Audited, immutable, open source. Every line of code that holds your funds lives on-chain — no black boxes, no trusted intermediaries, no server that can be taken down.
Every winner is selected by Chainlink VRF. The contract extends VRFConsumerBaseV2Plus and overrides fulfillRandomWords as an internal function — only the VRF coordinator can invoke it. No block.timestamp, no block.hash.
The contract inherits from audited OpenZeppelin modules. Every function that moves funds is protected by ReentrancyGuard. Role-based access uses AccessControl with two roles: DEFAULT_ADMIN_ROLE for ownership and MODERATOR_ROLE for operational actions.
Once Chainlink VRF resolves a round, the winner can claim immediately — no artificial delay. A 90-day dead man switch lets anyone force-cancel any non-terminal round if the protocol stops responding — no funds are ever locked permanently.
The full test suite runs across both Hardhat and Foundry — every branch, including reverting paths, is exercised. An emergency withdrawal path exists for surplus tokens, protected by a 48-hour timelock. Treasury claims are rate-limited to once per hour.
Every participate() call requires a time-limited EIP-712 signature from the backend signer — there is no open deposit function that can be called freely. Nonces prevent replay attacks. Disqualified participants are excluded from payouts and their ticket fees flow to the treasury.
The contract emits a structured event for every round resolution, prize claim, and cancellation. You can query the full history directly from a node — no API, no database, no trust required.