Who controls what, what nobody can touch and how the contracts were checked.
Audit status
How it was checked
There has been no third-party audit, so treat the contracts as unaudited. Here is what was done instead:
- Two static analysers. Slither and Aderyn were run on the code, and again on the exact commit that was deployed. Every serious result was checked by hand. A second pass rechecked every result that had been dismissed.
- Hundreds of tests. The suite of unit, fuzz, invariant and fork tests had 763 passing and 0 failing on the deployed code. The deep invariant run makes 500,000 random calls per property, checking things like “the contract always holds enough USDG to pay what it owes” and “a pause never blocks a claim or an unlock”.
- Several review passes. Independent AI-assisted reviews and internal reviews went through each contract, and every reported issue was checked against the code. Each Medium finding was reproduced with a test before it was fixed. Four Medium findings were found and all four are fixed. No Critical or High finding was found.
- Fixes come with tests. Each fix has a test that fails on the old code and passes on the new code.
- Rehearsed before launch. The full deploy ran on testnet, then on a private copy of mainnet, including a deploy that was stopped partway and resumed.
- Checked live on mainnet. After the deploy, reads on chain confirmed that the multisig Safe owns every owned contract with nothing pending, the deployer has no power left, and the timelocks are live. All 8 owned contracts have verified source on Blockscout.
- No secrets in the code. The full git history of both repositories was scanned for keys and tokens.
The full write-up, with every finding, its status and the fix, is in the audits folder (opens in a new tab) of the contracts repository.
Who controls what
| Role | Can | Can’t |
|---|---|---|
| Owner (multisig Safe) | Queue changes behind timelocks, pause new sales, revoke the keeper | Touch Purses, claims, the Alms or Passes |
| Keeper | Settle rounds, run buys and burns within caps | Send bought tokens anywhere but the burn address or the Vault |
| Players | Shoot, claim, lock and unlock | Claim for someone else |
Timelocks
- Booth and core settings
- 48 hours on mainnet
- GameConfig (tokens, pass amount, split)
- 7 days and only between chapters
- Attaching a Vault launcher
- 7 days, one time
- Turning on Robin Among Thieves bonds
- 7 days
- Revoking the keeper
- Immediate
What always works
- Claiming winnings, even while paused.
- Unlocking a Pass after 24 hours.
- Withdrawing an outlaw’s balance.
- Ownership can’t be renounced and ownership moves in two steps.
Reporting a bug
Report security issues to support@gameofsplits.fun.