> For the complete documentation index, see [llms.txt](https://docs.bextree.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bextree.com/security/escrow-architecture.md).

# Escrow Architecture

Two separate on-chain custody mechanisms back every trade, with deliberately different lifecycles.

## The Asset Vault (custody)

**Long-lived.** For pre-custodied asset classes (Orca, Raydium, Meteora DAMM v2 LP positions), the seller deposits the position into the vault **at listing time — before the auction goes live**. The vault:

* exists for as long as the listing exists, whether or not a buyer ever appears;
* holds the asset through the entire auction;
* releases it in exactly two directions — to the buyer via a verified settlement, or back to the seller if the auction ends without a sale.

An auction for a pre-custodied asset cannot be published until the deposit is confirmed on-chain. This is why LP purchases carry zero seller-failure risk: the seller's only required action happened before bidding started.

## Buyer escrow (settlement)

**Short-lived.** A settlement only exists once a winner and price are known. The winning buyer deposits the full bid amount in USDC into escrow governed by the settlement program. From there:

* **Pre-custodied:** the program swaps vault asset → buyer and payment (minus fee) → seller in one step.
* **Post-custodied (Streamflow):** the deposit starts the 24-hour settlement window. Funds release to the seller only after the transfer is verified on-chain; if the window lapses, the buyer is refunded in full automatically.

## Why custody, commerce, and settlement are separate

```
Custody     — holding an asset while it's listed        (Asset Vault)
Commerce    — running the auction                       (Marketplace)
Settlement  — exchanging a specific asset for a
              specific payment between two parties      (Settlement programs)
```

An asset can need custody long before anyone agrees to buy it, and a settlement can execute long after the auction ends. Keeping the three responsibilities in separate components means each one stays simple enough to reason about — and audit.