Trust the mechanism.Verify the rules.
- None
- None
- Not audited
- Testnet
Not audited · testnet only
01
Nobody holds the keys.
After the contract was initialised, every access key on its account was deleted. With zero keys, no one can deploy new code, call a privileged method or move the Hearth.
No owner
There is no owner account and no role that can do more than anyone else.
No setters
Every parameter is fixed at deploy. Nothing can change the goal rule, the fee, or the causes.
No upgrade
There is no upgrade method, and with no access keys the code can't be redeployed.
No pause
Nobody can stop giving, claiming or redeeming.
02
The chain checks the money.
The contract exposes check_invariants(). Every test asserts these after every step; here they are read live from testnet, refreshed every few seconds.
“The floor never decreased” is checkable because the contract stores the highest floor ever reached as a pair (Hearth, backed GOOD) and compares exactly, without rounding.
03
Tested three ways.
46
Contract tests
Every rule and every error code, plus a property test that runs random histories of gifts, settlements, claims, kindles and redemptions and asserts the invariants after each step. Run with
cargo test.1
Golden trace, three languages
One scenario file produces identical numbers in the Rust contract, the exact-integer Python model (
uv run pytest) and this website's math.E2E
Live on testnet
A scripted run on the locked demo contract: a catch with a spark, a deleted cause carried, a smother, a kindle rescue, a redeem. Every step asserted chain state; it passed with all invariants true and 0 keys.
04
Attacks, and what stops them.
A selection from the full threat model. Every design from the third version on went through independent adversarial review.
| Attack | Defence | What remains |
|---|---|---|
| Redeem between settlement and claim to push the floor down | GOOD for givers is counted in the backed supply the moment a fire settles, so claims never change the floor. | None |
| All GOOD redeemed, floor resets | A locked seed (1 NEAR and 1,000,000 GOOD nobody owns) keeps the backed supply above zero forever. | None |
| First-depositor inflation of the Hearth | There are no direct deposits: the Hearth grows only through fees of fires that catch. | None |
| Paying a cause twice | Payouts move Due → Sending → Paid or Carried. A payout acts only on Due. | None |
| Fake givers to reach a goal | Each counted giver costs a minimum gift plus the record fee, and 90% of it reaches the cause. | Accounts are not people |
| Give, then withdraw at the last second | Gifts can't be withdrawn before settlement. | None |
| Buying a catch by kindling | Only in the last 10% of the week, only a few givers short, at a doubling cost; a rescued fire never raises the goal. | Holders can subsidise a few givers each week |
| Re-registering a dead cause's name | A failed payout marks the cause dead forever; causes must be named accounts. | Re-registration before any payout fails is not caught |
| Self-referral and account splitting | The spark bounty moves weight from the newcomer to the spark. Total weight is unchanged, so fake friends earn nothing. | The referral count can be padded; no GOOD is gained |
| Colluding cause fakes a catch | New GOOD always costs at least 1.25× the floor, so recycled gifts buy nothing cheap. Causes rotate in a fixed order. | Not eliminated |
05
What we can't promise.
- 01
A colluding cause can fake a catch.
Its insiders give and get the 90% back off-chain. For a small holder that costs about 2% of the gifts and buys a fake streak, never GOOD below 1.25× the floor. Mitigated by curated DAO causes, fixed rotation and public flows. Not eliminated.
- 02
Accounts are not people.
Giver counts can be faked at a minimum gift plus the record fee per fake giver. Without collusion, 90% of that still reaches the cause.
- 03
Giving is giving.
At the floor, a giver's GOOD is worth about 8–9% of the gift on day one. It grows with every later fire that catches. It is not a return on the gift.
- 04
A smother destroys GOOD that was never minted.
It lowers the maximum supply, not circulating supply. Weeks with no gifts also smother, so an idle protocol slowly lowers its own cap and goal.
- 05
The chain verifies a transfer, not the good done.
The contract proves NEAR reached a curated account. What it funded is the cause's own report. A cause account deleted and re-registered by someone else before any payout fails would receive payouts.
- 06
Testnet causes and early givers are placeholders.
They are team-controlled and labelled as demo.
- 07
Holders can subsidise catches.
By kindling, holders can cover up to a quarter of the base goal (at least 1, at most 17) givers a week, at a doubling cost in burned GOOD. Rescued catches never raise the goal.
The backing floor is denominated in NEAR. It is not a guaranteed market price or USD value.
Check it yourself.
Every claim on this page can be verified with a read-only command.