Security and trust

What the programs guarantee

No swap while halted. swap reads HaltState.halted and fails with Halted before any quote or transfer. Test: harness/tests/halt.rs.
No swap past the cap. record_execution refuses the crossing fill (ExceedsMonthlyCap) and enforces the 1 percent fill limit past 90 percent (Throttled). Symbol limits are enforced at listing with no grace. Test: harness/tests/caps.rs.
No unlisted wallet trades or provides liquidity. Every money instruction requires an admitted Participant, and the issuer's freeze authority keeps every account the transfer agent has not thawed frozen; create_pool refuses a mint with neither that gate nor a transfer hook (NoIssuerGate). Test: harness/tests/access.rs.
No borrowing path. The venue program has no instruction that lends, borrows, or pays out more than the pool's own reserves; remove_liquidity is pro rata and collect_fees can only move what venue_fee_stock and venue_fee_quote record (Insolvent otherwise).
Pool solvency under fuzz. math::quote never lowers the constant product once the venue fee is set aside, and venue_fee <= fee <= amount_in. Property tests in floor_venue/src/math.rs and harness/tests/fuzz.rs.
Timer rules. A third-party token opens strictly after notice_sent_at + 30 days; a timely objection bars it for good; a late objection is refused (ObjectionWindowClosed) so the record cannot be rewritten after the fact. Test: harness/tests/notice.rs.
Keeper rules. Votes are per keeper, per proposal, per keeper epoch; sequence numbers prevent replay and reordering of halt events; ADV can only be posted for a finished month and never for an older month than the one on record.

Who can do what

The venue authority can pause and set fees up to the 10 percent ceiling in code (MAX_FEE_BPS = 1_000); it cannot touch vault balances except through the fee recipient path, and the fee recipient must itself be on the issuer's allowlist for the stock leg. The caps authority can list, unlist, pause and declare a breach; it cannot change the cap percentages, which are constants. No authority can post a halt or an ADV alone when the keeper threshold is above one.

The upgrade authority of each program is a keypair the operator holds until a multisig takes it; it is published on the disclosures page, as the order requires. Programs are never made final by burning the key.

What is off chain and must be trusted

Fact	Source	Failure mode	Mitigation
Primary-market halt	Nasdaq Trader halts feed, CTA notices, read by keepers	A keeper posts late or wrongly	Threshold voting, sequence numbers, the venue authority's pause as a backstop, a public comparison on the landing board
Prior-month consolidated ADV	NYSE Consolidated Volume Summary (licensed), read by keepers	Wrong or revised figure	Threshold voting, a revision that puts the month over the cap triggers a breach record
Issuer notice date and objection	The operator's correspondence with the issuer	Operator error	The record is written once; objections cannot be lifted on chain
The rights test for a token	The operator's legal review	Listing a token that does not pass	Only issuer-sponsored tokens are listed today

What the venue cannot promise

That a pool price tracks the primary market. Pools price on their reserves; there is no NBBO, and the pricing model is disclosed as such.
That an allowlisted wallet keeps its status. The issuer may freeze the account again at any time, and the venue has no say.
That the SEC agrees with every reading of the order. FLOOR follows the conditions as published and summarized by counsel; the operator remains responsible for compliance.

Reporting

Report a problem in the programs or the site to the operator through the X account linked in the footer. Keep details private until a fix is deployed.