Verify the wallet. Read the rules.
The live contracts are version 4.13, on Arbitrum Sepolia, a test network that uses test money. This page shows what an Arlo wallet can do, where its money can go, and what risks are left.
WHAT AN ARLO IS
An Arlo is one wallet for one Trader and one Backer. It is not a fund, a shared pool, or a number in our database. It lives on Arbitrum, a public network where anyone can look up its code and its money.
A new wallet for every Arlo.
The wallet is created when the two seats are matched. It holds only that Arlo's money, and money from another Arlo cannot reach it. It is built on Safe, a widely used wallet design.
The rules are added the moment it is made.
The wallet gets its rules in the same step that creates it. There is never a moment when we hold its keys or can act for it.
Every Arlo is made the same way.
Every Arlo is made by the same piece of code (the wallet factory). A new version uses a new factory, so it can never change an Arlo that is already running.
Each part of the code has one job, and none can be swapped out.
Formation creates the wallet. ArloGuard checks every payment. TierMathV4 and ArloLossBudget work out the amounts and the loss limit. The version an Arlo uses is fixed when it starts.
HOW MONEY MOVES, AND WHERE IT CAN GO
Money moves in four ways, and the code fixes each one.
In, to your own account.
You first put money in your own Arlo account, where it waits between Arlos. When you withdraw, you choose where it goes, and only your own wallet can approve it.
Out to a seat, when an Arlo starts.
When you take a seat, $5,000 for a Trader or $10,000 for a Backer moves from your account into the new Arlo wallet. The full $15,000 is there from the start, and nothing extra is taken.
Out to GMX for trades, and back again.
The Trader can send money to GMX to trade. Anything that comes back from a trade must return to the same wallet. ArloGuard checks every payment and refuses anything outside the rules.
Out to the two of you at the end, in order.
At the payout, the Backer gets $10,600 first. Then Arlo gets $150. The Trader gets what is left. Each payout goes back to its owner's account.
WHAT IS LIVE, AND WHERE TO READ IT
CODE
VERSION
NETWORK
ADDRESS
Venue registry
v4.13
Arbitrum Sepolia
0x8DbD…0e52
Wallet Safe setup
v4.13
Arbitrum Sepolia
0x4903…279e
Formation
v4.13
Arbitrum Sepolia
0x57EB…63F2
Queue
v4.13
Arbitrum Sepolia
0x7F1d…ee5a
ArloGuard (wallet rules)
v4.13
Arbitrum Sepolia
0x6De4…Bc89E
Wallet factory
v4.13
Arbitrum Sepolia
0x2dEB…f15D7
Settlement
v4.13
Arbitrum Sepolia
0xf281…DADC3
GMX reader adapter
v4.13
Arbitrum Sepolia
0x96aE…F64d6
GMX venue adapter (V2)
v4.13
Arbitrum Sepolia
0x4d30…11be
GMX loss budget adapter
v4.13
Arbitrum Sepolia
0xdbCa…82605
Genesis committed 17 September 2026 — the v4.13 testnet cascade. All ten contracts are verified on Arbiscan, the public record of the network, so the code you read is the code that runs. This is a test network with test money.
WHAT THE CODE CANNOT DO, AND HOW TO CHECK
These are facts about what the code can and cannot do. You can check each one yourself on Arbiscan.
A formed Arlo has no owner, and no upgrade path.
The one governed surface is the venue allowlist: an immutable owner proposes a venue, a 72-hour timelock makes it public before anyone can commit it, and the commit itself is permissionless. Beyond it, no proxy and no upgrade mechanism anywhere in the cascade. A fix ships as a whole new set of contracts, through a new factory. Every Arlo already running finishes on the version it was formed against. Check it: search the verified source for upgradeTo. There is nothing to find. Then search for owner: you will find owners, and none of them governs an Arlo. The venue registry’s immutable owner — the governed surface named above; it cannot move money. The treasury’s owner — who can move only money already in the treasury, never a wallet’s balance; under v4.13 that is where all of Arlo’s revenue arrives, so the code’s “stray” label covers every dollar of protocol revenue — and every one of those dollars is Arlo’s. And each wallet Safe’s 1-of-1 owner — the member whose money it is, whose every outflow the Guard screens. The lock is the Guard, not the absence of owners.
There is no pause and no emergency withdraw.
No pause, no emergencyWithdraw, no setBeneficiary. The functions an operator reaches for in a crisis were never written. Check it: read the ABI. If a function is not in it, nobody can call it, including us.
An Arlo's transfers take no destination.
An Arlo has exactly three outflow routes: an allowlisted venue with proceeds forced back, a member’s own wallet after settlement with the Backer paid first, and protocol-initiated recovery. Check it: look for a transfer that accepts an arbitrary address. An Arlo wallet has none. The one arbitrary destination in the cascade is the treasury’s stray sweep, and it can only move money that reached the treasury outside the fee — never a wallet’s balance.
The custody check fails closed.
Every outflow is screened on the way out by a guard that refuses anything it does not recognise, against a frozen module set. Check it: read ArloGuardV4: the default branch is a revert, not a pass.
WHAT IS BUILT, AND WHAT IS DEPLOYED
These behaviours are in the v4.13 contract source, live on the testnet cascade — every row below except the master funding account and auto-join. That row is built and tested but not deployed, so the app treats it as unavailable until its addresses are published.
Trader-called early settlement
deployed (Sepolia)
Fee recovered at settlement rather than Day 0
deployed (Sepolia)
A halt settling the Arlo outright
deployed (Sepolia)
Loss cap as wallet minus halt
deployed (Sepolia)
The master funding account and auto-join
built, not deployed
Same-owner skip in the queue
deployed (Sepolia)
RISKS FROM THE CODE ITSELF
Risks from the market, like a stop filling late or every position losing at once, are explained on
Protections. This section covers risks from the code itself. None of them can be fixed after the fact.
Nobody independent has reviewed this code
No independent security firm has checked this code, and none has been hired yet. Being able to read the code on Arbiscan means you see the code that runs; it does not mean an expert has checked it for mistakes. Give this risk as much weight as anything else on this page.
A bug nobody has found
The code cannot be changed, so a mistake in it stays there, in public view. There is no pause, no update and no master key to stop an attack while it happens. The same rules that keep the system fixed also make a bug hard to fix. This is the biggest open risk.
Three systems Arlo does not control
An Arlo relies on GMX (the exchange), Arbitrum (the network) and USDC (the digital dollar). If GMX goes down, Arbitrum stops, or USDC loses value, the wallet is affected no matter what Arlo's rules say.
WHAT HAPPENS AFTER THE TEST NETWORK
Every page here says this is a test network. Here is what comes next. None of it is a promise of a date.
Nothing on testnet carries over.
A test Arlo pays out on the test network and ends there. No balance, position or history moves to the real network, and nothing you do here earns you a place, a discount or a record later. The test network lets you watch a whole Arlo run before any real money is involved.
Real money means brand-new code.
The real network gets new code, made by a new factory, at different addresses from the table above. The addresses on this page stay on the test network. Nothing is moved or updated, because the code cannot be updated.
The figures could be different, and would still be fixed.
The real version may launch with a different fee, length or stop line than the 5% and 30 days shown here. What cannot happen is a change to an Arlo that already exists, on either network. The rules your Arlo starts with are the rules it ends with.
WHAT WE CONTROL, AND WHAT WE DO NOT
WE DO CONTROL
•This website, and every word on it.
•Which factory we use to publish new versions of the code.
•The address that receives Arlo's $150.
•What gets built next, and what we stop supporting.
WE DO NOT CONTROL
•Any live Arlo, or any wallet, including our own users'.
•The fee, the length or the stop line of an Arlo that has started.
•Whether an Arlo pays out, when, or to whom.
•Any way to pause, undo, change or take anything.
The second list is not a policy we could change. It lists things the live code simply cannot do, so it stays true even if we changed our minds.
HOW WE ARE PAID, AND WHEN
$150 per Arlo. 1% of the size.
It comes out of the same 5% fee the Trader pays, and Arlo gets it only at the payout, never at the start.
And we are last of the three.
If the wallet is short, our share is lost before the Backer's bonus and long before their money. An Arlo that ends badly for a Backer pays us nothing. We are paid from the same wallet as them, after them.
We think this is the fair way to charge. If the order people are paid in is what makes Arlo work, we should be in that order too, near the back.
HOW TO REACH US, AND WHAT THAT CAN AND CANNOT DO
What we can help with
Explaining how Arlo works, helping you look up your own Arlo on Arbiscan, fixing a bug on this website, or hearing that these docs are wrong. We want to hear that last one.
What contacting us cannot do
Get money back, undo a trade, let a Backer out early, change a fee, extend an Arlo, or step into a running Arlo in any way. This is not a policy choice: the code has no way to do it.
READ IT YOURSELF
The code is the rules. You can check everything above without asking us for anything. If you find something this page gets wrong, please tell us.
Wallet factory
0xA4Be…19f6