Security and custody
Common questions about custody and failure handling.
Who holds user funds? The user. Funds move from the user's wallet into a contract escrow whose release rules are cryptographic, and from the escrow to their destination. There is no deposit endpoint anywhere in the system.
Who holds the desk's funds? Three tiers. Working capital sits in hot wallets whose keys live in a cloud secrets vault, monitored through read-only viewing keys. Hedge collateral sits on exchanges, continuously polled and budget-capped. Everything else sits in cold storage on hardware the system has no connection to, and moves only when an operator signs on their own machine.
What if Abyss goes down mid-trade? The escrow's deadline refunds the user automatically. That refund path does not depend on Abyss, so no Abyss action is needed to make the user whole.
What if a hedge exchange fails? The desk's collateral on that venue is at risk (a known, accepted exposure; custody-delegated collateral is on the roadmap to remove it), but user funds are untouched, that venue's budgets collapse automatically, and quoting against it stops within one cycle.
What if a price feed lies? One lying feed is outvoted and excluded by the sanity gates. If the desk cannot form a confident price, it stops quoting. The double sample and fill-time drift check bound the damage of a fast market between quote and fill.
What if an operator errs? Multi-factor login; three permission tiers; a written reason on every mutation; staged settings with a visible countdown before they go live; hard caps and auto-expiries on the sensitive parameters; and the highest-risk parameters are not live-tunable at all.
What if Abyss's own code has a bug? Defense in depth: admission checks run twice in independent services, an order can be filled only once by construction, hedges are reconciled against exchange records, monitoring uses keys that cannot spend, and the breakers do not depend on the code paths they protect.
Who can see a user's trading? Midnight's shielded transactions keep balances and transfers private. Pricing happens off-chain, so there is no public order flow to observe pre-settlement.