• SOST DEX does not custody user funds or gold. Your SOST balance stays in your own wallet. Your gold (XAUT / PAXG) stays in your own Ethereum wallet or in the on-chain SOSTEscrow smart contract you yourself interact with.
• SOST DEX is not a centralized escrow or broker. Any escrow mentioned on this page refers to the on-chain Ethereum smart contract (SOSTEscrow). SOST Protocol does not operate, hold keys to, or manually release any escrow.
• SOST DEX does not guarantee counterparties, prices, delivery, or outcomes. Every offer is between two users, signed and encrypted client-side. SOST cannot reverse, force, or verify off-chain promises.

The relay can transport encrypted envelopes between users but cannot read or alter the content. SOST never sees your private keys, your private trade content, or your biometrics. The full rationale and safety guide is below.

Why SOST DEX does not intervene

SOST DEX is a non-custodial software interface. Trades are between users. The protocol's role is to host the interface and transport encrypted messages, not to broker or settle deals.

• Users create and sign offers client-side. The ED25519 signing key + X25519 encryption key live in your browser, encrypted with Argon2id from your passphrase. The DEX UI composes the offer; you sign it.
• The relay transports encrypted envelopes but cannot read them. Server-side SOST infrastructure never sees the cleartext of any offer, message, address negotiation, or settlement instruction.
• On-chain escrow is a smart contract (SOSTEscrow on Ethereum), not a SOST-operated escrow. SOST Protocol does not hold keys to the smart contract's funds. Releases happen by on-chain logic the counterparties trigger themselves.
• SOST cannot recover funds. If a user sends SOST or gold to the wrong address, signs the wrong offer, or trusts a fake counterparty, SOST has no key, no privilege, and no legal authority to reverse it.
• SOST cannot force delivery. If a counterparty agrees to send something and then disappears, SOST cannot compel them. The remedy is a separate matter between the users (civil dispute, police report, on-chain forensic tracing).
• SOST cannot verify off-chain promises. A counterparty claiming "I sent the wire" or "the metals are warehoused" is making an off-chain statement SOST has no way to validate. The user must verify independently.

What SOST DEX can  and  cannot verify

Honest DEX counterparty vs scammer

Specific to the DEX context (positions, reward rights, OTC requests, smart-contract escrow). If your counterparty matches the right column, stop the trade.

Realistic DEX scam examples

Five common attack patterns adapted to the DEX context, with warning signs and the safe response for each.

Pattern: a counterparty sends you a link to a "PoPC contract" on Ethereum that looks legitimate (same ABI, similar address). Their version of the contract has a hidden backdoor that lets them drain after deposit.

Warning signs: the contract address differs from the official SOSTEscrow address published in the SOST docs. The counterparty insists on "my version" or "the new test contract". The bytecode has not been verified on Etherscan, or shows unfamiliar admin/owner functions.

Safe response: only use the SOSTEscrow contract address documented in sost-popc-contracts.html. Verify the contract is open-source-verified on Etherscan. Refuse any "alternative" contract.

Pattern: a counterparty in a chat or social media post sends you a URL that looks like the DEX but is hosted elsewhere: sost-dex[.]net, sostdex[.]app, sostcore[.]io/dex. The clone page steals your passphrase / seed when you "Create Identity" or "Import Backup".

Warning signs: URL is not exactly sostcore.com/sost-dex.html or sostprotocol.com/sost-dex.html. Page asks for your seed phrase. Page looks identical but is on a different domain.

Safe response: only ever load the DEX from sostcore.com or sostprotocol.com. Type the URL yourself; do not click links from DMs / Telegram / X. If in doubt, navigate from the nav of sostcore.com itself. No legitimate process EVER asks for your seed phrase or passphrase.

Pattern: a seller claims their position is "locked in escrow" and to release it you must first pay an "activation fee" / "gas top-up" / "unlock fee" of N SOST or N USDT to a third address. The escrow does not exist; the "fee" is the scam.

Warning signs: any request to pay something small first to unlock something bigger. References to a "SOST escrow procedure" or "admin verification fee" that does not appear in any official SOST documentation. Pressure to pay before reading.

Safe response: SOST has no fees beyond normal network transaction fees and protocol-defined PoPC settlement fees. Anyone asking for an out-of-process "activation fee", "release fee", or "tax fee" is running an advance-fee scam.

Pattern: a buyer claims to have paid (in SOST, ETH, USDT or fiat) and sends a screenshot. Pressures the seller to release the position or reward right immediately. The transaction either does not exist or went to a different address.

Warning signs: screenshot instead of a verifiable txid. Refusal or delay when asked for the txid. Urgency: "release now, I have another deal waiting". The screenshot's address differs from your receiving address.

Safe response: never release based on a screenshot. Always require the txid, verify it on sost-explorer.html (for SOST) or Etherscan (for ETH/ERC-20), confirm the destination is YOUR address, and wait for the configured number of confirmations.

Pattern: after the offer is signed and you are about to send funds, the counterparty asks you to send to a different address than the one in the signed offer ("my main wallet was compromised", "use this temporary address instead", "send to my friend who is closer"). The new address is the attacker's.

Warning signs: a request to deviate from the signed offer payload. Last-minute address change. Excuse story attached.

Safe response: send ONLY to the address in the signed offer. If the counterparty needs to change anything, cancel the offer and sign a new one with the new terms. Never trust a verbal / chat amendment to a signed payload.

SOST cannot reverse on-chain transactions, force counterparties, or recover funds. What you can still do, in order:

1. Stop sending funds. Do not send more in the hope of recovering what you already sent.
2. Save the evidence. Txids, signed payload JSON, URLs, screenshots of the chat, the counterparty's handle, the addresses involved. Keep a local copy.
3. Revoke / rotate any compromised keys. If you entered a seed phrase or passphrase into a phishing site, assume the wallet is fully compromised. Move any remaining funds to a brand-new wallet (new seed) immediately. The old wallet is permanently unsafe.
4. Report fake domains / accounts. Submit the lookalike URL to your browser's phishing report, the registrar abuse contact, and the social platform where the impersonator operates.
5. Warn the community without doxxing. Post the pattern (the scam method) in the OTC Reputation room in SOST Talk. Do not post the counterparty's personal data; share their on-chain address and their chat handle only.
6. File a police report in your jurisdiction. Crypto fraud is increasingly investigated, and your report adds to the pattern.
7. Do NOT pay any "recovery agent" that contacts you afterwards offering to recover funds for a fee. That is a follow-up scam.
8. Understand: SOST cannot reverse the transaction, force the counterparty to deliver, or arbitrate the dispute. The protocol is non-custodial and software-only.