What the code cannot do, how it was reviewed, and where that stops. Each claim below names the function that makes it true. The source is verified on the explorer; read it.
The token's mint and rebase are callable only by policy. policy is the Hub, and lockPolicy() froze it — one-way; no unlock function exists. The Hub's mint accepts only two destinations: the pool, or a vault the season registered. There is no path by which new supply lands in an externally-owned wallet, ours included.
The Hub caps new supply at 200% of the settlement base per settlement and contraction at 5% of it. The Season 1 Policy sets its own tighter contraction cap at 3%, bounded between 1% and 5%. A rebase can only shrink — the token rejects a positive delta — and growth goes only through the destination-limited mint.
MAX_MINT_BPS_PER_WINDOW · MAX_CONTRACTION_BPScontractionCap · MIN_CONTRACTION_CAP … MAX_CONTRACTION_CAPrebase · supplyDelta <= 0transfer, transferFrom, transferAll and transferAllFrom move balances at the current index and nothing else: no hook, no fee, no exempt list, no variable read but the index. policy does not appear in any of them. The contract is proxy-free — a constructor, no initialize, no delegatecall, no selfdestruct. There is no admin path to change how a transfer behaves, before or after lockPolicy.
There is no seize, no burnFrom, no blacklist. burn burns the caller's own balance only. The Safe that owns the contracts can change parameters inside hard-coded bounds during a config window, install the next season's module through the Hub's delay, and pause. It cannot move your tokens.
At finalize, Genesis mints the LP tokens to 0x…dEaD. The USDG and TICKET in the pool cannot be withdrawn by anyone, ever.
pause() closes the ways in — stake is whenNotPaused — and stops rebases. It does not close the ways out: requestUnstake is not paused, and a queued exit can be withdrawn during a pause, because a pause would otherwise hold every exit in flight for as long as it ran.
A pause runs 24 hours. The pause admin can extend it to at most 30 days — a third of a season. The season's clock accounts for every paused second, and the exit path above stays open for all of it.
stake whenNotPaused · withdraw · released || _paused()pause · PAUSE_WINDOW · extendPause · MAX_PAUSE_EXTENSIONIf Genesis is never finalized, abort() opens refunds of every deposit in full after a seven-day grace. Above the cap, the excess is returned pro rata by refund() — a second, separate transaction, which the page tells you before you sign the first.
Adversarial review, in rounds, by two independent AI models. Each was given the contracts, a ledger of every path value can take through the system, and a brief that asks it to break the code and to check every citation in it — and none of our reasoning about what we had already fixed.
Both found real problems. The most serious was in our rules rather than our contracts: the Jackpot draw as published could be gamed by splitting a stake across many wallets. We found it, reproduced it against the real contracts, and changed the rule.
Every finding was reproduced in the EVM before it was accepted, then fixed in the code or restated on this page. The full report and our reproductions are linked below.
Four mechanical checks gate every release: every claimed bound cites the function that enforces it and the citation resolves; every ABI the site uses matches the contracts; every owner-only call has a named owner in the hand-off; every deploy input sits inside the bound the constructor enforces.
And a full rehearsal on Robinhood Chain's testnet: a real Genesis with real wallets, oversubscribed on purpose, finalized, handed to a 2-of-3 Safe, claimed in two transactions, and run night by night by the same keeper that will run mainnet.
| finding | what it was | what changed |
|---|---|---|
| Jackpot draw | N distinct wallets, equal shares: nine one-unit stakes beside one real staker took 90% of a drop. | N tickets, drawn with replacement, paid per ticket. Same harness, both rules: 90% → 0.000%. |
| Supply bound | We said "×2.95 per settlement". That assumed a hostile module would also contract 5%. | Restated: ×3 per settlement, ×27 per 24 hours, mint-only. Reached in the EVM. |
| Green nights | This site said a green night pulls the price back to target. It is proportional to the day's average, applied to the current pool. | Rule kept — it is the game — and every sentence that promised a reset corrected, here and on the rules page. |
| Season length | A season configured for N days settles one night more than N — two more if the first night lands late in its window. | Configured one day short of the advertised season, so the two agree; the reason is recorded where the constructor argument is read. |
| Queued exit fee | Our ledger said a queued exit's fee keeps falling while queued. It is pinned at the request. | Restated. |
| Owner timelock | This site said a public timelock stops the multisig. There is no timelock at launch. | Restated, below and on the rules page. |
| Prediction market | Three findings in a module that is not wired this season. | Stays unwired until each has a fix and a test. |
Nothing backs $TICKET, and you can lose everything you put in. No claim on assets, no redemption, no floor. The price can go to zero.
These are AI reviews. They are not an audit by a security firm, and this page does not call them one. They found real problems — the second found problems the first had missed across every round it ran, which is the clearest statement of their limit we can make. They are not a substitute for a professional audit and not a guarantee that none remain.
Things you should know that no review changes: