Security and trust
What the chain enforces, and whom you still trust.
Enforced by the program, with the tests that prove it
| Wall | Tests |
|---|---|
| No path moves pool assets to an arbitrary address | redeem_cannot_pay_someone_else_or_more_than_owned, execute_refuses_output_sent_elsewhere, execute_refuses_unlisted_route_programs, execute_refuses_draining_a_vault_the_order_does_not_sell, no_instruction_moves_assets_without_burning_shares_or_a_checked_trade |
| Only the cluster can rebalance | a hand-made decide_callback with a fake signature fails on the localnet; strangers cannot set rules or create computation definitions (Unauthorized) |
| The bands bind | execute_refuses_quiet_expired_and_oversized_orders, turnover_cap_binds_within_a_day_and_resets_the_next, execute_refuses_a_fill_worse_than_the_slippage_band, localnet TurnoverCapExceeded |
| Redemption stays solvent | fuzz_redemption_solvency (64 seeds x 400 random steps; no payout above the exact pro-rata claim; the last holder empties the pool), donation_attack_does_not_pay |
| Confidential mint and burn reconcile | confidential_round_trip_and_pro_rata_redeem (supply equals the sum of decrypted balances before and after) |
Who you still trust
| Who | Can | Cannot |
|---|---|---|
| Arcium's mainnet cluster (3 nodes today) | read the rules only if all three collude; stop answering, so no new orders | move assets; sign an order that breaks the bands |
| Arcium's program upgrade authority | change the cluster's signing key and so sign orders | exceed 20% turnover a day or 0.5% slippage a trade |
| Pyth | misprice within 1% confidence and 120 s of age | be swapped for another account |
| Kamino Scope | misprice the stocks and gold within 120 s of age | be swapped for another account or slot |
| Orca or Jupiter | give a bad fill | deliver less than 99.5% of value, touch another vault, change vault authorities |
| Circle and Coinbase | freeze the USDC and cbBTC vaults | anything else |
| Backed, the xStocks issuer | freeze or pause the NVDAx, SPYx and TSLAx vaults, or move tokens out of them; while xStock transfers are paused, redemptions wait | anything else |
| Tether | freeze the XAUt0 vault | anything else |
| The fund authority | pause deposits, decisions and trades; schedule new rules (public, seven-day delay); hand over the role | pause redemptions, change parameters, routes, assets or the fee account, mint shares |
| The rules author | know their own rules and trade ahead of orders within the bands | change rules silently |
| This program's upgrade authority | replace the program | nothing; it is meant to sit in a multisig with a timelock |
| Any keeper | choose when to ask and which route to use, and keep up to 0.5% a trade as fill quality | trade without an order, outside the bands, or twice on one order |
What confidentiality means exactly
The confidential transfer extension hides amounts. It does not hide accounts, that a transfer happened, the deposit itself, or the redemption itself. A holder's first balance can be read from their deposit; after that, transfers between holders and the running balance cannot be totalled by an observer. There is no auditor key, and the mint's configuration makes it impossible to add one.
The rule set's inputs are secret-shared across Arcium's nodes. Its outputs are orders, and orders are public, so an observer can study the trade pattern.
What this is not
UNLIT is not registered with, licensed by or approved by any regulator, and nothing on the site or in these docs is investment advice. The blind-trust comparison describes a mechanism, not a legal status.