0trace — truly private instant exchange

[Cinexa]

I have checked 0trace today. Their Content-Security-Policy is mostly theater for XSS. The Policy is: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; … unsafe-inline + unsafe-eval means if any XSS exists, CSP will not stop it. Homepage JS also uses dangerouslySetInnerHTML and innerHTML. There is no nonce/hash script policy. connect-src 'self' is the one CSP directive that actually helps.

Also, robots.txt maps the backend. It lists /admin, /api/admin, /api/partner, /api/v1, /api/quicknode, /order, /partner. /api/quicknode is an infrastructure leak (QuickNode RPC).

Also, homepage JSON-LD sameAs includes https://t.me/otraceio (letter O, missing zero). X is @0trace_io. I have checked it on Monerica, which also lists https://t.me/otraceio as their messenger. I see the @0traceio does not exist on Telegram. So, why would you use the letter O while the 0 is available for you?

[0trace]

I have checked 0trace today. Their Content-Security-Policy is mostly theater for XSS. The Policy is: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; … unsafe-inline + unsafe-eval means if any XSS exists, CSP will not stop it. Homepage JS also uses dangerouslySetInnerHTML and innerHTML. There is no nonce/hash script policy. connect-src 'self' is the one CSP directive that actually helps.

Also, robots.txt maps the backend. It lists /admin, /api/admin, /api/partner, /api/v1, /api/quicknode, /order, /partner. /api/quicknode is an infrastructure leak (QuickNode RPC).

Also, homepage JSON-LD sameAs includes https://t.me/otraceio (letter O, missing zero). X is @0trace_io. I have checked it on Monerica, which also lists https://t.me/otraceio as their messenger. I see the @0traceio does not exist on Telegram. So, why would you use the letter O while the 0 is available for you?

Thanks — useful review.
CSP. You're right about 'unsafe-eval' — it was inherited boilerplate, nothing we ship needs it. Removed, with a test so it can't come back. 'unsafe-inline' stays for now; removing it needs a nonce pipeline, which is open work. Meanwhile connect-src 'self' does the part you correctly flagged as useful: an injected script can't send anything anywhere we don't control.
On dangerouslySetInnerHTML — two call sites, both static content from our own source. No user or third-party input reaches either.
robots.txt. It's a crawl directive, not access control; every path there is independently gated, and our public API is documented openly by design. Still, two lines didn't earn their place and are gone.
Telegram. We don't operate one — see our post of March 29, 2026, 03:28:13 PM in this thread. The link was stale and has been removed everywhere.

[Doan9269]

The major platform listings have been confirmed with 0trace, some reputable members have also see to confirm their guarantee system to be working as expected, this is a platform that is indicating for a positive outcome being considered, they have been following due process to ensure they follow up with the normal protocols and procedures of a reputable platform, in which these are many more are commendable based on what we can see and hold on to by what they have achieved, to stand out.

[Cinexa]

Thanks — useful review.
CSP. You're right about 'unsafe-eval' — it was inherited boilerplate, nothing we ship needs it. Removed, with a test so it can't come back. 'unsafe-inline' stays for now; removing it needs a nonce pipeline, which is open work. Meanwhile connect-src 'self' does the part you correctly flagged as useful: an injected script can't send anything anywhere we don't control.
On dangerouslySetInnerHTML — two call sites, both static content from our own source. No user or third-party input reaches either.
robots.txt. It's a crawl directive, not access control; every path there is independently gated, and our public API is documented openly by design. Still, two lines didn't earn their place and are gone.
Telegram. We don't operate one — see our post of March 29, 2026, 03:28:13 PM in this thread. The link was stale and has been removed everywhere.

Thanks for the detailed reply, appreciate you actually engaging with it instead of waving it off.

For CSP, fair enough on unsafe-eval. Removing the leftover boilerplate and locking it with a test is the right move. On unsafe-inline, yeah, I get that a nonce pipeline is not a one line fix. Just flagging that until that lands, CSP still isn’t doing much against XSS if something ever slips through. connect-src 'self' helps for exfil, sure, but it doesn’t stop address swaps or fake UI in the page itself. So I’m still treating that as open risk until nonces are in.

dangerouslySetInnerHTML: noted. If those two sites are truly static and never touch user/order/chat input, that’s better than it looked from the bundles. Worth keeping an eye on as the app grows though, that class of bug usually creeps in later, not on day one.

As for telegram, might be worth pinging Monerica so their listing doesn’t keep advertising a dead/wrong handle.

[0trace]

Thanks — useful review.
CSP. You're right about 'unsafe-eval' — it was inherited boilerplate, nothing we ship needs it. Removed, with a test so it can't come back. 'unsafe-inline' stays for now; removing it needs a nonce pipeline, which is open work. Meanwhile connect-src 'self' does the part you correctly flagged as useful: an injected script can't send anything anywhere we don't control.
On dangerouslySetInnerHTML — two call sites, both static content from our own source. No user or third-party input reaches either.
robots.txt. It's a crawl directive, not access control; every path there is independently gated, and our public API is documented openly by design. Still, two lines didn't earn their place and are gone.
Telegram. We don't operate one — see our post of March 29, 2026, 03:28:13 PM in this thread. The link was stale and has been removed everywhere.

Thanks for the detailed reply, appreciate you actually engaging with it instead of waving it off.

For CSP, fair enough on unsafe-eval. Removing the leftover boilerplate and locking it with a test is the right move. On unsafe-inline, yeah, I get that a nonce pipeline is not a one line fix. Just flagging that until that lands, CSP still isn’t doing much against XSS if something ever slips through. connect-src 'self' helps for exfil, sure, but it doesn’t stop address swaps or fake UI in the page itself. So I’m still treating that as open risk until nonces are in.

dangerouslySetInnerHTML: noted. If those two sites are truly static and never touch user/order/chat input, that’s better than it looked from the bundles. Worth keeping an eye on as the app grows though, that class of bug usually creeps in later, not on day one.

As for telegram, might be worth pinging Monerica so their listing doesn’t keep advertising a dead/wrong handle.

Fair on unsafe-inline — treating it as open risk is the correct read.

Concrete reason it isn't quick here: the framework inlines its RSC payload into
the HTML (21 inline scripts on a single page, unique per page and per build), so
hashes aren't a mechanism, they're permanent drift. That leaves nonces, and a
nonce must be per-request while we serve 195 statically prerendered pages —
going nonce-based means making all of them dynamic, paying TTFB and LCP for an
audience arriving over Tor. Not a trade I'll make for second-order coverage, and
I'd rather say that than hand you a fake ETA.

Your point about that class creeping in later was the useful one, and it was
already half-true: of the two raw-HTML sites, the JSON-LD one takes a prop, not a
constant — and JSON.stringify does not escape `</script>`. No live vector (route
params are validated against fixed tables), but the sequence only had to appear
once in any of ~28 pages for the data/markup boundary to vanish.

Fixed rather than noted: `<` is now escaped to \u003c before it reaches the tag
(the JSON parser decodes it back, so crawlers read the graph unchanged), and two
tests pin it — one feeds `</script><img onerror>` through the serializer, the
other fails the build if a third dangerouslySetInnerHTML site ever appears. Both
verified by reintroducing the defect.

Telegram is off the Monerica listing now. Thanks for pushing on it.

We appreciate your attention.

[Cinexa]

Fair on unsafe-inline — treating it as open risk is the correct read.

Concrete reason it isn't quick here: the framework inlines its RSC payload into
the HTML (21 inline scripts on a single page, unique per page and per build), so
hashes aren't a mechanism, they're permanent drift. That leaves nonces, and a
nonce must be per-request while we serve 195 statically prerendered pages —
going nonce-based means making all of them dynamic, paying TTFB and LCP for an
audience arriving over Tor. Not a trade I'll make for second-order coverage, and
I'd rather say that than hand you a fake ETA.

Your point about that class creeping in later was the useful one, and it was
already half-true: of the two raw-HTML sites, the JSON-LD one takes a prop, not a
constant — and JSON.stringify does not escape `</script>`. No live vector (route
params are validated against fixed tables), but the sequence only had to appear
once in any of ~28 pages for the data/markup boundary to vanish.

Fixed rather than noted: `<` is now escaped to \u003c before it reaches the tag
(the JSON parser decodes it back, so crawlers read the graph unchanged), and two
tests pin it — one feeds `</script><img onerror>` through the serializer, the
other fails the build if a third dangerouslySetInnerHTML site ever appears. Both
verified by reintroducing the defect.

Telegram is off the Monerica listing now. Thanks for pushing on it.

We appreciate your attention.

Yeah, that tracks on the nonce side. rsc dumping a ton of unique inline scripts per build makes hashes useless, and making all the prerendered pages dynamic just for tor users is a bad trade. Fair, you won't fake an eta.

The JSON-LD bit was the useful one, prop into stringify without escaping </script> is exactly that creep. Glad you fixed it with \u003c and tests.

appreciate the straight answers.

[Bitcoin-Forever]

Thanks for the detailed reply, appreciate you actually engaging with it instead of waving it off.

Of course it is their responsibility to come up with the best on their platform and it is obvious that they may not know it all or have the idea of doing everything all alone, but when they are keen to suggestions from experience members, to do them more better to see some errors well fixed on their platform, I have seen some platform that don't follow up to respond on suggested ideas like this which is very bad, so it's true responsibility to follow up with the discussions on this their ANN thread and observe key notable areas needed for action as may be suggested.

[suzanne5223]

I'm glad about this, though I have been using the exchange service before now; the letter of guarantee that the system works properly gives more confidence.

This is how you get to know those who are ready for business with the service they provided and those that think they know it all and don't take other's review, ideas or suggestions serious, this alone talks a lot about them and what they are here for, staging a brand and maintaining high professional standard in all their dealings isn't a joke, it takes commitment and determination, which they are ready for.

I have to agree with you that the exchange level of dealing is not to be a joke because they carefully take every step in what they do, take their time, and go for something that will strengthen their service, which i believe are some of the attributes to know a platform that's into something for the long term rather platform that makes empty promises. Besides, i also notice that after they used the name 0trace, some brand also imitate their concept.

[Bitcoin-Forever]

Indeed it is not an easy task to go through all the various stages of having a newly setup platform, because it could be more challenging/demanding when it comes to the professionalism area on how you handle your platform, also look at the technical aspects in maintaining it as well as the financial demand as well to ensure that things keep running as expected by getting on board some qualified experts in the field to handle some key areas, such as the customer service, technical support, advertisement and many other areas to ensure the platform is listed among the top rated.

[348Judah]

Isn't it better to see that 0trace has additional measures to improve their site performance by conducting a review campaign?

It may be that I am thinking in this direction anyway, but I don't know their plan towards this, while with the level they have gone so far, I think it will be more advisable to see that they perfected all about their platform by considering for a review campaign to have other members view, suggestions and ideas towards the site functionality.

[0trace]

Zcash with public and private addresses. Coming soon to 0trace.

[348Judah]

You're also going to achieve another milestone, as you have decided for additional coin to be enlisted from the coins you supported ft exchange.

Going through some of the milestones, I can see you have already achieved recognition from several review sites that listed your platform and have good ratings already; you only have to be consistent with perfection, and you could achieve more better over the time.

[0trace]

You're also going to achieve another milestone, as you have decided for additional coin to be enlisted from the coins you supported ft exchange.

Going through some of the milestones, I can see you have already achieved recognition from several review sites that listed your platform and have good ratings already; you only have to be consistent with perfection, and you could achieve more better over the time.

Thank you for your feedback.
We truly appreciate it.

[Doan9269]

I'm glad about this, though I have been using the exchange service before now; the letter of guarantee that the system works properly gives more confidence.

This is what you get when you make use of a reputable exchange platform, as it takes them nothing to show every means to validate their authentication, there is now guaranteed that is platform operates well and it has also been attested by other sites and you can check their ratings from the number of platforms it has been listed, all like other exchange services that doesn't make the necessary things get in place over the service the provide.

[0trace]

ZEC is now fully available on 0trace — supporting both transparent (t1) and shielded (u1) addresses.

[Bitcoin-Forever]

If I may ask, is there any other way we can know of other coins that are in the pipeline or still under consideration to be supported by 0trace anytime soon?

I can see that you already have some previous updates on this, and perhaps we can just have the list of all the coins you have supported for an exchange on your platform all together.

[0trace]

If I may ask, is there any other way we can know of other coins that are in the pipeline or still under consideration to be supported by 0trace anytime soon?

I can see that you already have some previous updates on this, and perhaps we can just have the list of all the coins you have supported for an exchange on your platform all together.

Thank you for your question.
At this point, we believe all the necessary coins have been added. The only thing we're considering is adding a new Robinhood chain. But for now, it's just a plan.

[Bitcoin-Forever]

If I may ask, is there any other way we can know of other coins that are in the pipeline or still under consideration to be supported by 0trace anytime soon?

I can see that you already have some previous updates on this, and perhaps we can just have the list of all the coins you have supported for an exchange on your platform all together.

Thank you for your question.
At this point, we believe all the necessary coins have been added. The only thing we're considering is adding a new Robinhood chain. But for now, it's just a plan.

Sounds interesting, this was a layer 2 ethereum blockchain, its mainnet was recently launched, I know this will serve a good considerable offer to see that people could be able to use it.

I really like the way you're up with the follow up trend of what's happening within the crypto networks.

[Dunamisx]

People are ready to make use of an instant exchange for their privacy and so many other reasons.

But the issue is how to get a reliable one that will bring the true image of what an instant exchange provides, hope this is what you have also intended to render.

[Bitcoin-Forever]

Main
• Own liquidity
• Isolated wallets
• Tor support
• API
• 0.8 fee/
• No KYC/AML
• Escrow $5,000 on OrangeFren

Going through the OP thread on the first page, I learnt from the aspect quoted above that you charges 0.8 fee, but this fee was not expressed or specific on the currency that you consider in making on this, is it 0.8 USD or Bitcoin or possibly on other currency, sometimes we just have to be specific even though I mostly presume this should be in USD, but I think the reason it for and adjustment in case today projected rate need to be more specified with the currency.