Unrecognised programNewVen…111111
Per-trade cap10.00 SOL
Proposed
The one power worth attacking
Who can move a bot's money
Only an approved venue — a market program — can debit a bot's vault, and only with the attestor's co-signature and within a per-trade cap. Approving one is deliberately slow and public, because a malicious venue would drain every vault on the platform.
Example recordsThe venue registry, its timelock and the per-trade caps are built and tested on chain. This deployment is not reading them, so the entries below are illustrative.
1 approval pending
The delay before a venue can be activated exists for one reason: it is your window to look at what is being approved and, if you do not like it, withdraw your bots first. Once a venue is active it can debit any vault, up to its cap, on any order the attestor co-signs.
Active
botfamily-marketBFMark…111111
Per-trade cap25.00 SOL
Active
Revoked
botfamily-market (v1)01dVen…111111
Per-trade cap5.00 SOL
Revoked
How this is bounded
- Who approves
- The protocol authority, in two steps
- How fast
- Never immediately — a proposal waits out the delay
- What a venue can do
- Debit a vault, up to its cap, per trade
- What it still needs
- The attestor's co-signature on every order
- Lowering a cap
- Immediate — only raising one should wait
- Revoking
- Immediate
A venue never holds custody authority. It asks the core program for money and core decides — checking the co-signature, this venue's approval and its cap — which is why a bug in market logic cannot drain a bot. How the two programs split.