Contracts and custody
Custody sits in the pools. The Market is the allowance target and pulls the protected quote cost per fill straight through to the pool. There is no role that can mint or forge a claim.
Exits are never blocked
Withdrawals and claims remain callable in every state the protocol can be placed into: while the market is paused, while an individual pool is paused and while an address is frozen. This is deliberate. The alternative, gating exits during incidents, would mean that any operational response traps every depositor’s funds. We consider the ability to trap funds indefinitely a worse risk than the failure modes it would mitigate. The honest consequence, which we state rather than leave to be discovered: because the exit paths are never gated, they are the one surface with no operational control behind them. A defect in the exit accounting could not be contained by pausing or freezing. We treat those paths as warranting disproportionate review attention for exactly that reason.Operational controls and their delays
Pause stops new inflows and fills. It is the containment lever for an active incident, and it never affects a depositor’s ability to leave.
Role administration enforces the control lanes rather than relying on operator convention. The roles behind the timelocks cannot be granted directly by the multisig, and granting emergency-upgrade authority itself goes through the standard delayed lane. The current staging deployment exercises the same role-delay model with staging-scale delay values; production uses the full delays shown above.
Compliance freezing blocks trading only. A frozen address retains its withdrawal and claim rights.
Oracle integrity
Pricing comes from an on-chain spot oracle that derives a rate from external venues, read inside the executing transaction. Each supported quote asset also has a protected anchor reference. For buyer execution, C1 uses the higher of the live oracle reading and the anchor. A lower live reading therefore cannot create a cheap path through deposited inventory simply by moving below the protected reference. The configured anchor band governs how the anchor is allowed to move. It is not a hard execution band and an out-of-band live reading does not by itself reject a fill. Sustained market moves can propagate into the anchor subject to bounded update rules, while a move beyond the configured band must persist before the anchor follows it. If the live oracle cannot be read and a seeded anchor is available, C1 can continue quoting from that protected reference with a staleness adjustment that makes the buyer rate more conservative as the live reading remains unavailable. Quote and execution apply the same protected pricing logic. The same-block rate cache keeps fills within a block on a consistent rate path after the first oracle read. Oracle-priced designs remain exposed to sustained manipulation of the external reference market. The protected anchor is designed to defend the cheap-drain direction and constrain how quickly the protected reference follows abrupt moves, but it does not make reference-market manipulation impossible. We do not claim otherwise. There is no buyer-sideminTokensOut parameter in the direct Market interface. Partner routing can enforce route-level bounds, and integrations should use their normal maximum-input and minimum-output protections around the C1 leg.
The full oracle-manipulation analysis is available to integration partners and security reviewers on request to partnerships@flowstate.exchange with [ORACLE ANALYSIS] in the subject line, as listed on contact.
Audit status
The current rebuild is contracted for external audit with Hashlock. The engagement is in place, and fieldwork begins once the final review scope is released after the current staging observation period. The report will be published on completion. An earlier audit exists from November 2025, but it covers the predecessor system on a gas-optimisation scope and is not a review of the contracts described here.Reporting security issues
Security issues should be reported to support@flowstate.exchange with[SECURITY] in the subject line.
For high-stakes integrations, dedicated technical and risk-model collaboration is available, covering oracle alignment, depth requirements and anchor configuration.