Security

Invariants

Non-custodial wallets
No secret material in frontend or logs
Validators enforce assets, payments, addresses and time
One payment output cannot satisfy two escrow inputs
Legacy contracts remain spendable
Upgrades use new addresses

Required adversarial tests

Two inputs, one payment
Missing or wrong payment tag
Wrong payout offset
Partial bundle
Duplicate assets or entries
Fake or extra UTxO
Unexpected dust assets
Wrong staking credential
Time-bound abuse
Replay
Min/max count violations
Stranded value

Operations

Provider calls must use the central batcher and budget. The Discord bot has no wallet or database access.