Security and control of funds

You sign your own exchange actions. Windup does not need your seed phrase or private key.

Funds move into specific contracts when you use the product: the factory holds creator bonds, the curve holds launch inventory and raised USDC, the pool holds swap reserves, and the market holds lending inventory and position collateral.

The exchange operator can publish trusted prices and initiate eligible liquidations. The treasury receives the fees listed above. The exchange contracts do not give either role an arbitrary withdrawal function over creator bonds or position collateral.

The treasury is a Safe currently configured with one owner and a one-signature threshold. It does not currently require approval by multiple independent signers.

Other dependencies include Elysium, HyperEVM, the Inbox, the supported USDC contract and its upgradeable implementation, RPC availability and the pricing/liquidation service. Windup checks deployed code and contract relationships. A changed or unavailable dependency can prevent a quote or transaction from proceeding.

The contracts have undergone internal automated and integration tests. These checks are not an independent security audit. Market liquidity, operator failures and contract defects can still cause losses.

There is no exchange-wide admin pause that freezes every onchain action. A disabled website action does not necessarily prevent direct contract calls. Do not send tokens directly to a curve, pool or market in place of calling its deposit or trade function: a direct transfer may not create a credited balance and may be unrecoverable.