> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kaleidoswap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Model

> What the Swap SDK verifies, what the KaleidoSwap maker controls, what binds once funds are locked, and what your app must check itself

**Only the locked contract enforces a swap.** Everything the maker says before and around it (prices, status updates, fee estimates, discovery cards) is information. A wrong answer from the maker can cost a failed attempt or a worse price. It cannot take funds from a swap your app verified and locked.

## What binds

| | Enforces | Does not |
| - | - | - |
| **The lockup you funded** | Claim with the preimage, refund after the deadline, with the keys you derived | Fair pricing, or that the maker shows up |
| **The hold invoice you paid** | Settles only when the preimage is revealed | That the other leg is ever funded (then the payment is released) |
| **A quote or pair card** | The terms you create the swap on, when you pass `pairHash` | Completion |
| **An atomic RGB transaction** | Both sides move together, or neither does | Price beyond the limits you set |

## What the SDK checks for you

Before it returns a created swap, the SDK rebuilds the contract from your own inputs and compares it with what the maker sent. A mismatch stops the flow before any money moves.

| Input | Comes from |
| - | - |
| Your claim or refund key, your preimage | Your wallet, through `SwapMasterKey` |
| The maker's key, the deadline, the amounts | The maker's create response, checked for consistency |
| The lockup address | Derived by the SDK, then compared with the maker's |
| The invoice's payment hash | Compared with your preimage hash (reverse) or decoded from your invoice (submarine) |
| The RGB contract | The ID you pin at creation, never the maker's word |

The same applies to atomic RGB quotes: the rgb-lib offer inside a quote must move the same amounts and asset as the quote, so what your wallet signs is what you showed the user.

## What your app must check

Chain state, the network, invoices you pay, and fees. [Common mistakes](https://docs.kaleidoswap.com/sdk/common-mistakes.md) lists each check.

## What the maker controls

* **Whether it fills.** It can decline to create, pay, or lock. Your funds then come back through the refund or the released hold.
* **Cooperation.** It can refuse to co-sign. The script path still works after the deadline.
* **Re-quotes.** On a chain swap it can offer a new amount, but only your `swapAuth` can accept it.
* **The pay-through payout.** That leg has no lock. Use pay-through only where that is acceptable.

## Liveness

Claims need your app online before the deadline; refunds after the deadline need nothing from the maker. If a claim is missed, the swap fails and both sides recover their own funds. See [Swap states](https://docs.kaleidoswap.com/sdk/swap-states.md#deadlines).

Credentials and what each authorizes: [Keys and recovery](https://docs.kaleidoswap.com/sdk/keys-and-recovery.md#swapauth-store-it-with-the-swap) and [Attribute swaps to your organization](https://docs.kaleidoswap.com/sdk/partner-attribution.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.