Who holds your QTC, who can move it, and what can go wrong

User wallets. Signing in creates one Quantus wallet per user, with its own 24-word recovery phrase. The platform stores the phrase encrypted (AES-256-GCM, one master key held by the platform) and decrypts it in memory only to sign a transfer or to show you an export. You can export the phrase with your authenticator code; the platform keeps its copy.

Escrow wallet. Because a phrase can be exported, a balance in a user wallet can leave at any time, so it is never treated as escrow. Escrow is one platform wallet with a public address. It is a hot wallet: its key is online so that releases and refunds can be signed automatically.

1. Match. A taker accepts an offer. Both Arbitrum addresses are recorded for the trade.
2. Lock. The platform signs a transfer of the amount from the seller’s wallet to the escrow wallet and waits for 30 confirmations. If the seller’s wallet no longer holds the amount, the trade is cancelled and the seller is warned.
3. Pay. Only then does the buyer see payment instructions: the exact USDC total on Arbitrum One, from their recorded address to the seller’s. A watcher matches the transfer log and waits for 12 confirmations. The pay deadline is 90 minutes. Transfers that do not match exactly never advance the trade on their own.
4. Release. The escrow wallet sends the amount minus the 2% fee to the buyer’s wallet and the fee to the fee account, in one batch. There is no other moment at which the platform receives funds.
5. Refund. If the buyer does not pay in time, the escrow wallet sends the full amount back to the seller’s wallet. A payment detected before that refund executes stops it and sends the trade to dispute.

The platform checks on every pass that the escrow wallet holds at least the sum of all open trades.

• The platform holds the keys. A copy of every wallet’s phrase and the escrow key are online on its servers. Whoever compromises them can move deposited and escrowed QTC. There is no cold storage, no insurance and no guarantee scheme. Keep on the platform only what you are trading.
• One master key protects all stored phrases. It is loaded from the server’s configuration today, behind an interface that lets a key-management service replace it; that has not been done yet.
• If the platform goes away, a phrase you exported earlier still opens your wallet. Without an export you have no access, and QTC sitting in escrow at that moment can only be moved by the platform.
• Exporting does not end custody. The platform keeps its copy. For QTC only you control, withdraw to a wallet you created yourself.
• Offers are not locked. A sell offer is checked against the maker’s balance when posted, but the QTC can leave before a match. The take then fails cleanly, before the buyer is asked for anything.
• The USDC side has no escrow. A payment of the wrong amount, from another address or on another network is not reversed by anyone. The buyer’s protection is that payment instructions appear only after the lock is confirmed.
• Disputes are decided by platform admins. There is no external arbitrator. Decisions and their notes are visible to both parties.
• Confirmations are a trade-off. Quantus is a proof-of-work chain; 30 confirmations make a reorganisation unlikely, not impossible.
• Legal status is not settled. Holding crypto-assets for users is a regulated activity in many places. The operator claims no licence or registration; see the draft terms.