Custody

Nothing here takes custody. Every transaction is signed by you, and the protocol cannot move funds on your behalf. What varies by venue is where the resulting position sits.

Where a position lives

Some venues let a position be opened directly on your own wallet address. Your collateral and debt sit on your account at the venue, visible in that venue's own app, and you can manage or close the position there without DeVOLT existing.

Others have no on-behalf interface for the operations a leveraged open needs, so the position is opened inside a per-user proxy contract that only you control. Functionally the same claim on the same assets, but it lives at an address the venue's own front end does not show, and closing it goes through DeVOLT.

The one that cost real money

A close routine once withdrew a user's entire balance of the collateral asset from the venue, including deposits that had nothing to do with the DeVOLT position: their whole holding, down to zero. It was invisible for as long as it existed because every test opened on a fresh account with no pre-existing balance, so there was never anything extra to take.

It is fixed, and the lesson is written into how on-behalf adapters are tested: with a user who already holds a position at the venue, because that is the only state in which the bug appears.