Security & control

Who can move your funds (you), who cannot (us), and what happens if bandforband.fun goes offline.

bandforband.fun is built so that trusting us is not required to get your money back. All funds are held by the open-source wagers program on Solana, and the program, not our servers, decides where they can go.

The custody model

Your vault. Each player has a vault account (a PDA of the program, derived from your wallet address). Only a transaction signed by your wallet can withdraw from it.
Contest escrow. Each contest and tournament has its own escrow account. When you join, your stake moves from your vault into that escrow.
Where escrow can go. Money can only leave an escrow towards the vaults of the contest's own entrants (payouts and refunds) or the treasury (the rake, capped by the program). There is no instruction that sends escrow anywhere else.
No database balances. The balance you see in the app is read from your vault on-chain. Our database only stores metadata and an index of on-chain events.

Who can do what

Role	Held by	Can	Cannot
You	Your wallet	Deposit, withdraw, join, leave an open contest, back, buy, tip	Move anyone else's funds
Settler	A key used only by the bandforband.fun worker	Lock contests, settle them, pay promo credits from the rewards pool, close an empty vault so its rent goes back to whoever paid it	Withdraw from any vault, pay anyone who is not an entrant, take more than the contest's rake tier
Admin	A Squads multisig	Update the configuration within the program's hard caps, rotate the settler, pause new activity, hand over the admin role	Withdraw or move user vaults, touch escrow, block withdrawals
Anyone	Any wallet	Refund a contest after the timeout, claim payouts and refunds on behalf of entrants, close finished contests	Change where the money goes

The API that helps you build transactions only holds a fee payer key, so the platform can pay network fees for you. It cannot sign as you, and it is not allowed to hold the settler key: the API refuses to start if one is configured.

If we disappear

Your vault stays yours. You can withdraw with any Solana wallet, without the bandforband.fun website.
An unsettled contest can be refunded by anyone 7 days after it ends. Every entrant gets their full stake back.
Pause only stops new contests, joins, backings, purchases, tips and promo credits. Withdrawals are never blocked, and a paused program can still settle and refund.