Murmur · protections & risks
How your money is protected,
and what can still go wrong.
Murmur is a custodial fund with tokenized receipts, run by Starling. We think the honest way to earn trust is to tell you exactly where it lives: what the engineering guarantees, and what still depends on us.
What the engineering guarantees
Signed commands, replay-proof
Every mint, burn, close, and payout instruction is cryptographically signed with a secret the database never sees, and bound to its specific pool. Supply fences and an executed-command ledger stop the same instruction from ever running twice.
Deposits verified on-chain
Shares are only minted after the actual transfer is independently verified on-chain at finality depth, bound to the real sender, never from an amount the browser claims. A reconciler rebuilds accounting from chain data alone if the website never hears about a deposit.
Forward pricing
Deposits and withdrawals transact at the next published price, not the last one. Nobody (including us) can trade against a price they already know is stale.
Withdrawals pay realized money
A withdrawal isn't paid from a paper mark. Your slice of the book is actually closed and you're paid the realized proceeds, capped at your quote. Depositors who stay are never diluted by someone's exit.
Crash-safe money moves
Every multi-step transfer (bridge legs, pool funding, payouts) is journaled before it's sent and recovered on restart, so a mid-flight crash can't double-spend or strand funds. Stuck deposits and withdrawals are retried for 14 days instead of dying silently.
Continuous solvency monitoring
An automated check compares what each pool holds against what it owes and raises a loud alarm on any shortfall. Share supply is mirrored against the on-chain totals.
What you are still trusting us with
This is a fund you trust, not a protocol you verify
Your share tokens are receipts backed by our accounting and honesty. They are not collateralized claims a smart contract enforces. The desks' trading keys are operated by Starling. If you are looking for trustless, self-custodial exposure, this product is not that, and we won't pretend otherwise.
Prices are published by us
Pool value is marked from live venue prices and published by our infrastructure. Forward pricing and realized-close settlement limit what a wrong mark can do, but no third party attests the numbers.
One operator runs the infrastructure
If our systems go down, deposits and withdrawals stall until service is restored (queued work is durable and retried for 14 days). There is no user-side mechanism to force a redemption while infrastructure is offline.
Trading risk is real
The desks trade real markets with real drawdowns. Prediction markets, perps, and on-chain spot books can gap, and even liquid books move when a large exit hits them. Returns are not guaranteed and you can lose capital.
Experimental software
This is unaudited-by-third-parties software operating on mainnet. It has been through two internal multi-agent security audits with all critical findings fixed, but internal review is not an external audit.
Appropriate use: allocations you can afford to lose, by people comfortable trusting the operator. Not financial advice. Live system health is published on the status page.