Status

Manifest environment: production · Pons contracts: verified

Live launches

Open

Verified randomness for draws

Open

Recorded blockers

• Platform FEED buy route for a graduated FEED market is not built: PonsCurveAdapter only buys while the FEED token trades on its Pons curve.
• Mainnet-fork evidence only, not production verification: the deployment-version-2 fork suites passed on local forks of Robinhood Chain mainnet pinned at L2 blocks 68938375 (22/22 on the v2.1 contracts: launch in all three modes, per-round acquisition and funding finalization, 2-of-3 round commitment, a real drand beacon with the randomness audit flag simulated, settleWinners and claims) and 70771918 (route, drand and adapter suites, and the simulated production deployment F-10), docs/INTEGRATION_REPORT.md section 10. They must pass again at a fresh pin on the frozen release commit before the broadcast; buyFeed, the keeper, indexer and web against fork contracts, and claimMany beyond 3 awards have not been exercised on a fork.
• Upstream monitoring not running against production: Pons recipient-override, fee-policy, sweep-operator and WETH proxy Upgraded/AdminChanged alerts are not yet live.
• FeedPlatformBuyer is unconfigured, waiting for $feed (D-086): feed's contracts were deployed before $feed exists. Every coin's platform share (0.25% of its trading volume) collects in FeedPlatformBuyer, and no $feed is bought, until the owner (the dev wallet) launches $feed on Pons and sets it with one setConfig from the admin panel (Set $feed): the $feed token, its Pons curve route through the deployed PonsCurveAdapter and OperatorBoundGuard, the treasury and the D-084 bounds. Until then the owner can also take the waiting ETH out (D-085).
• Two-wallet operation (D-080a): The side wallet's key is kept on the server, and it alone approves each round's winner list. If the server is hacked, then while the key is compromised the attacker can approve fake winner lists for every funded round of every coin, including prizes carried over from earlier rounds. Each fake list must be cancelled separately within its own 10 minutes, and new ones keep coming until the dev wallet replaces the attestor (setAttestors). Nothing independent checks the lists. The same key is the platform keeper: it sets the only price limit of the platform's $feed buys, so the attacker can also make the platform ETH that buys $feed for the treasury trade at a bad price, up to the route's maximum trade size once per cooldown. It cannot change any setting, and it cannot reach a round whose winner list is already past its review.
• FEED contract sources are not verified on Sourcify: each FEED entry's source records a match against the local build only; verify every contract on Sourcify (exact_match) and update the entries.