What you're trusting

What the programs guarantee

The creator’s money only moves through trades. It sits in an escrow owned by the market. Traders can swap it between USDC and the market’s stocks, never withdraw it.
Traders can only trade the stocks the market allows. The allowlist is fixed when the market is created.
Every trade is checked. The fill price must be within 1% of the oracle price, one trade can use at most half of a trader’s slice, and the trader’s stake must still cover their positions after the trade.
Losses hit the stake first. At settlement, losses are taken from the trader’s collateral before the creator’s money.
Launch money stays locked. USDC that a token launch puts into a stake can back trades and can be lost to liquidation, but it can never be withdrawn.
Predictions settle from program state. No outside oracle, committee or dispute window: the final values are already on-chain.

	Today	On mainnet
Prices	Our relay posts prices from Hyperliquid and Jupiter into accounts with Pyth’s layout. The relay key could post a wrong price.	Pyth’s own price accounts; the relay goes away.
The stock venue	A stand-in for Jupiter that fills swaps from its own inventory at the posted price plus a spread.	Real xStocks through Jupiter.
The keeper	Our server starts, liquidates and settles markets. Every keeper action is also open to anyone.	Same, plus third-party keepers paid the liquidation fee.
Access	An allowlist we control.	Open.
Program upgrades	We hold the upgrade key.	A multisig, then frozen.

Nothing here has been audited. Devnet uses mock money only.