Security
Trust model
What you have to trust, and what you can check yourself.
Trust boundaries
| Party | Can | Cannot |
|---|---|---|
| Contract owner | Pause and unpause new package creation | Move, redirect or freeze any funds. The contract isn't upgradeable. |
| Relayer | Submit signed actions, expire/release when allowed, trigger payouts | Change a signed action, fund a different package, or pay a payout to anyone but the recipient |
| Agency | Build and change the package before confirmation | Release any money without the client's approval of that version and every required acceptance |
| Paxos (USDG issuer) | Pause USDG or freeze addresses, including the Setlo contract | — |
What you can verify
The contract source is verified on Sourcify for both networks. Every package, acceptance, credit and payout is an event on a public explorer.