Custody & safety

Non-Custodial & Security

The protocol never holds your money in a wallet it controls. Contracts hold only what's in play, and no admin can take it.

Who holds what

GAP is fully non-custodial. There is no operator wallet that ever "holds user funds." On-chain, the contracts hold only:

Locked session stakes — your $BELL while a position is open, released back to you (right side) or partly burned (wrong side) strictly by the resolve rules.
The Floor Pot — funded by losing stakes and fees, paid out by weight.
The insurance vault — VOID rebates and poke bounties.

Claims are pull-based (you call collect; nothing is pushed in loops), state is written before any external call (checks-effects-interactions), and per-user accounting is O(1) — no unbounded loops over players.

No team tap

By construction there is no admin path to drain the pot, the insurance vault, or locked stakes into a team wallet. The core is immutable where it can be; any configurable parameter sits behind explicit roles, with hard floors on the values it can take. Resolution is permissionless — no privileged key can hold a session hostage.

Oracle safety

Outcomes come only from on-chain observables — Chainlink feeds read via their proxy, with dynamic decimals and a staleness guard (Robinhood Chain has no L2 sequencer-uptime feed, so freshness is enforced by feed updatedAt plus off-chain block-recency checks). Resolution is a TWAP over a window, so a single tick can never settle a session. If the official feed and the token feed disagree beyond a configured bound, the session VOIDs rather than guessing.

Audit status

The current core (PRINT, Combo, tickets, the pot, the oracle router, the calendar) ships with per-phase threat models and audit notes (THREATS-*.md / AUDIT-*.md in the repo), an invariants file where each invariant maps to a named test, and an adversarial test suite (fuzzing + reentrancy). Static analysis (slither) is run and its findings triaged — no open high or medium severity at this stage.

External audit gates custody features

Nothing that would hold value beyond in-play stakes ships without an external audit. The protocol-owned weekend market maker ("THE BELL") and the optional isolated Morpho borrow loop are audit-gated — designed accounting-first and left stubbed until reviewed. This is deliberate sequencing, not a claim that today's code is externally audited.