Security model
The product cannot move your bonds. If a design requires custody, it is out of scope for this MVP.
No custody
SGOV is bought into your wallet. Rungs are schedule records. There is no address holding user funds and no contract that can move them.
Signature required
Every maturity needs your signature. Automatic settlement is banned. Roll is also a signed action.
Guardrails at swap time
Consensus price only. Market sessions only. Ticket cap enforced. Slippage disclosed before the signature prompt.
Out of scope
- Vaults, ERC-4626, third-party fund custody
- Routing through SHY
- Leverage or borrowing against rungs
- Auto-compound via third-party protocols
- Fiat on-ramp or off-ramp
- Automatic settlement without signature