Security
The useful question isn't whether we're trustworthy. It's what we could do if we weren't — if our key got stolen tonight, or if we turned out to be dishonest. This page answers that, then covers what's left over.
What we hold
Two things. Our own key, which your order names as the only address allowed to use it, and which pays the gas. And your signed permission, so we can submit it when the price is right. That's all. We never see or ask for a key of yours, and there's no step anywhere that would let you send us one.
What a stolen key could do
Buy you the branch you asked for, at or below your price, once, before your deadline. That's it. Everything below is blocked by a contract, not by us:
- Buy above the price you set
- Buy for a different Charter
- Buy more licences than you agreed to
- Call any contract but the auction
- Send any of your ETH anywhere
- Move, approve or sell your STANDARD
- Transfer or burn your Charter
- Act before your order opens or after it expires
- Use the order a second time
- Change any of the above after you have signed
Each of these is listed with the exact error you'd get back under how branch limit orders work.
Cancelling, and expiry
You can cancel an order at any time from your wallet, and only you can. We don't have to delete anything for an order to stop working. The contract checks the deadline, so once an order expires it can't be used even if we keep a copy of it, and even if we disappear.
Your orders are private
Until an order fills it doesn't exist on chain, and the price in it is worth money to anyone bidding against you. Anyone can look up who owns which Charter, so if we listed orders by address alone, a competitor could read everyone's prices. To see your orders you sign a message proving the address is yours. It lasts 15 minutes, costs no gas, and permits nothing.
What is audited, and what is not
Every contract that enforces your order is MetaMask's, and we use them unchanged. Cyfrin and Consensys Diligence have audited them, and the reports are published with the code: delegation-framework/auditsgithub.com ↗.
The way we have assembled them has not been audited by anyone independent. We haven't written any contracts, which rules out the biggest category of risk. But picking the wrong conditions, or wiring them together badly, is still a way to get this wrong, and nobody outside the project has checked that we didn't.
Checking it yourself
We test these claims against the real contracts rather than just stating them. The test builds a genuine order, signs it, and simulates the whole purchase against the live auction. Then it tries every way we might bend the order — a higher price, a different Charter, another contract, no fee — and checks that each attempt is blocked by the right contract. Eighteen checks in all. It only reads from the chain, so it can be run against mainnet at any time without spending anything.
There's a simpler check too: every contract address is listed under contracts, and the permission you sign is readable in your wallet before you sign it.
What you still have to trust
Non-custodial doesn't mean you trust nobody. It means we're not the ones holding your assets. You do still rely on four things:
- MetaMask's contracts, which others have audited and we use unchanged.
- Standard Reserve's contracts, which we didn't write and don't control.
- The way we've put them together, which isn't audited. It's described here in full so you can judge it yourself.
- Our watcher, but only to turn up. It can't act outside the conditions, so the worst it can do is fail to buy. Your order then expires and costs you nothing.