Trust Model - KaleidoSwap Documentation

Only the locked contract enforces a swap. Everything the maker says before and around it (prices, status updates, fee estimates, discovery cards) is information. A wrong answer from the maker can cost a failed attempt or a worse price. It cannot take funds from a swap your app verified and locked.

What binds

	Enforces	Does not
The lockup you funded	Claim with the preimage, refund after the deadline, with the keys you derived	Fair pricing, or that the maker shows up
The hold invoice you paid	Settles only when the preimage is revealed	That the other leg is ever funded (then the payment is released)
A quote or pair card	The terms you create the swap on, when you pass `pairHash`	Completion
An atomic RGB transaction	Both sides move together, or neither does	Price beyond the limits you set

What the SDK checks for you

Before it returns a created swap, the SDK rebuilds the contract from your own inputs and compares it with what the maker sent. A mismatch stops the flow before any money moves.

Input	Comes from
Your claim or refund key, your preimage	Your wallet, through `SwapMasterKey`
The maker’s key, the deadline, the amounts	The maker’s create response, checked for consistency
The lockup address	Derived by the SDK, then compared with the maker’s
The invoice’s payment hash	Compared with your preimage hash (reverse) or decoded from your invoice (submarine)
The RGB contract	The ID you pin at creation, never the maker’s word

The same applies to atomic RGB quotes: the rgb-lib offer inside a quote must move the same amounts and asset as the quote, so what your wallet signs is what you showed the user.

What your app must check

Chain state, the network, invoices you pay, and fees. Common mistakes lists each check.

What the maker controls

Whether it fills. It can decline to create, pay, or lock. Your funds then come back through the refund or the released hold.
Cooperation. It can refuse to co-sign. The script path still works after the deadline.
Re-quotes. On a chain swap it can offer a new amount, but only your swapAuth can accept it.
The pay-through payout. That leg has no lock. Use pay-through only where that is acceptable.

Liveness

Claims need your app online before the deadline; refunds after the deadline need nothing from the maker. If a claim is missed, the swap fails and both sides recover their own funds. See Swap states. Credentials and what each authorizes: Keys and recovery and Attribute swaps to your organization.