Before any value
Security & status
What testing covers
- Per-token conservation across successful actions.
- One terminal settlement and terminal-state immutability.
- Role-authorized and permissionless clock transitions.
- Withdrawal failure isolation.
- A terminal path through verdict, challenge, timeout, lapse or mutual cancellation.
What tests do not prove
Passing contract tests does not prove criteria quality, document availability, verifier honesty, arbitrator neutrality, beneficial-owner separation or safety for real value.
Operator surface
The escrow operator can pause and unpause new deal creation and transfer the pauser role. Pausing does not stop settlement, cancellation, withdrawal or the clocks on existing deals. The escrow has no fee or general admin withdrawal function.
Threat model
| Threat | Contract response | Residual responsibility |
|---|---|---|
| Seller signature replay | Typed-data domain and consumed acceptance digest | Integrators must pin chain, contract and domain version. |
| Fee-on-transfer or short-receipt token | Opening/bond/challenge require exact received amount | Use only listed tokens with understood behavior. |
| Role impersonation | Caller checks against signed verifier/arbitrator addresses | Parties must authenticate role operators before signing. |
| Verifier or arbitrator silence | Timeout and permissionless finalization paths prevent permanent lock | Short windows can still deny a practical chance to respond. |
| Withdrawal receiver failure | Pull-based, per-beneficiary credits and partial withdrawal | Beneficiary must use a receiver that can accept the token. |
| Self-dealing history | Events preserve addresses and allocations | Indexers must disclose beneficial-owner and independence limits. |
Critical invariants
- For each token, recorded liability should remain backed by contract holdings.
- A deal reaches one terminal state and cannot settle twice.
- Settlement allocation is derived from state, verdict/ruling and posted balances, not UI labels.
- Pausing new openings cannot freeze existing settlement clocks or withdrawals.
- Only a disputed Refund ruling slashes the seller bond.
Open before production
- Independent external review of the selected source and deployment.
- Production-sized challenge and override windows.
- Verified bytecode and constructor configuration for the chosen network.
- Independent role holders and counterparty history.
- A documented response process for findings and redeployment.
Reporting a vulnerability
Use GitHub private vulnerability reporting on the source repository. Do not open a public issue containing vulnerability details.
Roadmap, not launch claims
A hosted verifier, meaningful independent reputation, standards runtime integrations, mainnet, an external audit, a revenue model and role marketplaces are deferred until each is implemented and evidenced.