> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rondo.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> How Rondo protects escrow, atomic settlement and transaction bounds.

Rondo combines escrow-backed orders, atomic settlement and explicit transaction bounds. This page
explains the protections that users and integrations can verify.

## Enforced by the contracts

<CardGroup cols={2}>
  <Card title="Escrow-backed orders" icon="vault">
    Offered funds arrive before an order is indexed. The received balance delta must equal the
    requested amount.
  </Card>

  <Card title="Atomic settlement" icon="link">
    Payment and escrow release share one transaction. A revert rolls both transfers and all state
    changes back.
  </Card>

  <Card title="Bounded prices" icon="shield">
    Takers set `maxAmountIn`; PEG makers store `minRate`. A fill outside either bound reverts.
  </Card>

  <Card title="Escrow-separated fees" icon="scale-balanced">
    Protocol fee accounting is isolated from the remainder owed to open orders.
  </Card>
</CardGroup>

The invariant behind the last claim is:

```text theme={"system"}
token.balanceOf(Rondo) ≥ open-order escrow for token + accruedFees[token]
```

It can be checked externally with
[`lens.totalEscrowed`](/reference/lens#totalescrowed-—-the-solvency-check).

## External dependencies

### Orakl price feed

PEG creation and filling depend on a positive, fresh five-minute Orakl average containing at least
five observations. A stale latest observation or an unavailable average stops those paths; fixed
fills continue because their ratio is already stored. `priceScale` is derived from the configured
feed's decimals.

The maker's absolute `minRate` is the last bound on a PEG fill. It protects the settled payment
rather than merely checking the reported oracle answer.

### Base tokens and USDT

Each market depends on successful transfers of its selected base token (JPYC, IDRX, or IDRP) and
Kaia USDT. If a token transfer is unavailable, the associated create, fill or refund cannot
complete even though the Rondo function remains callable.

An unsuccessful refund leaves the order open so its accounting remains intact.

## Failure behaviour

| Condition                                       | Fixed fill       | PEG fill         | Create order     | Cancel / expire             |
| ----------------------------------------------- | ---------------- | ---------------- | ---------------- | --------------------------- |
| Protocol paused                                 | Blocked          | Blocked          | Blocked          | Available at protocol level |
| Oracle stale or five-minute average unavailable | Available        | Blocked          | Blocked          | Available at protocol level |
| PEG below maker floor                           | —                | Blocked          | —                | Available at protocol level |
| Token rejects transfer                          | Transfer reverts | Transfer reverts | Transfer reverts | Refund does not complete    |

## Before integrating or trading

* Read addresses from [Deployments](/reference/deployments) and verify the selected market.
* Read `paused`, `takerWhitelistEnabled`, oracle freshness and current configuration on-chain.
* Treat `previewFill` as pricing, not a complete dry run; use the lens or reproduce all surrounding guards.
* Recheck the live ticket immediately before signing a PEG fill.

<Note>
  The application is labelled **beta**. That label is a deployment-stage disclosure, not an on-chain
  guard: contracts continue to execute exactly as called.
</Note>