> For the complete documentation index, see [llms.txt](https://docs.papaya.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.papaya.finance/overview/security-and-custody.md). # Security and custody What the contract owner can and cannot do, and the risks to know. ## Non-custodial * Papaya never holds user private keys. * Funds deposited into Papaya sit in the smart contract, not in a Papaya-controlled wallet. * Users and merchants can withdraw their available balance at any time. ## What the contract owner can and cannot do The contract owner **cannot** move user balances. The only owner function that moves tokens, `rescueFunds`, is limited to tokens sent to the contract by mistake: it cannot withdraw more than the amount above the sum of all user balances. The contracts have no pause function and are not upgradeable. Rules cannot be changed for existing deployments. ## Risks to understand * **Smart contract risk.** All balances for a stablecoin on a network sit in one contract. A bug in that contract would affect all of them. * **Liquidation.** In streaming mode, if a balance runs out and cannot be refilled, the remaining balance goes to whoever liquidates the account. Keep balances funded or set up an allowance for refill. * **Price feeds.** In streaming mode, liquidation thresholds and refill rewards use Chainlink price feeds for the gas token and the stablecoin. * **Stablecoin risk.** Papaya holds balances in the deposited stablecoin and inherits its risks (issuer, depeg, freezing). ## Audits and patents * The core streaming contract was audited by Stronghold Security. * Periodic subscriptions are in preview. * The Papaya architecture is patent pending (USPTO). ## Responsible disclosure If you find a vulnerability, please contact the team at before disclosing it publicly.