Trust model

Who holds which key, what each one can move, and how every move can be checked from the chain.

No program, keys and Memos

The product runs without a Solana program of its own. Pots are USDC token accounts owned by per-target escrow keys; the keeper 2cNfNTMpXuFZRtMWFvydgJxDq3Z2ZoiPVVNQtzFpuC6N pays fees and signs records. Every movement of money is a plain SPL transfer with a Memo teardown:<action>:<program>:..., so pots, backers, refunds, top-ups and payouts can all be rebuilt from public transactions, and the site does exactly that.

The keeper and the escrow keys

• The escrow keys and the keeper key live in the site's server secrets and are never shown or logged.
• A refund goes to the wallet that chipped in, for at most its share, and only before a PASS.
• A payout goes 90% to the payout wallet bound to the passing submission and 10% to the vault, in one transaction.
• Each keeper transaction is recorded with its signature before it is broadcast, and a recorded step is never sent again.

Because the escrows are keys rather than a program, a reader checks the keeper's behaviour against these rules from the Memos.

The judge

• The judge machine runs one job at a time and stops when the queue is empty.
• Its X25519 private key, which opens submitted archives, lives only in the judge machine's secrets.
• Builds run with no secrets in the environment, on an ephemeral machine, with a 10 minute cap.
• Verdicts are reports with hashes that anyone can reproduce with the verifier (see Verifying a verdict).

What is public and when

• Immediately: snapshots, first looks, instruction samples, pots, transfers, attempts with their match and hashes.
• On a PASS: the source, the same day.
• Never: a FAIL's source, which stays encrypted.

Reverse engineering

The engine reads public bytecode and public transactions. Its purpose is audit, interoperability and security research. A hunter who finds a vulnerability while working on a target reports it to the program's own security contact first; many programs publish one in their .security.txt section, which the first look shows. Owners who want to raise a concern about a target use the takedown form.