Security model
What the program enforces, and what it does not.
Guarantees
- Escrowed assets live in program-derived accounts with no private key. Only a fill or a close can move them.
- A close always returns assets and rent to the order's owner, whoever signs the close transaction.
- Every fill is checked against the price bound the filler signed, computed on the per-token-received amount after fees.
- Settlement is one transaction. There is no state in which one side has paid and the other has not delivered.
What the protocol cannot do
The administrator cannot move escrowed assets. Not with a special instruction, not by passing unusual accounts, not at all. Every order's vault lives in an address space derived from that order, and the only administrative instruction that touches a token account addresses the fee vault, in a separate and non-overlapping address space.
This is verified three independent ways: by enumerating the accounts of every administrator-authenticated instruction, by proving the two address spaces cannot collide, and by a test suite that attempts the theft against a live funded vault and asserts it fails.
What the protocol can do
| Capability | Held by | Bounded by |
|---|---|---|
| Change the fee | Admin | Hard cap of 1%, compiled into the program. Currently set to 0.30% |
| Change the fee destination | Admin | Treasury account only |
| Withdraw collected fees | Admin | Fee vault only |
| Register a payment asset | Admin | Per-asset value floors and ceilings |
| Pause new orders and fills | Admin or guardian | Cancellation is never blocked |
| Replace the program | Upgrade authority | Nothing in the program |
Pause never traps funds
Pausing halts new orders and new fills. Cancellation always works. That is structural rather than a policy: the cancel instruction does not read the protocol config at all, so there is no pause flag reachable from that code path.
The guardian
A break-glass key that can halt the venue in seconds and do nothing else. It cannot un-pause, which requires the administrator, so a compromised guardian can stop trading but cannot resume it to cover its tracks, and can never reach funds.
Upgrade authority
Independent verification
solana program show 49Wrcv37fZHj3ac9ajHb3iLiqAcZwvT6YB5Hf3Tetty9Compare Authority against what the project publishes. The deployed bytes are verified on chain, so the badge below reads the live verification result rather than a hash that has to be updated by hand on every upgrade.
The upgrade authority is the only key that can replace the program's code. It cannot move escrowed assets, change a price or take a fee retroactively, but a future upgrade it signs could change any rule described on this page. The verification badge above reads live, so you can confirm at any moment that the deployed bytes still match the published source.
What your client must still do
- Read
pausedfrom the config before offering a create or fill, and surface it rather than letting the transaction fail. - Derive price bounds from a quote helper, never from the listed price. A bound equal to the listed price always reverts.
- Treat every monetary value as
bigint. A u64 amount silently loses precision as a JavaScriptnumber.