Security
What a stranger can check.
The program is the rule and the record, never the vault. Everything below is a fact read from the chain or the build, or a sentence about what is not yet done.
The programdevnet
Fbp8fBdCnT8Pv1g5vJ8brPZm1U4yWLtUsEtoac8A16gj · deployed and executable
8agi582Xfi2cMBrQ4Tmb5JwAeDARhmigRgcezKiur12B · 640,000 bytes of ELF · last deployed at slot 499,325,517
FKfq2AUUKWgubVtQ8ixyfR7zy5qEweqrzQrJqd2owoJb — a key, the deployer’s, until the multisig. A multisig, then a freeze, is the plan after Stocklana; until then the program can be changed by that key and this page will say so.
the built artefact is not on this host; the hash is published with each deploy
The docs describe every instruction; the repository is public and the IDL is committed.
What a keeper can and cannot do
- Cannot choose the amount. The program computes the slice from on-chain state.
- Cannot skip the check. begin_sweep refuses unless a finish_sweep for the same register and release follows in the same transaction.
- Cannot redirect the output. The owner’s own token account is verified before and after.
- Only discretion: the route, inside the owner’s tolerance against Pyth’s price net of confidence.
- Only reward: the tip, 0.0005 SOL plus the receipt’s rent, from the owner’s float. The same for a vest, from the grant’s float.
What the escrow can and cannot do
- Scrip holds an asset only in an escrow the payer created, that the recipient can see, and that the payer cannot spend.
- A payment’s escrow exists for one transaction, or until a first share is claimed; a gift nobody claims returns to the payer after thirty days.
- A grant’s escrow releases on the schedule, to the recipient, or the unvested part back to the payer on a revoke. No instruction sends it anywhere else.
- The rule never holds anything: the owner’s USDC and stock sit in the owner’s own accounts; the delegate allowance is the owner’s to revoke.
What is not done, said plainly
- No audit. No verifiable build yet. The upgrade authority is a key.
- The legal shape — grants of securities-backed tokens on a schedule, executed by third-party keepers, non-custodial in design — has not been reviewed by a lawyer.
- xStocks carry a permanent delegate and a pause authority: the issuer can move, burn or freeze. Self-custody here means not our custody.
Bug bountypaid in stock
Break the claim flow, take a sponsored position twice, vest more than the schedule, or move an escrow anywhere but where the program says: a write-up with a signature, and a failing test if you can. Paid through /bounties, in SPYx, with a receipt that says what you found.