Guarantees and limits

Five properties this contract makes unconditional, each proved against the deployed source, and the three bounded exceptions, each with its bound stated exactly. Read this page before depositing.

Most documentation of a custody contract asserts safety and leaves the reader to find the exceptions in the source. This page does the opposite. The guarantees below are real and they are absolute, and they are worth more, not less, for sitting beside an honest account of what they do not cover.

The guarantees#

1. The house can never move your free balance#

   Not to itself, not to a consignor, not to a recovery address, not under any finding, default, suspension or emergency. There is no function that transfers unlocked collateral out of the contract, and none can be added.

   Proof. The contract makes exactly two outbound token transfers in its entire surface. claimWithdraw transfers to msg.sender: the owner of the balance, and nobody else. settle transfers to treasury, an immutable, and reverts InsufficientLock when lockOf[bidder][lot] == 0. There is no third transfer. lock and release move no tokens at all; they only move a number between the free and locked columns of the same bidder's own balance.

2. Your exit cannot be blocked, paused, or delayed by anyone#

   Once the timelock has run, claiming is a transaction you sign that reads nothing the house controls. There is no state the contract can be put into (paused, settler revoked, guardian hostile, servers gone) in which a ripened claim fails.

   function claimWithdraw() external {
       uint256 amount = pendingWithdrawalOf[msg.sender];
       if (amount == 0) revert NothingPending();
       if (block.timestamp < withdrawableAt[msg.sender]) revert TooEarly(...);
       pendingWithdrawalOf[msg.sender] = 0;
       withdrawableAt[msg.sender] = 0;
       balanceOf[msg.sender] -= amount;
       emit WithdrawClaimed(msg.sender, amount, balanceOf[msg.sender]);
       if (!IERC20Minimal(token).transfer(msg.sender, amount)) revert TransferFailed();
   }

   Proof. Read the signature: external, and no notPaused modifier. Read the body: no reference to settler, guardian or paused. The same is true of requestWithdraw and cancelWithdraw. The guardian's brake is deliberately built to freeze the house's side of settlement while leaving every bidder-side exit open.

3. A settlement has exactly one possible destination, fixed at deployment#

   Even a fully compromised house key cannot send your collateral to an attacker. It can only push it to the address the contract was born with, an address the house already controls, which turns theft into misappropriation and makes the loss recoverable in the ordinary legal way rather than gone.

   address public immutable treasury;
   // ...
   if (!IERC20Minimal(token).transfer(treasury, amount)) revert TransferFailed();

   Proof. treasury is immutable: written once in the constructor, no setter, not storage. settle takes no destination argument. And the separation is held across rotations, not just at deployment: acceptSettler and acceptGuardian both revert RolesMustDiffer when the caller is the treasury, because a constructor check alone is walked past by two ordinary, fully authorised role rotations.

4. There is no upgrade path and no admin override#

   No proxy, no delegatecall, no implementation slot, no selfdestruct, no owner, no pausable-upgradeable base, and no function that changes a rule. The bytecode at that address is the whole of the agreement and it cannot be edited under you. A change of rules is a new contract and a public migration.

   Proof. The constants are compile-time: VERSION, MAX_LOCK_AGE and SETTLE_DELAY are constant; token, treasury and withdrawDelay are immutable. The only mutable state the roles can touch is settler, guardian and paused, each through a named two-step transfer or the brake. Search the verified source for delegatecall and selfdestruct: neither appears.

5. Encumbrance is bounded, and the release is permissionless#

   No lock can hold your money for ever, and freeing an overdue lock does not require the house to cooperate, be online, or exist.

   /// @notice Release a lock that has stood past MAX_LOCK_AGE. Callable
   ///         by ANYONE, deliberately. Not pausable.
   function expireLock(address bidder, bytes32 lot) external { ... }

   Proof. expireLock has no access modifier and no notPaused. Any address may call it against any lock whose lockExpiresAt has passed, which is 30 days after the lock was created or last raised. If the guardian has called revokeSettler, the age requirement is waived entirely and every lock becomes expirable at once, because with no settler there is nobody who could ever settle or release it and holding the bidder to a timer would be punishment for the house's incident.

A sixth, about the roles#

The guardian, the incident key, cannot appoint a settler. Not "cannot appoint itself": cannot appoint at all. transferSettler is onlySettler, and the power is absent from the guardian rather than guarded by a check.

That is deliberate, and the reasoning is worth repeating because it is the kind of thing usually got wrong. A check like "the new settler may not be the guardian's address" compares addresses. Separation of duties is about parties. A guardian holding a second address proposes it, accepts from it, and now holds both roles, a pause-only key that can encumber every bidder's free balance and push locked collateral to the treasury. No on-chain check can tell that address apart from an honest new settler key. So the power is not there to abuse.

The limits#

Three. None of them is a bug, and each is the cost of a property the system needs. Each has a bound, and the bound is a number rather than a reassurance.

The worst case, stated in one paragraph#

The full analysis of each key, each role, and each attacker is Threat model.

What is not claimed#

So that nobody has to guess at the edges of the page above:

• Not non-custodial. The contract holds customer funds and the house operates a key against it. The house says so in the contract's own header.
• Not audited to exhaustion. Two independent audits, a ten-lens panel, 161 Foundry and 934 Node tests, and a clean Slither triage, but no formal proof of the full state machine, no bug bounty currently running, and no insurance on balances.
• Not proof against your own key loss. Balances are keyed to the depositing address and cannot be reassigned. That is the same property that stops the house doing it to you.
• Not private. Your lock, and therefore your maximum bid, is public and permanent.
• Not instant, in a disaster. The exit from a locked balance is unconditional and needs nobody's cooperation, but it can take up to 30 days.