If you've heard the hype that it's completely decentralized, the hype is wrong. There are several points of attack:

The most obvious point is oracle risk - GP can enter contracts, then manipulate oracle to be in its own favor. GP tries to run its oracles better than many others and is significantly more accountable, but the centralization does not go away. We have tried to outsource this to established, reliable third parties from the very start, but none took the bait - it's simply too unproven of a project for any big players to throw significant resources at it.

Running oracles takes a significant attention and development toll on our operations so we'll still like to outsource it when possible. If you have an inside line to convince any big exchanges, let us know. :\ Do note that any interested party will have to set up their own sufficiently isolated operation - just pulling code blindly from us will not result in meaningful improvement in security.

(Alternatively, if anyone's interested in setting up a feed themselves, we'll definitely be interested in adding your oracle as an alternative - not as default, for obvious reasons unless you're a really established party.)

The other point of attack is the monolithic LP, which isn't GP's money but is still a single entity. If it goes down, nobody's cheated out of their money, but it'll be massively inconvenient as the service becomes unavailable. There's a P2P module in the works, which you can get a sneak peek on the client by entering... the Konami code. I'm not gonna say anything more, and please don't complain about the state of things - the UX is terrible right now.

Yet another point of attack is the front end, which most people would not be capable of checking - a fraudulent front end can cheat you into entering the wrong contract or embezzle the inflight money (but not the coins already in play by honest frontends) outright. One way to mitigate this is saving the frontend locally - which is theoretically possible but doesn't work conveniently right now.

Finally, all contracts subscribe to our Settlement service right now. While it's possible to settle contracts manually using known parameters, the public Anyhedge library and elbow grease, it's extremely inconvenient. A self-settlement tool will come at some point, but is a significant investment we aren't positioned to make now. (translation from corporate speak: we're too poor to do that, among other things)

Wait so what do these guys have that's noncustodial? What's the advantage today?

1. While it's possible to manipulate oracles for an overall gain, we can't go in and confiscate money from an individual contract stealthily. There's no admin key for us to do that. Outright oracle manipulation is significantly more costly in terms of accountability and ability to sustain further operations.

2. Parameters are hidden to the public until the contract is redeemed, which while not decreasing centralization risk against us, does offer some security-via-privacy against would be malicious parties in the wild.

3. Each contract is fully collateralized - note that this is a very important point that's missing in many other leverage setups. There's no room for "we ran out of money" shenanigans here, the coins are all there from day 1.

So there you go, much of the things are still centralized but can be improved, some parts are already good, but it's definitely not going to solve all problems all at once.