What a stranger can check.

The programmainnet-beta

What Meridian's servers can and cannot doevery save is checked by the program

• Cannot choose the amount. The program computes the slice from on-chain state.
• Cannot skip the check. begin_sweep refuses unless a finish_sweep for the same register and release follows in the same transaction.
• Must deliver the minimum. The owner’s own token account must gain at least the slice’s worth at Pyth’s price net of confidence, less the owner’s tolerance (1% by default), or the whole sweep reverts.
• Are trusted for the rest of the slice, for now. The program checks that minimum, not the whole slice, so a submitter that delivered only the minimum could keep the rest: about the owner’s tolerance plus Pyth’s band, plus any move in the ten minutes a price stays valid. Meridian’s servers swap the whole slice into the owner’s account. Requiring that on chain is the first change in the next program upgrade.
• Are paid a fixed fee for submitting each save, plus the receipt’s rent, from the saver’s prepaid saves. The same for a vest, from the grant’s float.

The team's own walletsmarked on every stub

Receipts to these wallets are Meridian paying itself or its founder testing the product. The ledger marks their stubs “team”, and every count of people reached leaves them out.

What the escrow can and cannot do

• Meridian holds an asset only in an escrow the payer created, that the recipient can see, and that the payer cannot spend.
• A payment’s escrow exists for one transaction, or until a first share is claimed; a gift nobody claims returns to the payer after thirty days.
• A grant’s escrow releases on the schedule, to the recipient, or the unvested part back to the payer on a revoke. No instruction sends it anywhere else.
• The rule never holds anything: the owner’s USDC and stock sit in the owner’s own accounts; the delegate allowance is the owner’s to revoke.

What is not done, said plainly

• No audit. No verifiable build yet. The upgrade authority is a key.
• The legal shape — grants of securities-backed tokens on a schedule, executed automatically, non-custodial in design — has not been reviewed by a lawyer.
• xStocks carry a permanent delegate and a pause authority: the issuer can move, burn or freeze. Self-custody here means not our custody.

Bug bountypaid in stock

Break the claim flow, take a sponsored position twice, vest more than the schedule, or move an escrow anywhere but where the program says: a write-up with a signature, and a failing test if you can. Paid through /bounties, in SPYx, with a receipt that says what you found.