Security

Design

Non-custodial. The protocol never holds your keys. sGRAM sits in your wallet and only you can move it.
Contract-enforced unlock. The 14-day hold on newly minted sGRAM is enforced by the contract, not by an operator.

These safeguards come from the KTON V2 design the pool is built on.

Only genuine sGRAM can be redeemed. When sGRAM is burned, the sGRAM contract recalculates the address of the holder's own sGRAM wallet and accepts the burn only from that address. Counterfeit tokens that call themselves “sGRAM”, or any other jetton sent to the protocol, cannot be exchanged for GRAM from the pool.
Payouts are authorised only by the sGRAM contract. The pool releases GRAM only on a withdrawal request that comes from the sGRAM contract itself; a message from any other address is rejected.
Unknown operations are refused. Messages the contracts do not recognise are not processed.
Emergency stop. A dedicated role can halt the pool if an attack or an anomaly is detected. While the pool is halted, withdrawal requests are not executed: the burned sGRAM is minted back to its owner, so nothing is lost.

The pool is intended for GRAM that its holder owns lawfully.

Prohibited by the Terms. Depositing GRAM obtained through theft, hacks, fraud or other unlawful activity, or using the pool to conceal the origin of such funds, is prohibited under the Terms of Use.
Staking does not break the trail. Deposits, sGRAM transfers and withdrawals are public TON transactions tied to specific addresses. Passing stolen GRAM through the pool does not hide where it came from or which wallet holds it now.
Response to reports. On credible information that funds in the pool originate from a theft or a hack, we cooperate with the affected parties, wallet and exchange providers and law enforcement, and may restrict access to the Site's interface for the addresses involved.

The pool is built on the open-source TON liquid-staking codebase KTON V2 (MIT licence).
The KTON V2 contracts were audited by TonBit (BitsLab), 3 Apr – 26 May 2025: audit report KTON-Final-Audit-Report.pdf in the KTON repository.
The gram-staking pool is our own deployment based on this code. It has not had a separate audit, and its source code has not been published yet. The KTON audit does not by itself cover our deployment.

We will update this page if an audit of the gram-staking deployment is carried out or the source is published.