Risks

What the admin can do

• Pause new orders. Orders already committed still open, settle and pay out.
• Disable a market, or change its guard. Orders in a disabled market sit out and get their bond back.
• Set the keeper address. The keeper has no special power: every instruction it sends is open to anyone.
• Withdraw the treasury share of fees.
• Upgrade the program. The upgrade authority is kept for now, so bugs can be fixed quickly; it will be handed over or revoked and announced on X.

What the admin cannot do

Move a balance. No instruction lets the admin touch a user's free or locked funds, a stake, or a pending reward.

What Blackpool depends on

• drand. Orders are encrypted to a drand quicknet round. If the beacon stalls, orders cannot be opened by the keeper; you can still open your own from the app during the reveal window, or it closes without trading.
• The keeper. If no keeper runs, nothing is lost: anyone can sample, open, finalize and claim, but an order nobody opens in time keeps its bond.
• The pools. Prices come from Orca and Raydium pools. Moving a pool for the whole commit window costs real money, the mean of several samples dilutes a short move, and the guard voids a batch whose samples spread too far.
• The xStocks issuer. xStocks are issued as Token-2022 tokens with a permanent delegate and a pause held by their issuer. The issuer can freeze transfers or move tokens, including the ones in Blackpool's vault.
• Timing. The drand round is aimed at the end of the batch from the measured slot time. If slots run slower than measured, an order can be readable a few seconds before its batch closes.

Audits

The program is not audited. It has unit tests and LiteSVM integration tests, including a randomized solvency test, and was run end to end on a local validator with real drand encryption. Use amounts you can afford to lose.