False positive: quarta.fun flagged as "This dApp could be malicious"

[carlthrane1-prog]

Summary

Domain: https://www.quarta.fun
Program ID: qrtAM7ZTcGvng6SPY9ZMyt3HqZKE99jeNEDD1f9hEBG
Network: Solana mainnet
Deployed: 3 October 2026

Phantom shows "Request blocked - This dApp could be malicious" on connect.
The domain is not in github.com/phantom/blocklist, so this appears to be the
unknown-dApp scanner rather than a listing.

What it is: a parimutuel prediction market. A 15 minute round takes bets on
up or down for a Pyth price feed, then settles from the pool. There is no
market maker and no token sale. The program has no instruction that moves
stake anywhere except to the winning side and a 1% fee; the fee is capped at
5% in code.

Source and the deployed binary hash can be provided on request.

Example

https://www.quarta.fun

Steps to Reproduce

1. Open https://www.quarta.fun in a browser with the Phantom extension
2. Click "Launch app", then "Connect wallet"
3. Choose Phantom
4. Phantom shows: "Request blocked - This dApp could be malicious. Do not
   proceed unless you are certain it is safe."

The domain is not present in github.com/phantom/blocklist (checked against
blocklist.yaml and fuzzylist.yaml), so this looks like the dApp reputation
check rather than a listing.

Details:

• Domain: https://www.quarta.fun
• Program ID: qrtAM7ZTcGvng6SPY9ZMyt3HqZKE99jeNEDD1f9hEBG
• Network: Solana mainnet, deployed 3 October 2026
• The site is static, no backend. It reads Pyth price accounts and the
  program's own accounts over public RPC.

What it does: a parimutuel prediction market. Each 15 minute round takes
SOL on "up" or "down" against a Pyth feed, then pays the winning side out
of the pool. No market maker, no token, no presale. The program has no
instruction that sends stake anywhere except to the winning side and a 1%
fee, and the fee is capped at 5% in the program.

Happy to provide the source or the deployed binary hash.

Phantom Version

26.31.0

Is there an existing discussion for this?

• I have searched the existing discussions

[Th3Ya0vi]

Thanks for reaching out. Please contact our support team at help.phantom.com, where someone from our Trust & Safety team can assist with reviewing the warning. You can also follow our Domain and transaction warnings guide for guidance and next steps.