Escrow identity, checked after every call
quoteEscrow = N_c
+ prefundRemaining
+ claimableQuote
+ refundableQuote
+ accruedFees
Every USDG in the contract is owed to a named party at all times. The same identity holds for stock tokens. It is asserted in every test that moves value and fuzzed as a stateful invariant.
- Per-series isolation
- A bad series cannot touch another. There is no shared pool of risk.
- Pull payments only
- Claims and refunds are withdrawn by the holder. The contract never pushes funds.
- Official closes only
- No intraday prints, no weekend prices, no oracle games. Chainlink primary, Pyth backup.
- Immutable, no proxies
- Solidity 0.8.28, OpenZeppelin v5.1.0, no upgrade path, no admin over user funds.