How it works
- Staked
$SGLlives in a program-owned vault whose authority is a Program-Derived Address (PDA) — not a private key anyone holds. - Only the staking program can move tokens out of the vault, and the only path that returns principal sends it to the original staker, after the cooldown.
- There is no instruction that lets the platform sweep your principal to itself.
What the platform can do
To be precise about trust boundaries, the privileged keys can:- Deposit rewards (funding the pool from the platform’s own funds — additive only).
- Update parameters like minimums and cooldowns (which can’t retroactively extend an in-progress unstake — see Cooldowns).
- Pause the program in an emergency — but pausing never blocks unstaking, withdrawing, or claiming.
- Slash — and only under strict limits. See Slashing and What’s Never Slashed.
What the platform cannot do
- It cannot transfer your staked principal to itself or any third party.
- It cannot block your exit or your claims.
- It cannot retroactively change the cooldown on a position already unstaking.
- It cannot slash a Yield position, or slash anything beyond the rules in Slashing.
Ownership is proven by your signature. Every mutating action on your position must be signed by your wallet — the program rejects any other signer. This is also what makes agentic access safe: an agent acts with your keypair, never with custody.