Prismata never holds your funds. We're an interface to on-chain contracts. Your tokens are always yours.
When you buy tokens through Prismata, they're recorded in Uniswap V4's PoolManager contract — not in any Prismata-controlled wallet or database.
The PoolManager maintains a ledger of ERC6909 claims — think of them as on-chain IOUs. It records: "Wallet 0xABC owns X amount of Token Y." That record is immutable and controlled only by your wallet's private key.
Prismata builds the transaction. You sign it. It goes on-chain. We never hold funds.
Every trade, withdrawal, or action requires your wallet signature. Prismata constructs the transaction, but only your wallet can authorise it. If you don't sign, nothing happens.
This is the key difference from centralised exchanges. On Coinbase or Binance, you have an IOU in their database — they hold the real tokens. With Prismata, your tokens are on-chain from the moment you buy. No intermediary holding anything on your behalf.
Your tokens stay on-chain, owned by your wallet. Prismata uses a smart contract called PrismataRelay to interact with the PoolManager. That contract is on-chain and doesn't depend on us — you could use it directly, or any other ERC6909-compatible interface.
The tokens aren't "in" Prismata. They're in Uniswap V4's contracts. We're just one way to access them.
While Prismata itself is non-custodial, your tokens do sit in smart contracts (Uniswap V4's PoolManager). Smart contracts can have bugs.
That said, Uniswap V4 has undergone nine independent security audits, a $2.35M security competition with over 500 researchers, and has a $15.5M active bug bounty — the largest in history. No critical vulnerabilities were found. Uniswap V2 and V3 have processed over $2.75 trillion in trading volume with zero hacks.