Invariants
Properties that gate shipping
These are not preferences. Each one is covered by an invariant test, and code that breaks one does not ship.
- 01
Freeze at request
When a draw starts, payment is escrowed and the selection set is frozen. No deposit or withdrawal may change which positions are eligible while randomness is in flight. This is the exact gap that drained the reference protocol.
- 02
One draw in flight
Requests settle in the order they were made, so callback timing cannot let a later request reshape an earlier one's selection pool.
- 03
The callback stores only
The randomness callback writes the random word. It never selects, transfers, swaps or settles.
- 04
No swaps inside the callback
Token purchases are pull-based and run in a separate transaction. Unbounded gas inside a callback is a liveness failure and a reentrancy surface.
- 05
Pull payments
Every outgoing value accrues to a withdrawable credit balance. Settlement never pushes tokens.
- 06
Revenue never touches backing
Protocol fees come from the surcharge and the settlement discount only.
- 07
Defensive NFT delivery
Keep-NFT settlement is strict and reverts on failure so the purchaser can fall back to the bid. Every other path delivers best-effort and leaves the NFT recoverable.
- 08
Withdrawal is always available
Backing is fixed at deposit, so exit is the depositor's only risk control.
- 09
Timeout and refund
Unfulfilled draws expire and refund. Anyone can finalise a stale draw.
- 10
Seed positions accrue no points
The operator's seed addresses are excluded from Phase 1 point accrual, hardcoded rather than filtered off-chain.
Why this list exists.The protocol custodies other people’s NFTs and has no external audit. Writing the properties down and testing them directly is what replaces the audit — not a substitute for one, but better than an unstated assumption.