A short window. A real responsibility.
GhostMarket holds your ZEC during a purchase. You should know when, why, and what limits apply.
No live endpoint is connected. Public counts must be batched and delayed, with timestamps rounded to the hour; no per-order breakdown.
What we hold, and when
- From
- The moment your payment reaches escrow
- Until
- The seller’s payout is broadcast
- Typical window
- 15 to 90 minutes
- Never
- Before you pay or after the order completes
We do not hold balances. There is no deposit, no account balance to top up, and nothing to withdraw except site credit from rounding remainders. Money enters for one order and leaves for that order.
Why it works this way
An off-chain registry cannot make money and ownership move as a single atomic event. An intermediary holds the payment so one side cannot take the other’s value and walk away.
ZIP 228 describes atomic swaps of shielded assets: buyer and seller each sign, a matcher assembles settlement, and both legs execute or neither does. The venue would never take possession. It is still Draft and is not active in this marketplace.
Until that is available, GhostMarket is custodial. A confirmed Zcash payment does not by itself prove ownership of a token in this off-chain registry.
The limits
The custody design specifies these controls. This preview cannot verify an operating deployment or its live limits.
Float ceiling
Anything above roughly one day of payout volume is swept to an air-gapped cold reserve on a schedule, limiting the amount at risk if the hot key is compromised.
Velocity caps
Per-payout, per-hour, and per-day limits live on the wallet host, outside the database. Exceeding them requires approval signed by an offline key.
The web tier cannot name a payee
The wallet service receives a payout reference and derives the amount and destination from the database. It refuses anything the order does not justify.
Your saved address is encrypted
The design encrypts it in your browser under a key the server never sees. To claim a payout, you return, unlock locally, and supply a destination used once. Encryption and claims are not connected in this preview.
What we never ask for
Every address field rejects key material before validation or storage. This includes extended and incoming viewing keys, BIP32 keys, transparent WIF keys, and recovery phrases.
There is no watch-only mode. Typing an address cannot give someone access to its history. Private account views require a signature.
What we publish
Only aggregates: escrow held, open orders, float ceiling, last cold sweep, and the oldest held order. Public releases must avoid a count changing with a single sale. Sale prices are banded and activity is delayed and batched, never a live feed.
This disclosure follows the project’s custody policy and the dedicated escrow disclosure pattern credited to ZecBit.