How your money is held

Nobody holds your money, Arlo included. Each Arlo has its own wallet, and code checks every payment that leaves it. The code can pay GMX, and at the end the Backer, Arlo and the Trader. Nothing else.

Four ways money moves

Every route money can take. Try to send it anywhere else.

In, from your wallet to the queue. Your contribution waits in the queue’s code until your Arlo starts, or until you cancel.
From the queue to the Arlo’s wallet. When your Arlo starts, both contributions move into a new wallet made for it.
To GMX and back. The Trader’s orders send margin to GMX. Whatever comes back must come back to the same wallet.
Out, in order. At the end the wallet pays the Backer, then Arlo, then the Trader. Each share goes to a wallet the code fixed when the Arlo started.

Any other payment is refused. The check on the wallet turns down anything it does not recognise, so anything unexpected is blocked, not let through.

Who can do what

Pick a person to see what they can do.

One thing can change. Arlo can propose adding another trading exchange alongside GMX. Each proposal is public for 72 hours before anyone can switch it on. A badly built link to a new exchange could put money at risk, so this is the one place where you rely on Arlo’s judgement. Today GMX is the only one.

Watching the line

Arlo runs a closing service that watches every wallet. When a wallet reaches its line, or an Arlo ends with trades still open, it asks the code to close them.

Anyone can do the same, including the Backer. The code checks the wallet first, so nobody can close trades in a healthy Arlo. And if Arlo’s service ever stopped, anyone could still close trades and start the payout.

No owner, no pause, no upgrade

There is no switch to pause an Arlo, no way to reverse a trade, and no way to change the code under a running Arlo. A fix ships as new code. Every Arlo already running finishes on the code it started with.

That cuts both ways. Nobody can take your money, and nobody can step in to stop a loss. Nobody can make you whole.

Check it yourself

Arlo’s code is public on Arbitrum. You can read it on Arbiscan, a public record of the network, where you see the exact code that runs. Four checks anyone can make:

Look for a way to upgrade. Search the code for upgradeTo. There is none.
Look for a pause. There is no pause and no emergencyWithdraw. If a function is not in the code, nobody can call it.
Look at where payments go. No function that moves an Arlo’s money takes an address that someone types in.
Look at the wallet’s check. Read ArloGuardV425. Anything it does not recognise is refused.

What is still a risk

Code can have mistakes. No independent firm has reviewed this code yet. Arlo’s own rules require that review before Arlo runs with real money. Because nothing can be paused or upgraded, a mistake could not be fixed inside a running Arlo.
Arlo relies on others. GMX, Arbitrum and USDC are not Arlo’s. If one of them fails, an Arlo is hit, whatever its rules say.

Risks, plainly covers these and every other risk.