🔓 Your money always has an exit
Every market state ends in a payout or a refund, and the exits are permissionless: anyone can resolve after the sampling window, anyone can force-void after 24h of keeper silence, voids refund every stake, losers reclaim their account rent. A dead operator cannot strand your funds.
🧪 Every drain we found is fixed and re-attacked on every change
Three adversarial audit passes found real critical bugs — oracle-steering drains, a forged-price drain, a round-recycling over-claim. Each fix ships with an exploit test that attempts the drain and must fail. The suite re-runs on every program change.
🧮 Payouts can't overdraw the pool
Parimutuel with floor-division math: the sum of all claims is provably ≤ the distributable pool, and the vault can never drop below rent while any position is unclaimed. The protocol holds zero inventory — it takes a rake, it never bets against you.
⛓ Settlement reads the chain, not us
Prices come from on-chain pool reserves — the median of multiple time-spaced reads, each requiring a sustained confirmation, collected over a mandatory window. No off-chain price feed, no operator-submitted number, no single instant to snipe.
🙈 Betting is blind by design
Cohort waves lock before their member tokens are even known, and the short bet window closes before the typical dev-exit lands. What makes the game fair to you also makes it unrideable for insiders.