Who can do what,
in full.

clava is one Solana program, cLvjeQgjRy9E6w9YzPHHd8r7XjfEr4UywuqjM17VPdP, not yet deployed to mainnet. Once live, it holds each vault’s tokens in an account only the program itself can sign for. No person holds a key that can move collateral or pool funds directly.

It has not been independently audited. It has an automated test suite (positions, fees, caps, liquidations, take profit, stop loss, pool deposits and withdrawals, and a random-walk check that the books always balance), which is not the same thing.

Can: replace the program’s code. That is the largest trust you place in us: new code could in principle do anything the program can do.

Our promise: every upgrade is announced on @joinclava before it happens, with what changes. We intend to put the key behind a multisig and then a timelock as the venue grows.

Can: list markets; change a market’s spread, carry, leverage and open-interest cap within caps written into the program (spread at most 5%, carry at most 0.1% a day, leverage at most 20×), including for trades already open; pause new trades; rotate the oracle key; and claim the protocol’s 20% share of fees.

Cannot: move your collateral, move pool funds, close or liquidate your trade, or stop you closing. Closing, take profit, stop loss and liquidation always work while a price is available.

HRw9fUQjPwszaSghfLRBuCkVJrhPD51MpHSxpM57akeo

Can: sign prices. The program accepts a price only if this key signed it, and only the newest one counts.

Cannot: move funds. But a wrong or late price would be acted on, so the oracle cross-checks: crypto needs two of Coinbase, Kraken and Bitstamp to agree within 1%; stocks, currencies and metals come from CNBC and only while the market is open; predictions from Polymarket’s order book. If the key were lost, the admin key can rotate it.

Your wallet and its keys. You sign every transaction yourself. We never see your private key and cannot move, recover or reverse anything you send. A confirmed transaction on Solana is final.

The collateral tokens are issued by Ondo (USDY), Jupiter Lend (jlUSDC) and Maple (syrupUSDC). Their issuers can freeze or change them, and their yields can fall. Swaps run through Jupiter. clava does not control any of them.

Write to hello@joinclava.markets with “Security” in the subject. Please do not test against other people’s funds or post details publicly before we have answered. We reply within two working days. Our security.txt has the same details.