Security model
What the owner can and cannot do
Most staking sites answer this with a promise. Here the answer is in the contract, and you can check every line below against the verified source.
Live governance state
Read straight from the contract, not a status page someone updates by hand.
- Voting body
- 0 members
- Owner
- —
- Recovery wallet
- —
- Liquid balance
- — USDT
The owner can
Take a disclosed fee on every deposit
The fee falls with deposit size: 12% under 500 USDT, 10% from 500, 7% from 2,500, 5% from 10,000. It is split evenly between two development wallets and taken before the stake is recorded, so your stake is credited net. The deposit screen shows the exact split before you sign, and the schedule is compiled into the contract with no function to change it.
Collect protocol fees on claims
10% of every yield claim goes to two fee wallets, halved to 5% on the Advanced and Elite plans, plus a capped share of any strategy profit. The owner chooses those addresses but the owner address itself receives nothing. This is how the project makes money, and the contract caps how much it can take.
Deploy up to 20% into Polymarket
The collateral becomes outcome tokens held by the contract. It never lands in anyone's wallet. The 20% cap counts everything already deployed, so it cannot be worked around by deploying repeatedly in smaller amounts.
Pause the protocol
This stops new stakes and yield claims. Early exit keeps working the whole time, so nobody gets locked in.
Blacklist an address
This blocks new stakes and claims for one address. It cannot block early exit or emergency withdrawal, so principal is never trapped. What it does cost you is access to yield you have already earned but not claimed.
The owner cannot
Withdraw principal to a wallet
There is no such function. Money leaves the contract in three ways: to the staker who earned it, to the fee wallets for fees already charged, and as the capped profit fee. There is no withdraw-a-percentage-of-the-pool function at any size, whatever it might be called.
Spend the fee balance as if it were pool capital
Collected fees are counted separately and subtracted inside totalAssets(). Fee income never gets counted as pool capital, and withdrawing a fee cannot reach a staker's principal.
Raise the deposit fee after you deposit
Both rates were fixed when the contract was deployed, under a hard 20% ceiling checked at that moment. Whatever rate you were shown is the rate the contract will always charge.
Bill principal as profit
The performance fee applies only to what comes back above the principal that went out, and that principal counter is reduced by whatever is actually recovered. Splitting a redemption across several calls cannot invent profit that was not made.
Sweep funds without partners and a delay
A fund rescue needs three votes from the body of the owner plus registered partners, and then a 48-hour wait enforced on-chain. While any vote is outstanding, the destination address cannot be changed.
Override a partner vote
The owner holds one vote in that body and cannot outvote it. They cannot unpause their way out of emergency mode, and they cannot add or remove partners while a vote is running.
The race that protects you
If the voting body ever moves to sweep the pool, you get a 36-hour head start. Both clocks run on-chain and both start from the same vote.
- 1
Hour 0
Quorum reached
Three votes have been cast. The protocol pauses straight away and no new capital goes into the strategy.
- 2
Hour 12
Your withdrawal opens
Emergency withdrawal opens for everyone. Full principal, no penalty, no permission needed.
- 3
Hour 48
Earliest possible sweep
Only now can a rescue go through, and only to the recovery wallet that was locked in when the vote started.
Known limitations
A page that only lists strengths is an advert. These are the parts we would want to know about before depositing.
The owner is a single key, not a multisig
A Gnosis Safe or a timelock would work as owner without changing a line of code, and either would be safer. For now the partner vote is what stands in for it.
Order-book arbitrage is not autonomous
Polymarket's order book only accepts orders from approved operators, so the contract can split, merge, and redeem after a market resolves, and nothing more. Continuous buying and selling would need an off-chain component, and we have not built one.
Staking economics are not a guarantee
The daily rates are settings in the contract, not a return the project has shown it can sustain. Yield is simple rather than compounded, and paying it depends on how the strategy performs and on money coming in.
Early exit is charged on principal, not on yield
Leaving is always possible and needs nobody's approval, but it is not free: the penalty comes off the stake itself — 50% in week 1, settling at 10% from week 5 — and unclaimed yield is lost on top. There is no penalty-free withdrawal even after the term ends. A blacklisted address can still exit, but cannot claim yield it has already earned.
Bug bounty
If you find a real vulnerability, tell us privately before you do anything else and we will pay for it. The contract has already been through Slither and a unit, fork and invariant test suite, so anything a person finds on top of that is worth paying for.
Critical
$500Any route that moves staked principal to an address other than the staker who owns it. A drain, a theft, an unauthorised sweep.
High
$150Freezing user funds, getting around a security control such as the partner quorum, the emergency-withdrawal delay or the blacklist limits, or breaking an accounting rule.
Medium
$50Accounting or logic errors that do not move funds by themselves but could add up to something that does.
Low / info
CreditGas inefficiencies, style issues, or anything already listed above as a known limitation.
How to report
Message us on Telegram at @arbhub_site with a description and, if you can, a proof of concept against a fork rather than mainnet. Tell us privately first. Posting it publicly or exploiting it on-chain before a fix is out means no reward. If two people find the same issue, the first valid report wins. The scope is the deployed contract at 0x5589105c61154f93D11aa350a25c634d5B324bFB and this frontend; known limitations listed above are out of scope.