Security

What the owner can do

• Set the underwriter key, which signs ceilings.
• Propose a staking address (first one at once, later ones after two days).
• Transfer ownership in two steps.

What nobody can do

• Move a lender's deposit, a lender's repayments, or USDG waiting in an inbox anywhere other than where the rules send it.
• Change a line's terms after it is opened.
• Redirect an x402 payment: the EIP-3009 authorization names the inbox as recipient.

Trust in the underwriter

The underwriter signs a ceiling computed from public data with a published formula. A wrong signature can let an agent ask for more than it should, but cannot take anyone's money: lenders still choose what to fund, and every agent page shows the data behind its line.

Failed payouts

If a USDG transfer to an agent's payout address fails, the amount is kept for that address and it can withdraw it with withdrawPending(). Settlement never blocks lenders.