a4e7 and no auditor (Option::None). The owner can therefore only allow or refuse external transfers from other ledgers, which ordinary transfers within a ledger do not use. The docs' phrase "full control of the contract" overstates what the code allows. Judgment call: the substance fits 3, but 3 needs onchain evidence, and the schema cannot hold Starknet addresses, so 2.

Evidence (2)1 verified · 1 documented

Verified
The ledger owner's only powers are change_auditor_key (rejected if the instance has no auditor) and approveTongo/revokeTongo, which gate receive_external_transfer from other ledgers. There is no pause, freeze, blacklist or replace_class in Tongo.cairo or Vault.cairo, and the Vault has no owner.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The docs describe the owner's control in broad terms; the code limits it to auditor rotation and external-transfer approval.
docs.tongo.cash/protocol/vault.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Settle without the provider

Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

A payer funds a Tongo account and transfers to the payee's public key, and the payee rolls over and withdraws. Every step is a direct contract call with a proof built client-side by the public SDK. A Starknet account pays the gas, and no provider signature or relayer is involved. The Relayer is an optional alternative for users without a Starknet account. Addresses and ABIs are documented. Judgment call: the substance fits 3, but 3 needs onchain evidence that the schema cannot express for Starknet, so 2.

Evidence (2)1 verified · 1 documented

Verified
fund, transfer, withdraw and ragequit are external and authorised only by the zero-knowledge proof for the Tongo key; withdraw sends ERC-20 to any Starknet address named in the proof, and any caller may submit.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Addresses and class hashes are listed in the docs; the ABIs ship in the SDK (packages/tongo-sdk/src/abi).
docs.tongo.cash/protocol/contracts.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Reliance on hosted services

Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

No relayer, paymaster, indexer or API is required. Proofs are made client-side, state comes from the RPC, and the user can pay gas from their own Starknet account. The optional Relayer path depends on AVNU's paymaster and on the Relayer owner's whitelists.

Evidence (2)1 verified · 1 documented

Verified
The SDK reads account history from Starknet events through the RpcProvider the integrator supplies; the SDK source contains no hardcoded service URL.
fatlabsxyz/tongo · packages/tongo-sdk/src/account/account.data.service.ts
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The Relayer and the AVNU paymaster behind it serve only users without a funded Starknet account.
docs.tongo.cash/protocol/relayer.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Neutral settlement, disclosed filtering

Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The contracts and SDK contain no filtering. The demo frontend is closed and was not inspected. The Relayer's whitelists cover ledgers, assets and forwarders, not users. Judgment call: 3 needs a package or trace, and the Starknet sequencer is a further point of filtering outside this code, so 2.

Evidence (1)1 verified

Verified
Settlement checks only proofs, nonces and balances; there is no address or country check. A grep of the SDK source for country, geolocation, sanction and chainalysis finds nothing.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Token and chain freeze risks disclosed

Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5

1 Weak

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Tokens are enumerated in the docs, and onchain through each Vault's get_vault_config, which we read but cannot cite as onchain evidence here. No document tells users that Circle can freeze native USDC held by a Vault. Nor does any document state that Starknet's single StarkWare sequencer can censor transactions. Scored 1: enumerated in docs only.

Evidence (1)1 documented

Documented
The docs enumerate the wrapped ERC-20s (native USDC, STRK, ETH, USDT, WBTC) with their Vault and ledger addresses; the SDK has no token list.
docs.tongo.cash/protocol/contracts.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Open

Is the whole stack visible?

No evidencePillar rating: weakest of 4
1 of 4 Partial or better · 1 no evidence

What would raise this pillar

Contracts verified onchain reaching Weak: Some contracts verified.

Contracts verified onchain

Does the deployed bytecode match public source, and can a third party rebuild it? O1

No evidence

Sets the pillar rating

UnreviewedAssessed by AI research agent (seed), 2026-10-09

No checkable evidence settles this yet, so it counts as 0.

The onchain class hashes match the docs (Tongo 0x072c…471e, Vault 0x044d…121f), but we could not show that the source compiles to them. Voyager returned 403 and was not bypassed, Starkscan renders client-side, and Starknet has no Sourcify. No rebuild was attempted.

Whole stack published

Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2

1 Weak

Best evidence: VerifiedChecked 2026-10-09 10 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Contracts and the SDK are public, and no backend or indexer is needed. The demo frontend at demo.tongo.cash has no public source. Judgment call: anchor 2 means everything but the backend, which here would include the frontend, so 1.

Evidence (1)1 verified

Verified
The tongo monorepo holds the Cairo contracts (ledger, vault, relayer) and the TypeScript SDK; the SHE proof library is a separate public repo. No frontend repository is public.
fatlabsxyz/tongo · packages
commit 7dac05e823 · checked 2026-10-09

Can be self-hosted

Can a stranger reach a working deployment from the README? O3

1 Weak

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Docs exist for using the SDK and deploying ledgers. Reproduction not attempted, so capped at 1.

Evidence (1)1 verified

Verified
The SDK README covers provider and account setup and operations; deployment parameters are in the docs (Vault deploy_tongo).
fatlabsxyz/tongo · packages/tongo-sdk/README.md
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Interfaces and data export

Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

ABIs and event schemas are in the repo. No protocol API exists or is needed. There is no export function; account history is rebuilt from events by the SDK. Judgment call: 2, as for other API-free protocols.

Evidence (1)1 verified

Verified
Event structs (Fund, Withdraw, Transfer and others) are defined in the repo, and generated ABIs for Tongo, Vault and Aux ship in packages/tongo-sdk/src/abi.
fatlabsxyz/tongo · packages/contracts/src/structs/events.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Free

Does the license actually let a third party fork, modify, and run it?

2 PartialPillar rating: weakest of 3
3 of 3 Partial or better

What would raise this pillar

Protection against relicensing reaching Strong: No CLA, or a CLA that does not permit unilateral relicensing, plus a written license-stability commitment in the repo.
No proprietary dependencies reaching Strong: A production deployment needs no proprietary plugin or hosted-only service.

Open-source licences

Does every repository needed to run the product carry an OSI-approved license? F1

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Both repositories needed to run the protocol carry Apache-2.0. The cairo-abi-codec GitHub repo has no LICENSE file, but its npm package declares ISC; we did not list it as a repo. The docs repo is unlicensed but not needed to run.

Evidence (1)1 verified

Verified
tongo (contracts and SDK) is Apache-2.0; she is Apache-2.0 (GitHub licence API); the SDK's npm dependencies @fatsolutions/she and @fatsolutions/cairo-abi-codec declare Apache-2.0 and ISC.
fatlabsxyz/tongo · LICENSE
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Protection against relicensing

Can the provider unilaterally relicense future versions, and has it committed not to? F2

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

No CLA and no relicensing event; no written licence-stability commitment.

Evidence (1)1 verified

Verified
LICENSE has two commits, 3e57e0c8 (2025-09-18, "Add LICENSE", Apache 2.0) and 439e07e2 (2026-01-27, a one-line edit, still Apache 2.0); the repo has no CONTRIBUTING or CLA file.
fatlabsxyz/tongo · LICENSE
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

No proprietary dependencies

Does a production deployment need a proprietary plugin or hosted-only service? F3

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Production use needs only the public contracts, SDK and a Starknet RPC. The AVNU paymaster matters only on the optional Relayer path. Judgment call: no O3 reproduction, so 2.

Evidence (1)1 verified

Verified
The SDK depends on open packages (starknet.js, @scure, @noble, @fatsolutions/she, cairo-abi-codec); no API key or hosted service is configured.
fatlabsxyz/tongo · packages/tongo-sdk/package.json
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Privacy

What can an observer learn, and did the user knowingly choose it?

1 WeakPillar rating: weakest of 5
4 of 5 Partial or better

What would raise this pillar

Payments linkable onchain reaching Partial: Minimal linkage, documented.

Tracking and analytics

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The SDK ships no telemetry. The demo frontend is closed and was not inspected, and no trace was run. Judgment call: absence shown only in code is capped at 2.

Evidence (1)1 verified

Verified
No analytics, telemetry, error-reporting or fingerprinting dependency in the SDK.
fatlabsxyz/tongo · packages/tongo-sdk/package.json
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Data collected beyond payment

Does the flow collect anything beyond addresses, amounts, token, and chain? P2

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The protocol collects nothing beyond keys, amounts and addresses, and no required component holds user data. The canonical v2 ledgers were deployed without an auditor (get_tongo_config returned Option::None at block 16117583), so no third party receives decryptable copies of balances. Per the docs, an auditor cannot be added later. Instances deployed with an auditor would score lower.

Evidence (1)1 verified

Verified
Operations take a public key, amounts (public for fund and withdraw, encrypted for transfer), a destination address, proofs and hints; audit ciphertexts are required only when the instance has an auditor key.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Payments linkable onchain

What do calldata and events reveal about who paid whom for what? P3

1 Weak

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Tongo hides transfer amounts but not who paid whom. Every transfer publishes the payer's and payee's Tongo public keys. Funding ties a Starknet address to a key, and withdrawal ties a key to a Starknet address, both with plaintext amounts. Users can make fresh keys, but each must be funded. Judgment call: payer-payee linkage is public by design and implied rather than stated in the docs, which stress hidden amounts. Between 1 and 0 we take 1, because the event schema is public in the repo.

Evidence (1)1 verified

Verified
TransferEvent emits the sender and receiver public keys as event keys with only encrypted amounts; FundEvent links the funding Starknet address to the Tongo key with a plaintext amount; WithdrawEvent links the key to the destination address with a plaintext amount.
fatlabsxyz/tongo · packages/contracts/src/structs/events.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Third parties in the payment flow

Which third parties see a request during a payment, and can they be swapped out? P4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

On the direct path only the chosen RPC sees requests. The optional relayed path adds the AVNU paymaster, which is named and set by the caller. Judgment call: 3 would need a package or trace, and the demo frontend was not inspected, so 2.

Evidence (1)1 verified

Verified
The integrator passes its own RpcProvider ("YOUR_RPC_PROVIDER"); the relayed path takes a paymaster URL as a parameter (RelayerAccount).
fatlabsxyz/tongo · packages/tongo-sdk/README.md
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Endpoints can be changed

Can RPC and indexer URLs be changed, and is the indexer code public? P5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The RPC is configurable in the SDK, and there is no indexer to host. The only official UI (the demo) is closed, so we could not check whether a UI setting exists. Scored 2: configurable via code.

Evidence (1)1 verified

Verified
The RPC is a constructor argument in the SDK; no indexer is used.
fatlabsxyz/tongo · packages/tongo-sdk/README.md
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Security

Who can cause loss, lock users in, or change the rules?

1 WeakPillar rating: weakest of 6
5 of 6 Partial or better

What would raise this pillar

Audits and bug bounty reaching Partial: Audit pinned to a commit, resolutions not individually linked.

Who holds funds in transit

Who holds funds between payer and payee, and can the provider redirect them? S1

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Funds sit in a non-upgradeable Vault, released only against the key holder's proof. The provider cannot redirect them. Judgment call: the substance fits 3, but 3 needs onchain evidence that the schema cannot express for Starknet, so 2. The class hashes we read match the docs. Native USDC inherits Circle's freeze power over the Vault address (C5).

Evidence (1)1 verified

Verified
The Vault releases ERC-20 only to Tongo ledgers it deployed, and ledgers release only on a valid withdraw or ragequit proof by the key holder; neither contract has an owner path to move funds or replace its class.
fatlabsxyz/tongo · packages/contracts/src/tongo/Vault.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Who can upgrade the code

Who can change the contract code, and with how much notice? S2

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The ledger and Vault classes are non-upgradeable. The docs' class hashes match getClassHashAt for the v2 instances at block 16117583, but we could not verify that this source compiles to them (O1). Judgment call: the substance fits 3, but without onchain evidence in the schema and without class verification, 2.

Evidence (1)1 verified

Verified
Neither Tongo.cairo nor Vault.cairo calls replace_class or has an upgrade entrypoint; on Starknet a contract can change code only through replace_class in its own code.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Token approval scope

How large an allowance does the SDK ask users to grant, and for how long? S3

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The SDK asks for exact-amount approvals, and transfers need none. The ledger's own MAX approval to its Vault is contract-to-contract. Judgment call: the code fits 3, but 3 needs a distributed package or trace, so 2.

Evidence (1)1 verified

Verified
populateApprove() approves the ledger for exactly amount x rate of the ERC-20 being funded.
fatlabsxyz/tongo · packages/tongo-sdk/src/operations/fund.ts
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Funds safe if provider disappears Derived

If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Derived from S1=2, C2=2, C3=3 and O3=1. If Fat Solutions disappears, the non-upgradeable Vault and ledgers keep working. The key holder can withdraw or ragequit, and can keep transferring, with the public SDK and any RPC. S1 and C2 are capped at 2 only by the onchain evidence format, and no public frontend build exists. Scored 2: funds are retrievable through a verified direct path.

Evidence (1)1 verified

Verified
withdraw and ragequit are callable by anyone with the key holder's proof and send ERC-20 to the address named in the proof.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Secrets and webhook handling

Are secrets kept out of client bundles and are webhooks signed and verified? S5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Users' secrets are their Tongo keys, generated and used client-side. Relayed operations are signed with the Tongo key. The repo commits devnet-only test keys in packages/tongo-sdk/.env, a hygiene issue rather than a production secret. Judgment call: 2 (minor issues).

Evidence (1)1 verified

Verified
A committed .env holds a local devnet RPC (127.0.0.1:5050), devnet test keys and a devnet account; the SDK otherwise keeps the Tongo private key client-side and has no API keys or webhooks.
fatlabsxyz/tongo · packages/tongo-sdk/.env
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Audits and bug bounty

Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6

1 Weak

Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

One audit, from October 2025, predates the v2 Vault, ledger and Relayer architecture now deployed. We found no audited commit hash in the report text and did not trace fixes. No bug bounty or SECURITY file. Scored 1: audit report only.

Evidence (1)1 documented

Documented
The zkSecurity report covers the SHE library and the Tongo contracts and provers, with findings such as a weak Fiat-Shamir transform in the bit proof; it is also committed at audits/Audit_of_Tongo.pdf.
reports.zksecurity.xyz/reports/tongo
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Security audits 1

Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.

Date	Auditor	Type	Scope	Covers deployed code	Findings
2025-10	zkSecurity	Audit	SHE homomorphic encryption library (Cairo verifiers and TypeScript sigma-protocol provers) and the Tongo Cairo contracts and SDK provers Engagement began 2025-10-13 for two weeks on private repositories; the report gives no audited commit. The same report is committed at audits/Audit_of_Tongo.pdf in both repos. It predates the v2 Vault and ledger architecture deployed on Starknet.	Partly	2 high, 2 medium, 5 low, 2 informational

Compiled from: The audits/ folders and READMEs of github.com/fatlabsxyz/tongo and fatlabsxyz/she, the docs at docs.tongo.cash, and zkSecurity's public report index (reports.zksecurity.xyz). Both READMEs name only the zkSecurity audit. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.

Operational and procurement

Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.

Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 7 evidenced, 0 attested, 6 absent, 30 not applicable, 2 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.

Group A: operational facts

Fees

Evidenced

Component	Paid by	Amount	Basis
network	payer	Starknet v3 fee in STRK; sample 1.456 STRK for a Tongo transfer (42.4M L2 gas, 1,696 L1 data gas)	Starknet fee formula over L2 gas, L1 gas and L1 data gas at the block's prices plus an optional tip, paid by the submitting Starknet account; all fees go to the sequencer (StarkWare). Set by Starknet, not by Tongo.
provider	payer	Optional relayer fee (fee_to_sender), set per operation by the user; 0 when the user submits directly	Only on the gasless Relayer path. Tongo.cairo pays fee_to_sender from the sender's encrypted balance to the caller in ERC-20 at the Vault rate; the Relayer executes only when fees cover its gas plus a configurable margin.

No protocol fee and no fee to Fat Solutions on the direct path. Funding a Tongo account is an ordinary ERC-20 approve and call, paying the same Starknet fee. Fees are high relative to the amounts moved so far (the v2 USDC Vault held 7.78 USDC at the seed read).

Verified
starknet_getTransactionReceipt for 0x1c865f68…3949 (a TransferEvent on the v2 USDC ledger 0x00b3…d4d3, Starknet block 12,474,497, 2026-07-29 21:13:42 UTC) returns actual_fee 0x1433e87959c49180 FRI (1.456 STRK). Other transfers on that ledger paid 1.33 to 1.46 STRK, withdrawals 0.70 to 1.04 STRK. Read through a public Starknet JSON-RPC endpoint; any node returns the same receipt.
starknet-rpc.publicnode.com
block 12474497 · checked 2026-10-09
Verified
With relayData set, withdraw moves fee_to_sender from the Vault to get_caller_address() and subtracts it from the sender's encrypted balance; transfer and ragequit do the same (L309-L314, L372-L377). There is no other fee in Tongo.cairo or Vault.cairo.
fatlabsxyz/tongo · packages/contracts/src/tongo/Tongo.cairo
commit 7dac05e823 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Starknet fee units (L2 gas, L1 gas, L1 data gas), v3 STRK-denominated limits and tip, and the recipient of fees.
docs.starknet.io/learn/protocol/fees
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
Relayer architecture page; the Relayer uses the AVNU paymaster, pays gas and is reimbursed from the operation's fee.
docs.tongo.cash/protocol/relayer.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Custody model

Evidenced

Self-custody

Agrees with the S1 finding (anchor 3 in substance, capped at 2 for want of schema-compatible onchain evidence). The ERC-20 reserve sits in an ownerless, non-upgradeable Vault released only against the key holder's proof; the ledger owner cannot move funds. Native USDC keeps Circle's freeze power over the Vault address.

Evidence shared with CROPS: S1 item 1

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Licences and registrations

Absent

Judgment call: absent rather than not_applicable, because Fat Solutions holds the ledger owner key (external-transfer approvals) and the Relayer owner role and runs the demo frontend, although it never holds users' funds. Searched: tongo.cash, fatsolutions.xyz, docs.tongo.cash (introduction, vault, relayer, auditor, contracts) and the repository README. No legal name or jurisdiction is disclosed, so no regulator register could be searched.

Documented
The developer presents itself as a research and development team; the site names no legal entity, licence or regulator.
fatsolutions.xyz
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The product site links to the demo, docs, GitHub and npm and has no terms, privacy or legal page.
www.tongo.cash
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Cash-out options

N/A: falls to the institution

No fiat leg. The payee withdraws the wrapped ERC-20 (USDC, USDT, STRK, ETH, WBTC) to a Starknet address; converting it to local currency is outside the protocol.

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

First deployment

Evidenced

2026-07-13 (block 11811046): v2 USDC Tongo ledger 0x00b3…d4d3 (its Vault 0x4cf9…b27f at block 11,810,608 the same day). The first v1 instance (0x6d82…0e27) dates from block 3,587,879 on 2025-11-14.

Judgment call. The assessed unit is the v2 ledgers, so the v2 USDC ledger is recorded; v1 instances (separate contracts, still holding funds) are about eight months older. Voyager returned 403 and Starkscan renders client-side, so the timestamps come from a public Starknet JSON-RPC node rather than an explorer API.

Verified
Binary search with starknet_getClassHashAt finds the v2 USDC ledger first present at Starknet block 11,811,046 (class 0x072c…471e) and its Vault at 11,810,608 (class 0x044d…121f); starknet_getBlockWithTxHashes gives timestamps 1783970097 (2026-07-13T19:14:57Z) and 1783969165. The Relayer appears at 11,811,680. The earliest v1 instance appears at 3,587,879 (1763155393, 2025-11-14T21:23:13Z), class 0x0058…672a.
starknet-rpc.publicnode.com
block 11811046 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Operating entity

Absent

Maintainer is Fat Solutions (GitHub organisation fatlabsxyz, npm scope @fatsolutions); no legal entity is disclosed on tongo.cash, fatsolutions.xyz, the docs, the GitHub organisation profile (empty) or the npm package. Recorded as absent (undisclosed), not as proof that no company exists.

Documented
The developer's site carries only a trade name and a contact address; no legal form, jurisdiction or register number.
fatsolutions.xyz
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Documented
The audit report names the client by trade name only.
reports.zksecurity.xyz/reports/tongo
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Security incidents

Evidenced

Absence of a found incident is not evidence that none occurred.

Empty list with the search recorded. Audit findings fixed before release are not incidents. No post-mortem or disclosure page exists to search.

Verified
No published security advisories in fatlabsxyz/tongo (empty list on 2026-10-09); fatlabsxyz/she has none either. Release notes mention fixes for the October 2025 zkSecurity audit (sdk-v1.3.0, PR 122) but no incident.
api.github.com/repos/fatlabsxyz/tongo/security-advisories
checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Product changes affecting users

Evidenced

2025-11-14: v1 Tongo instances deployed on Starknet mainnet (class 0x0058…672a), each ledger holding its own ERC-20. source
2026-07-13: v2.0.0 released and deployed - Vaults hold reserves and deploy ledgers, external transfers between ledgers, optional Relayer with the AVNU paymaster. v1 instances remain live and are listed as legacy. source

Contracts are not upgradeable, so every change is a new deployment; users move funds themselves.

Verified
Release v2.0.0 published 2026-07-13 (52 pull requests since v0.0.2, including vault, relayer and external transfers); deployment dates are from Starknet state (see first_deployment).
api.github.com/repos/fatlabsxyz/tongo/releases
checked 2026-10-09
Documented
Vault Architecture (v2) page describing the split into Vaults and ledgers.
docs.tongo.cash/protocol/vault.html
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Volume transacted (verified only)

Not observable

Transfer amounts are ElGamal-encrypted. Fund, Withdraw and Ragequit events do carry plaintext amounts, so entry and exit are public, but they are Starknet events, the volume script reads EVM logs only, and this row lists no contracts because Starknet addresses do not fit the schema.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Group B: institutional due diligence

Control	State	What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?	N/A: falls to the institution implied from the component list
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?	N/A: falls to the institution implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?	N/A: falls to the institution implied from the component list
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?	N/A: falls to the institution implied from the component list
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?	N/A: falls to the institution implied from the component list
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?	N/A: falls to the institution implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?	Absent	none of 2 repo(s): fatlabsxyz/tongo ✗ no security policy file; fatlabsxyz/she ✗ no security policy file source 1 · source 2
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?	N/A: falls to the institution implied from the component list
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?	Absent	none of 2 repo(s): fatlabsxyz/tongo ✗ no scanning config or workflow step found; fatlabsxyz/she ✗ no scanning config or workflow step found source 1 · source 2
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?	N/A: falls to the institution implied from the component list
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?	N/A: no such service implied from the component list
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?	N/A: no such service implied from the component list
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?	N/A: falls to the institution implied from the component list
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?	N/A: no such service implied from the component list
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?	N/A: falls to the institution implied from the component list
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?	N/A: falls to the institution implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?	N/A: falls to the institution implied from the component list
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?	N/A: no such service implied from the component list
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?	N/A: falls to the institution implied from the component list
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?	N/A: falls to the institution implied from the component list
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?	N/A: falls to the institution implied from the component list
B5.4 Export controls If an API exports data, does it limit volumes and log exports?	N/A: falls to the institution implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?	N/A: falls to the institution implied from the component list
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?	N/A: falls to the institution implied from the component list
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?	N/A: falls to the institution implied from the component list
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?	N/A: falls to the institution implied from the component list
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?	N/A: falls to the institution implied from the component list
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?	N/A: falls to the institution implied from the component list
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?	N/A: falls to the institution implied from the component list
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?	N/A: falls to the institution implied from the component list
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?	Absent	none of 2 repo(s): fatlabsxyz/tongo ✗ no deployment configuration; fatlabsxyz/she ✗ no deployment configuration source 1 · source 2
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?	Evidenced	some of 2 repo(s): fatlabsxyz/tongo ✓ rules: deletion, non_fast_forward, creation, required_linear_history, required_signatures, pull_request; fatlabsxyz/she ✗ no branch rules visible (classic branch protection is not readable without push access) source 1 · source 2
B9.2 CI runs on pull requests Does every pull request trigger automated checks?	Evidenced	some of 2 repo(s): fatlabsxyz/tongo ✓ 3 workflow file(s); fatlabsxyz/she ✗ 1 workflow file(s) source 1 · source 2
B9.3 Tests run in CI Do the CI workflows run the test suite?	Evidenced	all of 2 repo(s): fatlabsxyz/tongo ✓ test command in a workflow; fatlabsxyz/she ✓ test command in a workflow source 1 · source 2
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?	Absent	none of 2 repo(s): fatlabsxyz/tongo ✗ coverage tooling referenced; fatlabsxyz/she ✗ coverage tooling referenced source 1 · source 2
B9.5 Versioned releases Are releases tagged with immutable semantic versions?	Evidenced	some of 2 repo(s): fatlabsxyz/tongo ✓ latest tags: v2.0.0, v0.0.2, v0.0.1; fatlabsxyz/she ✗ latest tags: ts-v0.4.0, ts-v0.1.1, ts-v0.1.0 source 1 · source 2
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?	Evidenced	all of 2 repo(s): fatlabsxyz/tongo ✓ 10 of 10 recent commits signed; fatlabsxyz/she ✓ 10 of 10 recent commits signed source 1 · source 2
B9.7 Changelog Is a changelog maintained with the code?	Evidenced	all of 2 repo(s): fatlabsxyz/tongo ✓ 5 release(s) with notes; fatlabsxyz/she ✓ 1 release(s) with notes source 1 · source 2
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?	Absent	none of 2 repo(s): fatlabsxyz/tongo ✗ none found; fatlabsxyz/she ✗ none found source 1 · source 2
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?	Evidenced	Logical and integration views. The docs cover the encryption system, storage, the v2 Vault and ledger split, the Relayer (with the AVNU paymaster), auditing, the contract ABI and the SDK; the SHE section documents each proof protocol. No infrastructure view, as no operator-run infrastructure is required. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?	N/A: falls to the institution implied from the component list
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?	Unknown implied from the component list
B11.3 Termination terms What happens to customer funds and data on termination by either side?	N/A: falls to the institution implied from the component list
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?	Absent	Settlement checks only proofs, nonces and balances; the seed grep of the SDK for country, geolocation, sanction and chainalysis found nothing. The optional auditor key is a human-held decryption key, not an automated screen, and no canonical instance has one. CROPS C4
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?	Unknown implied from the component list

Scope of assessment

Components in the payment path

Component	Role	Public	Licence	Operator	Required
Tongo ledger contracts (v2 canonical instances)	contracts	Yes	Apache-2.0	Owner 0x3bb4…a4e7 (external-transfer approvals only; no auditor)	Yes
Vault contracts (hold the ERC-20 reserve, deploy ledgers)	contracts	Yes	Apache-2.0	none (no owner)	Yes
SHE proof library (Cairo verifier and TypeScript provers)	sdk	Yes	Apache-2.0	user	Yes
@fatsolutions/tongo-sdk (client-side proving and transaction building)	sdk	Yes	Apache-2.0	user	Yes
Starknet mainnet and a JSON-RPC endpoint of the user's choice	ledger	Yes	Apache-2.0	StarkWare-operated sequencer; RPC chosen by the user	Yes
Tongo Relayer contract (optional gasless path)	relayer	Yes	Apache-2.0	Relayer owner (whitelists ledgers, assets and forwarders)	No
AVNU paymaster used by the Relayer	paymaster	No	proprietary	AVNU	No
Demo frontend (demo.tongo.cash)	frontend	No	proprietary	Fat Solutions	No

Repositories

Repository	Role	License
fatlabsxyz/tongo	contracts	Apache-2.0
fatlabsxyz/she	sdk	Apache-2.0

Contracts

None listed.

Assessor notes

Unit: the v2 canonical Tongo ledgers and Vaults on Starknet mainnet. Starknet state was read via starknet-rpc.publicnode.com at block 16117583, using starknet_call and starknet_getClassHashAt. Those reads cannot be cited as onchain evidence because the schema accepts only 20-byte EVM or base58 addresses. This caps C1, C2, S1 and S2 at 2, as the findings explain. Usage is small: the v2 USDC Vault held 7.78 USDC and the other v2 Vaults held 0, while the larger v1 STRK instance held about 295.6 STRK. Contracts are identical at tag v2.0.0 (47ea644b) and master (7dac05e8). We ran no transactions, built nothing and inspected no frontend.

At a glance

Holds up 17

Falls short 5

Not yet evidenced 1

Where it is offered

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

What would raise this pillar

Security audits 1

Group A: operational facts

Group B: institutional due diligence

Scope of assessment

Components in the payment path

Repositories

Contracts

Assessor notes