Security
此内容尚不支持你的语言。
Internal reviews
Section titled “Internal reviews”The contracts were reviewed twice in October 2026, by reviewers who read the code without the authors’ conclusions, each in their own area: pool, lending, prize vault, periphery.
| Review | Critical | High | Medium | Low |
|---|---|---|---|---|
| First | 1 | 4 | 7 | 8 |
| Second | 0 | 3 | 5 | 18 |
Every finding came with a test that proved it. After the fix, each proof was turned into a regression test that asserts the attack no longer works, so a finding cannot come back silently.
The critical finding of the first review: the drand signature was not checked for membership in the G1 subgroup, so whoever finalized a draw could add a small-order point to a valid signature and grind the randomness until a chosen address won. The contract now rejects such signatures before the pairing.
These reviews are not a substitute for an external audit.
| Kind | What it covers |
|---|---|
| Unit and flow tests | every message of every contract, in @ton/sandbox |
| Real Elector | lending against the Elector compiled from source: rewarded round, rejected stake, lost cut, max_factor cap, a real fine through a complaint and a validator vote |
| Elector model | the bid engine’s election algorithm against the real Elector on random participant sets |
| Randomized | seeded random sequences of deposits, exits, claims, transfers, donations, time jumps, lending rounds with fines and prize draws with real drand beacons; after every step: solvency, share supply, claims within queued, the vault’s wallet holding exactly its tracked shares, every exit getting at least its principal, no lost message |
| drand | real quicknet beacons from round 1 to October 2026, forged signatures, wrong rounds, wrong witnesses |
| Gas | every handler against its gas budget, so a fee can never fall short of what the code spends |
| Upgrades | a live treasury upgraded through the timelock with its storage migrated |
| Deployment | the deploy and verify scripts against the sandbox |
All of it runs on every commit.
Monitoring
Section titled “Monitoring”A monitor watches the live protocol and alerts the team in Telegram: indexer lag, reserves no longer covering holders and claims, any bad debt, a falling share rate, a paused pool, a low keeper fund, late keepers and overdue draws.
Known limits
Section titled “Known limits”- The election id is assumed to equal
utime_untilof the current set. If the Elector announces late, stakes are rejected and the minimum payment is charged. - Elections the Elector postpones are not handled.
- A stake that loses the cut returns only after unfreeze, so that Gram idles for one extra round.
- If the Elector lags past the 10-minute grace, a recovery may return only part of a stake. The pool books a loss and the rest is recovered later as pool profit; the validator loses its share of that rest, and claims already reduced are not restored.
- Keepers are paid in Gram at network prices. The governor must keep bounties above real gas costs.
- Draws depend on drand. If it stops, a closed draw waits and deposits in that vault stay frozen until the beacon exists.
- An instant withdrawal can leave before a fine becomes visible, while liquidity lasts. Fines show on chain only when the loan settles.
- Migration works only through the source pool’s instant liquidity, and each migrator trusts its source pool’s contracts.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Write to the team privately before disclosing anything. A bug bounty with fixed rewards opens with mainnet.