Security
Raise Rail moves real value between parties with different interests. The design assumes mistakes, retries and adversaries — and makes the dangerous paths structurally impossible rather than merely discouraged.
Committed capital is held in an SPL token account whose authority is a program-derived address — an account with no private key. Transfers out of escrow can only happen through the Raise Rail program's instructions: an approved milestone release (in order, within balance) or a refund after cancellation. Neither the company, the investors nor the platform can move escrowed funds outside those rules.
PDA authority · no private key · two exit paths
Sign-in is an ed25519 signature over a human-readable challenge bound to this origin, your wallet address, a single-use nonce and an issue time. Nonces expire after five minutes and are consumed atomically — the same signed message can never authenticate twice. Sessions are HttpOnly cookies referencing hashed tokens; raw tokens are never stored.
ed25519 · origin-bound · single-use nonce · 5-minute expiry
Every mutation re-checks the caller's role on the server: company owners and operators manage rounds, investor admins and members commit and vote, reviewers read. Hiding a button is a courtesy; the service layer is the control. Votes are weighted by confirmed commitments read from the database, never from the request.
server-side role check on every mutation · weights read, never sent
Commitments, decisions and releases carry idempotency keys and unique transaction signatures. Retrying a request — a flaky connection, a double-click, a replayed webhook — returns the original result instead of moving capital twice. On-chain, decision accounts are derived per investor per milestone, making duplicate votes structurally impossible.
idempotency key · unique tx signature · one decision account per investor per milestone
PostgreSQL is an indexed view for fast product experiences; Solana holds authoritative escrow balances, commitments and approvals. A reconciliation job compares indexed state with program accounts, repairs stale records and flags divergence rather than papering over it.
Solana authoritative · Postgres indexed · divergence flagged, not hidden
Every material action — invitation, commitment, request, decision, release, refund, wallet change — produces a structured activity event in the same database transaction as the change itself. On-chain counterparts emit program events. History accumulates; it does not get edited.
activity event in the same transaction as the change · never edited
Engineering practices
Applied uniformly across the API, the Solana program and the runtime.
Raise Rail is demonstration software. Nothing on this site is an offer to sell or a solicitation of an offer to buy securities. Capital formation is regulated activity — operate a platform like this only with appropriate legal counsel and licences in your jurisdiction.