Whitelist adha.fun (false positive — open-source Solana dApp)

[adhadotfun]

adha.fun is showing Phantom's "this dApp could be malicious" warning on connect.

It is not listed in blocklist.yaml — I checked all 2,319 entries — so this looks
like an automated heuristic flag on a young domain rather than a manual listing.
Opening this as a false-positive review request.

What the site does

adha.fun is a launcher for pump.fun coins with configurable creator-fee splits.
A creator picks how their fee stream is divided (e.g. a share to holders, a share
to a buyback reserve), and that configuration is written on chain.

Wallet interactions, precisely

• The site requests transaction signatures only, always initiated by a click.
• It never requests a seed phrase, and never asks for a token approval or
  setAuthority — there is no delegation step anywhere in the flow.
• No private keys exist server-side. The vanity-address grinder that produces
  …adha mint addresses runs in the browser; keys stay in the tab's
  localStorage and never leave it.
• Nothing auto-signs. Every signature is a discrete user action.

Verification

• Full source, MIT licensed: https://github.com/adhadotfun/adha-fun
• Fee-split routing is readable on chain rather than asserted in a README. The
  executor wallet that receives split fees is public:
  https://solscan.io/account/6xjNfNVyaigQYjLC7vNpUP4cbwHQNNdZhZpreemfvjjT
• A live coin launched through the site, with the dev allocation locked in a
  Streamflow escrow (20,000,000 tokens, lock tx):
  https://solscan.io/tx/4TCfd62a9ULEu4BRGLsoaXMWn8jzZv8N5izsCtPje4qKsbGdAedLcaiwm9jHNe7xZWtf6XSp4dJ5WnaVW75bijK7
• X: https://x.com/adhadotfun

I understand whitelist.yaml is not currently consumed in production; this PR is
primarily a request for review of the heuristic flag. Happy to provide anything
further that helps, and happy to close this if the correct channel is elsewhere.

Summary by CodeRabbit

• New Features
  • Added adha.fun to the approved website whitelist.
  • Confirmed nftplus.io remains approved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ab44072e-a4ff-436e-ae1e-5df7b6190d17

📥 Commits

Reviewing files that changed from the base of the PR and between 5030186 and fc35702.

📒 Files selected for processing (1)

• whitelist.yaml

Included review availability: 4 reviews are currently available. Based on recent review activity, included reviews refill at 5 per hour.

---

📝 Walkthrough

Walkthrough

Changes

Whitelist update

Layer / File(s)	Summary
Add whitelist URL whitelist.yaml	The whitelist retains nftplus.io and adds adha.fun.

Merge Risk: 🔵 Low · up to fc357

This PR adds adha.fun to published allowlist data, although the allowlist is not currently enforced. It is mergeable with owner awareness, but the production consumer and future revalidation should be documented before enforcement is activated to avoid suppressing warnings without renewed validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: adding adha.fun to the whitelist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request has been flagged as potential spam (promotional) by CodeRabbit slop detection and should be reviewed carefully.