What the contract guarantees

This page separates what the Blackpool contract enforces from what it does not. If something is not on the first list, do not assume it.

Guaranteed by the code

Sealed during commit. While a batch takes orders, the chain holds only your commitment hash and a fixed 1 USDG bond. Market, side, size and limit are not on-chain.
One price per batch. Every crossed order in a batch fills at the same midpoint, read from the market's Uniswap V4 pool in the settlement block.
Your limit holds. A buy never fills above its limit, a sell never below.
No fill at a moved price. If the settlement midpoint is further from the batch's sampled average than the market's guard, the batch is voided and every order is returned.
No fill at a stale price. A batch not settled within 26 blocks of its reveal window is voided.
Unfilled size comes back. Whatever does not cross is returned to your free vault balance in the settlement call.
Free balance is withdrawable. No phase, pause or owner action can stop the withdrawal of a balance not locked in an open order.
Solvency. Settlement rounds every division toward the venue and asserts that it pays out no more than it takes in.
Fee ceiling and delay. The fee can never exceed 0.50 %, and a change waits 48 hours.

Privacy after reveal. A revealed order is public for up to 5 blocks of the reveal window plus the time until settlement.
Privacy of balances. Deposits and withdrawals are ordinary token transfers. Someone who watches your vault balance can guess at your intent.
That you are trading. A commitment is visible, so the fact that an address is about to trade is public.
A fill. Blackpool has no liquidity of its own. Size only crosses if the other side is in the same batch.
The listing venue price. Fills are at the on-chain pool midpoint, which can differ from Nasdaq or NYSE.
The stock tokens themselves. Their issuer can pause them or block an address. See Risks.