Security model
Trust assumptions, spelled out.
What you are trusting, stated plainly.
What you do not have to trust
- The outcome. It is read from Uniswap’s contract, not reported by anyone. No oracle, no committee, no dispute period.
- This website. Every action is a direct call to a verified contract. The interface can go offline and your position is unaffected.
- Us, for your funds. There is no admin function that can move, freeze or confiscate a stake. Not one.
What the owner key can do
| Function | Limit |
|---|---|
setFee | capped at 5%, profit leg only, cannot apply retroactively to a claim already made |
setTreasury | changes where accrued fees go |
setFrogToken | sets the discount token and threshold |
setOwner | transfers the key |
There is no pause, no upgrade path, no proxy and no migration function. The contract that is deployed is the contract that will settle your market.
Engineering
- Non-reentrant on every state-changing entry point; effects written before ETH moves.
- Payout maths uses floor division so the sum of claims can never exceed the pool.
- Reads that decide anything are preceded by a forced checkpoint, so no decision is made on stale auction state.
- The block clock is sourced from ArbSys, matching the auction exactly rather than approximately.
- 34 tests, including a solvency fuzz and fork tests against real mainnet auctions.
What has not happened
The contract has not been audited. It is small and heavily tested, and the tests include adversarial cases, but that is not the same thing as a professional review. Size your positions accordingly.