trenchcoat
Free · no sign-up
Website report · 1 h ago

cleft.live

“CLEFT - a USDC carry vault on SOL”

Template-written 43 evidence items Code reader analysed 31 scripts
What this means for you

CLEFT only talked to its own servers while we watched.E1

  • An AI agent used the site and saw 0 of 2 claimed features working.E35E36E40E41E42
  • Wallet connection: I clicked Connect wallet. A dialog opened asking for a Solana wallet (Phantom, Solflare or Backpack) and said none was found in this browser, so I couldn't finish connecting. The vault page also showed 'Requests are closed right now' for deposits and redemptions.E35E36
  • Staking / yield: I didn't find a $CLEFT staking interface anywhere I looked. Staking appears only in docs links and on the Receipts page, which lists a 'Staker reward USDC' address and calls the token 'staked on Earn', but /stake and /earn both return Not found. The vault page loaded live data, but NAV was 0.00, no epoch had been struck, no funding receipts existed and no perp venue was attached.E36E40E41E42E43
  • Also noticed, Status panel reports perp venue not connected: The PARTIAL status panel listed the database, chain RPC, vault program, keeper and indexer as OK, but 'Perp venue adapter: Not connected' and 'Venue deposits: Not reporting'. The vault page also said deposits are held in USDC and no short is open.E36E38
  • Tech check: the site claims wallet connection, and its public page shows matching evidence.E31E10E11E12
  • Tech check: the site mentions staking / yield, but we found nothing behind it in what its public page loads.E32
  • We saw no known analytics or advertising services load on the first visit.E1
  • Its code can ask your wallet to sign transactions. Read every wallet pop-up before approving.E29

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

Wallet connection

“Skip to the vault overview CLEFT Connect wallet Open vault 01Run 02Legs 03Funding 04Turns 05Drift 06St…”E31

Wallet libraries in its code: WalletConnect / Reown, Solana web3 / wallet adapter, PhantomE10E11E12

Wallet requests in its code: signTransaction, signMessageE29E30

Nothing found on the public page

Staking / yield

“…EFT exists Vault share carry P&L, redeem at NAV $CLEFT stake fee claim, 7-day cooldown 01 Vision Leverage grows eve…”E32

No matching code, calls or services in what loaded for us.

Calls its own backend /api/auth/session, /api/vault, /api/receiptsE17E18E19E20
Wallet code WalletConnect / Reown, Solana web3 / wallet adapter, PhantomE10E11E12E29
Contract calls in its code none seen
Talks to AI services none seen
Live connections keeps a live two-way connection open to a serverE15

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 10 steps and saw 0 of 2 claimed features working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

Wallet connection

I clicked Connect wallet. A dialog opened asking for a Solana wallet (Phantom, Solflare or Backpack) and said none was found in this browser, so I couldn't finish connecting. The vault page also showed 'Requests are closed right now' for deposits and redemptions.E35E36

Not seen working

Staking / yield

I didn't find a $CLEFT staking interface anywhere I looked. Staking appears only in docs links and on the Receipts page, which lists a 'Staker reward USDC' address and calls the token 'staked on Earn', but /stake and /earn both return Not found. The vault page loaded live data, but NAV was 0.00, no epoch had been struck, no funding receipts existed and no perp venue was attached.E36E40E41E42E43

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Status panel reports perp venue not connected

The PARTIAL status panel listed the database, chain RPC, vault program, keeper and indexer as OK, but 'Perp venue adapter: Not connected' and 'Venue deposits: Not reporting'. The vault page also said deposits are held in USDC and no short is open.E36E38

Noticed

Receipts and addresses link to Solana devnet

The Receipts page loaded three USDC deposit book-flow entries (balance 20.00 USDC) and zero funding receipts. All of its Solscan links, including the program and the $CLEFT mint, point to cluster=devnet.E42

What it is

  • The Internet Archive has never saved this site, so it is probably new.E33
  • The site describes itself as: “A USDC carry vault on SOL: a spot leg and an equal short leg, funding settled hourly as receipts.”E2
  • It's built with Next.js and React (common tools for building web apps).E6E7
  • Notable building blocks in its code: Three.js (3D graphics).E8
  • In your browser it can copy text to your clipboard, saves small bits of data in your browser and keeps a live two-way connection open to a server.E13E14E15
  • It has sections such as /vault, /receipts, /docs and /portfolio.E28
  • While loading, it called 4 endpoints on its own servers, such as /api/auth/session, /api/vault, /api/receipts and 1 more.E17E18E19E20

Where your data goes

On a first visit the page only talked to its own servers (cleft.live).

Crypto and wallets

  • Wallet tools in the code: WalletConnect / Reown, Solana web3 / wallet adapter and Phantom.E10E11E12
  • signTransaction: asks a wallet to sign transactions (often Solana wallets).E29
  • signMessage: asks a wallet to sign a message.E30

How key features work

What it can ask your wallet to sign

Its code can ask your wallet for signTransaction. Each of these opens a wallet pop-up you must approve; read it before you click.E29

signTransaction

Connecting your wallet

It connects to crypto wallets using WalletConnect / Reown, Solana web3 / wallet adapter, Phantom, signTransaction and 1 more. Connecting shows the site your wallet address; it doesn't move funds by itself.E10E11E12

WalletConnect / ReownSolana web3 / wallet adapterPhantomsignTransactionsignMessage

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/api/auth/session, /api/auth/nonce, /api/auth/verify and /api/auth/logout).E17E25E26E9

/api/auth/session/api/auth/nonce/api/auth/verify/api/auth/logout

Live updates

It keeps live connections open (WebSockets) so content updates without reloading.E15

websocket

Loading its content

Its content loads from its own API while you browse (/api/auth/session, /api/vault, /api/receipts and /api/config/public).E17E18E19E20

/api/auth/session/api/vault/api/receipts/api/config/public

Drawing and editing in the browser

The page draws and edits graphics in your browser using Three.js (3D graphics) and the canvas.E8E16

Three.js (3D graphics)canvas

Saving data on your device

It saves data in your browser (localStorage), so some things persist between visits.E14

local_storage

Pages and API calls

Pages it links to

//vault/receipts/docs/portfolio

Endpoints

Called while loading (seen) or named in the code (code).

cleft.live/api/auth/sessionseenE17
cleft.live/api/vaultseenE18
cleft.live/api/receiptsseenE19
cleft.live/api/config/publicseenE20
/api/vaultcodeE21
/api/receiptscodeE22
/api/config/publiccodeE23
/api/statuscodeE24
/api/auth/noncecodeE25
/api/auth/verifycodeE26
/api/auth/logoutcodeE27

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: CLEFT - a USDC carry vault on SOL
page title · https://cleft.live/
E2
Page description: A USDC carry vault on SOL: a spot leg and an equal short leg, funding settled hourly as receipts.
page description · https://cleft.live/
E3
Site name: CLEFT
page site_name · https://cleft.live/
E4
Main heading: Hold the other side of leverage.
page h1 · https://cleft.live/
E5
29 request(s) to cleft.live
types: 13 script, 8 stylesheet, 4 fetch
GET https://cleft.live/ · script · 29 requests · network recording
E6
Next.js detected by the code reader (next-runtime)
confidence: high
cleft.live/_next/static/chunks/3tl0cbk7j1mj0.js · “next-runtime” · the code reader
E7
React detected by the code reader (react-runtime)
confidence: medium
cleft.live/_next/static/chunks/40ueth782yg6v.js · “react-runtime” · the code reader
E8
Three.js (3D graphics) found in the code
cleft.live/_next/static/chunks/20lv7twe1j5d7.js @ 1:491405 · “WebGLRenderer” · pattern scan
E9
NextAuth / Auth.js found in the code
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:11567 · “/api/auth/session” · pattern scan
E10
WalletConnect / Reown found in the code
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:17991 · “WalletConnect” · pattern scan
E11
Solana web3 / wallet adapter found in the code
cleft.live/_next/static/chunks/20qi77zhr3hmb.js @ 7:20 · “wallet-adapter” · pattern scan
E12
Phantom found in the code
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:284 · “phantom.app” · pattern scan
E13
Uses the browser ability: clipboard_write
can copy text to your clipboard
cleft.live/_next/static/chunks/2l9bypm_bfs-j.js @ 1:12584 · “clipboard.writeText(” · pattern scan
E14
Uses the browser ability: local_storage
saves small bits of data in your browser
cleft.live/_next/static/chunks/20qi77zhr3hmb.js @ 479:29723 · “localStorage.setItem(” · pattern scan
E15
Uses the browser ability: websocket
keeps a live two-way connection open to a server
cleft.live/_next/static/chunks/20qi77zhr3hmb.js @ 6:7607 · “new WebSocket(” · pattern scan
E16
Uses the browser ability: canvas
draws graphics on a canvas
cleft.live/_next/static/chunks/3tl0cbk7j1mj0.js @ 1:131556 · “getContext("webgl2"” · pattern scan
E17
The page called /api/auth/session on cleft.live (GET)
GET https://cleft.live/api/auth/session · fetch · network recording
E18
The page called /api/vault on cleft.live (GET)
GET https://cleft.live/api/vault · fetch · network recording
E19
The page called /api/receipts on cleft.live (GET)
GET https://cleft.live/api/receipts · fetch · network recording
E20
The page called /api/config/public on cleft.live (GET)
GET https://cleft.live/api/config/public · fetch · network recording
E21
Code reader found the endpoint /api/vault
how: call:fetch
cleft.live/_next/static/chunks/0v7dws-_kivy3.js @ 1:13882 · “/api/vault” · the code reader
E22
Code reader found the endpoint /api/receipts
how: call:fetch
cleft.live/_next/static/chunks/0v7dws-_kivy3.js @ 1:13945 · “/api/receipts” · the code reader
E23
Code reader found the endpoint /api/config/public
how: call:fetch
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:17165 · “/api/config/public” · the code reader
E24
The code names the endpoint /api/status
cleft.live/_next/static/chunks/2l9bypm_bfs-j.js @ 1:2004 · “/api/status” · pattern scan
E25
The code names the endpoint /api/auth/nonce
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:12041 · “/api/auth/nonce” · pattern scan
E26
The code names the endpoint /api/auth/verify
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:12176 · “/api/auth/verify” · pattern scan
E27
The code names the endpoint /api/auth/logout
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:12418 · “/api/auth/logout” · pattern scan
E28
5 links to pages on the same site
page links · https://cleft.live/ · /, /vault, /receipts, /docs, /portfolio
E29
Wallet request in code: signTransaction
asks a wallet to sign transactions (often Solana wallets)
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:13603 · “signTransaction” · pattern scan
E30
Wallet request in code: signMessage
asks a wallet to sign a message
cleft.live/_next/static/chunks/1xe8ib91_hbgu.js @ 1:11776 · “signMessage” · pattern scan
E31
The site says: “Skip to the vault overview CLEFT Connect wallet Open vault 01Run 02Legs 03Funding 04Turns 05Drift 06St…”
page text · https://cleft.live/ · Skip to the vault overview CLEFT Connect wallet Open vault 01Run 02Legs 03Funding 04Turns 05Drift 06St…
E32
The site says: “…EFT exists Vault share carry P&L, redeem at NAV $CLEFT stake fee claim, 7-day cooldown 01 Vision Leverage grows eve…”
page text · https://cleft.live/ · …EFT exists Vault share carry P&L, redeem at NAV $CLEFT stake fee claim, 7-day cooldown 01 Vision Leverage grows eve…
E33
The Internet Archive has no saved copy of cleft.live
page web archive · https://web.archive.org/web/*/cleft.live
E34
Agent step 1: view
AI agent step 1 · view on /
E35
Agent step 2: click Connect wallet
AI agent step 2 · click on / · page called GET cleft.live/api/config/public
E36
Agent step 3: go /vault
AI agent step 3 · go on /vault · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/portfolio, GET cleft.live/receipts, GET cleft.live/docs
E37
Agent step 4: go /portfolio
AI agent step 4 · go on /portfolio · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/vault, GET cleft.live/receipts, GET cleft.live/docs, GET cleft.live/api/config/public, GET cleft.live/api/vault
E38
Agent step 5: click PARTIAL 2
AI agent step 5 · click on /portfolio
E39
Agent step 6: go /docs
AI agent step 6 · go on /docs · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/vault, GET cleft.live/portfolio, GET cleft.live/receipts
E40
Agent step 7: click Staking $CLEFT
AI agent step 7 · click on /docs
E41
Agent step 8: go /stake
AI agent step 8 · go on /stake · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/vault, GET cleft.live/portfolio, GET cleft.live/receipts, GET cleft.live/docs
E42
Agent step 9: go /receipts
AI agent step 9 · go on /receipts · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/vault, GET cleft.live/portfolio, GET cleft.live/docs
E43
Agent step 10: go /earn
AI agent step 10 · go on /earn · page called GET cleft.live/api/auth/session, GET cleft.live/api/status, GET cleft.live/, GET cleft.live/vault, GET cleft.live/portfolio, GET cleft.live/receipts, GET cleft.live/docs

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 14 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id J8y3O1U6.