Method

How a contract works

What the platform guarantees technically, under which conditions, what it does not guarantee, and what you can check for yourself on-chain.

Sign-in

A signed message, no password: The server generates a unique message (domain, nonce, 5-minute expiry). Your wallet signs it; the server checks the signature against its own copy of the message. A message can be used once.
Session: HttpOnly, SameSite=Strict cookie, valid for 12 hours, revoked on sign-out. The server only keeps a fingerprint of it. If you switch accounts in Phantom, the session closes.
What the signature does not allow: The sign-in signature allows no transfer. Only a transaction you approve in Phantom can move SOL out of your wallet.

Terms frozen and written on-chain: Program, amount, duration, network, recipient and the offer window are frozen before the deposit. Their fingerprint (sha256) is written in a memo of your transaction, signed by you. Terms that do not match that fingerprint are never used.
Checked before you sign: Before Phantom opens, this page checks that the transaction contains exactly one transfer of the agreed amount from your wallet to the recipient shown, plus the contract memo, and nothing else.
Every deposit is accounted for: The executor reads the collection wallet's history directly from the blockchain, page by page, without relying on the website. Each incoming transfer is either credited to its contract or queued for a refund to its sender. Refunds require signed operator approval; no processing charge is deducted from an approved refund. Transfers below the minimum refund threshold are recorded but not refunded.
When a deposit is refunded: If it lands more than 12 minutes after the offer was made, if the program is full or your wallet's cap is reached when it lands, if it pays an offer already funded, or if it does not match its signed terms. The operator reviews the refund before it is sent; you do not need to send another transaction.

No early withdrawal: The countdown starts at the time recorded on-chain for your deposit. Nothing can be withdrawn before maturity.
A ledger, not a trader: The platform keeps the record: who deposited what, when, for how long. It does not communicate with the trading system.

Humans set the amount, with signed approvals: At maturity, a named reviewer signs an approval with their own key, binding the contract, your deposit transaction, your address, the amount and the network. The operator can require two different reviewers above a set amount. If an AI is asked for an opinion, it decides nothing and cannot pay anything.
What can authorize a payment: Only valid signatures from reviewer keys listed in the executor's own configuration. A record written into a database is not an authorization: before paying, the executor re-checks the signatures and re-reads your deposit on-chain.
To you, and nobody else: The payout goes to the address that made the deposit. Payouts are capped over any 24 hours.
No double payment, enforced on-chain: Every attempt to pay you also creates the same small marker account on Solana, derived from the payout. The network refuses to create an account that already exists, so at most one attempt can ever succeed, even if a server crashes, a connection drops or a retry happens. The marker is public proof that the payment was made.
Correcting a review: If reviewers sign different amounts, nothing is paid. A reviewer signs a new review round; earlier signatures stay on record but no longer count.

Bound by your signature: If you add a referral code before your first deposit, the referrer's address is written into the terms you sign with that deposit. It binds once, on your first credited contract, and never changes afterwards.
Paid by the executor, from verified deposits: The referrer receives 12% of each of your deposits: half when the deposit is credited, half 61 days later if they have a contract of their own by then. It does not change your contract or the amount returned to you.

The returned amount is not guaranteed: It is set by the reviewers at maturity. It may be higher or lower than your deposit. The contract promises no amount.
The operator controls the collection wallet: The website holds no key and never opens the executor's records, so a website breach alone cannot authorize a payment or empty the wallet. That separation holds only if the website and the executor run under separate accounts with separate files, as the deployment guide requires. The operator, however, holds the collection key: the payout rests on the operator's commitment, not on an on-chain program that would enforce it. The memo proves the terms and the deposit date; it does not lock the funds.

The returned amount may be lower than the deposit, down to zero.
If the collection wallet lacks funds at maturity, the payment waits until the operator brings them back.
A review can be put on hold; the reason is shown to you.
Collecting third-party money is a regulated activity. On mainnet, deposits stay closed until the legal framework is in place.