Security hardening (#69)

* fix: security hardening from Frank Castle review

Resolves all issues from the Safe Solana Builder audit:

C2: token_program validation in WithdrawFeesAccounts
C3: Normalize oracle price before PMM formula
H1: Emergency pause mechanism (SET_PAUSE instruction)
H2: Delegation check in match_orders
H3: 24h timelock on authority rotation + cancel-proposal
M1: Events for initialize_market, cancel_order, delegate_orderbook, withdraw_fees
M3: Fix truncated comment + typo
M4: Fix oracle_timestamp doc (slot -> seconds)

Market::LEN: 256 -> 265 (+1 paused, +8 pending_authority_proposed_at)
Error variants added: MarketPaused, OrderbookDelegated, TimelockPending

* chore: cargo fmt (nightly)

* chore: deploy to devnet

Deployed FluxDEX program to devnet.
Program ID: 3onsNSU7Q8v5yZ14wTY9DnNHr76WSxwjfnD1jrDyZAPc

- Updated app/src/lib/program.ts with deployed address
- Updated app/.env.example with deployed address
- Created deploy/deploy-devnet.sh script
- Updated TDD.md §9.2 with devnet program ID

Author: 0xfave

README.md

@@ -6,7 +6,7 @@ FluxDEX is an exchange-oriented Solana program combining a central limit order b
 
 Custody and durable state live on Solana L1. The order book delegates to MagicBlock ephemeral rollups for ~10ms block time execution with gasless session transactions.
 
-**This is not a finished end-user DEX yet.** It covers PMM math, matching engine, settlement, and delegation lifecycle. The Python prototype validates the DODO quadratic pricing formulas before Rust porting.
+**⚠️ WARNING: NOT READY FOR PRODUCTION.** This code has **not** received a professional security audit. Do not use with real funds until a full audit is completed.
 
 ## Why FluxDEX
 
@@ -38,20 +38,9 @@ Most DEXes either use a pure AMM (high slippage, IL) or a pure CLOB (no fallback
 
 ### In Progress
 
-- Epic 4: MagicBlock SDK on-chain integration (delegation CPI + gpl-session), Pyth oracle, deployment scripts
-- Epic 3: React/Vite frontend components
-
-### Not Started
-
-- MagicBlock on-chain delegation CPI (ownership transfer to `DELeGGvXpWV2fqJUhqcF5ZSYMS4JTLjteaAMARRSaeSh`)
-- Pyth oracle integration (on-chain price validation + frontend display)
 - CCTP V2 cross-chain deposits
-- Frontend UI components (OrderBook, PlaceOrder, Portfolio, MarketStats, LatencyTimer)
-- Devnet deployment scripts
 - Security audit checklist verification
 
-The right way to read this repo: **smart contract done, math validated, frontend and integrations starting.**
-
 ## Architecture
 
 ```
@@ -87,6 +76,14 @@ The right way to read this repo: **smart contract done, math validated, frontend
                 +----------------------------------+
 ```
 
+## Prerequisites
+
+- **Rust** — Install via [rustup](https://rustup.rs/). The repo pins a Solana-compatible version in `rust-toolchain.toml`.
+- **Solana CLI** — Install from [docs.solanalabs.com/cli/install](https://docs.solanalabs.com/cli/install). Minimum version compatible with the Solana SDK in `Cargo.toml`.
+- **Node.js 18+** — Required for the frontend (`app/`).
+- **just** — Command runner. Install via `cargo install just` or your package manager.
+- **Python 3.10+** — Required for the PMM math prototype and test vector generation.
+
 ## Repository Layout
 
 ```
@@ -114,6 +111,54 @@ flux-dex/
 └── Cargo.toml
 ```
 
+## Getting Started
+
+### Build the Program
+
+```bash
+# Build the Solana BPF program
+cargo build-sbf
+
+# Or via just
+just build
+```
+
+The compiled `.so` is written to `target/deploy/flux_dex.so`.
+
+### Install Frontend Dependencies
+
+```bash
+cd app
+npm install
+npm run dev      # start dev server at http://localhost:5173
+```
+
+### Run Tests
+
+```bash
+# Solana BPF integration tests (~60+ tests)
+cargo test-sbf -- --nocapture
+
+# Or via just
+just test
+just test-sbf     # explicit BPF target
+```
+
+### Deploy to Devnet
+
+```bash
+# Ensure you've built first
+cargo build-sbf
+
+# Deploy using the deploy script
+./deploy/deploy-devnet.sh
+
+# Specify a custom deployer keypair (defaults to ~/.config/solana/id.json)
+./deploy/deploy-devnet.sh ~/.config/solana/devnet.json
+```
+
+The deploy script handles program deployment, and devnet addresses are recorded in the deploy output.
+
 ## PMM Math (Python Prototype)
 
 The quadratic DODO pricing curve:
@@ -176,11 +221,15 @@ just all              # lint + test + vectors
 2. [`prototype/pmm_math.py`](prototype/pmm_math.py) — Python reference implementation
 3. [`docs/prd.md`](docs/prd.md) — product requirements and open questions
 
+## License
+
+Apache 2.0. See [LICENSE](LICENSE) for the full license text.
+
 ## Roadmap
 
 1. **Epic 1** — Scaffolding, state.rs, error.rs, CI/CD ✅
 2. **Epic 2** — All instruction handlers + security hardening ✅
-3. **Epic 3** — React/Vite trading frontend (in progress)
+3. **Epic 3** — React/Vite trading frontend ✅
 4. **Epic 4** — MagicBlock, Pyth oracle, CCTP V2, deployment (in progress)
 
 See `docs/epics/` for full ticket breakdown.

docs/epics/epic-4-integration.md

@@ -168,7 +168,7 @@ Complete the full security audit checklist from TDD §6.4 and shared-base.md. Ve
 
 ### Ticket 4.6: README & Documentation
 
-**Status:** Not Started
+**Status:** Complete
 **Priority:** P2
 **Estimated Effort:** Small
 
@@ -179,14 +179,14 @@ Write a comprehensive README with project description, architecture overview, se
 - `README.md` — Full project documentation
 
 **Acceptance Criteria:**
-- [ ] Project description and goals
-- [ ] Architecture diagram reference
-- [ ] Prerequisites (Rust, Solana CLI, Node.js)
-- [ ] Build instructions (`cargo build-sbf`, `npm install`)
-- [ ] Test instructions (`cargo test-sbf`)
-- [ ] Deployment instructions
-- [ ] Contributing guidelines
-- [ ] License (Apache 2.0)
+- [x] Project description and goals
+- [x] Architecture diagram reference
+- [x] Prerequisites (Rust, Solana CLI, Node.js)
+- [x] Build instructions (`cargo build-sbf`, `npm install`)
+- [x] Test instructions (`cargo test-sbf`)
+- [x] Deployment instructions
+- [x] Contributing guidelines
+- [x] License (Apache 2.0)
 
 ---