No custody
Both legs are bought into your wallet. TRUSS holds no address with user funds and no contract that can move them.
Security model
The design refuses custody. If a path would let TRUSS move your assets, it is out of scope.
Signed rebalances
Every rebalance requires your signature. Nothing trades automatically in the background.
Consensus prices only
Trades use liquidity-weighted Dexscreener consensus across deep pools. No deep pool means no trade. Never a guess.
No leverage path
No borrowing, no liquidations, no margin. The multiplier ceiling is enforced in allocate(), not only in the UI.
Before any deploy
- security-reviewer agent on the rebalance path
- Session gate + holiday calendar covered by tests
- Ticket cap asserts SGOV binds first on large size
- Multiplier ceiling throws above MAX_MULTIPLIER = 8