DEPOSITS AND WITHDRAWALS

Money in is verified on-chain. Money out is claimed by you, on-chain, with a proof. In between, every token lives in an append-only ledger that survives crashes and restarts.

MONEY IN

1. You deposit stock tokens straight from your wallet: no swap, no router, no price impact.
2. Each token lands in its own Gauntlet vault contract, one vault per stock, not in some team wallet.
3. The server verifies your deposit transaction independently on-chain (right token, right vault, net amount, confirmation depth) and credits your arena balance with the same tokens, 1:1. A transaction hash can be credited once, ever.

MONEY OUT

1. You request a withdrawal of a token, signed by your wallet. No signature, no request.
2. Requests batch per epoch and per token. Each batch becomes a merkle root committed on-chain to that token's vault: one root per epoch, single use.
3. After a claim delay, you claim your own leaf with a proof. The vault pays your wallet and only your wallet: the address is inside the hashed leaf, so nobody can claim your money, and you cannot claim anyone else's.

WHY YOU CAN TRUST THE EXIT

• Solvency is a contract invariant. A root that promises more than the vault holds cannot be committed.
• The batch key is caged. The key that commits roots can do nothing else: per-epoch caps and per-wallet caps bound any batch it signs, and the claim delay is a human reaction window during which a bad root can be revoked and the vault paused by independent keys.
• Nobody can drain the pot, including us: there is no function in the contract that moves funds to the owner. Renouncing or transferring control follows a two-step process, and admin functions are gated to a multisig.
• Caps start tight at real-money launch and rise as the system earns trust. Limits protect the pot while the code proves itself in public.