DocumentationSafety

Safety

The lifecycle rules that keep acquisitions, withdrawals, refunds, and transfers bounded.

  • Depositor-only withdrawal. A position's NFT and its ETH backing can only ever be withdrawn by the depositor who paired them. Active exits wait until every issued acquisition is terminal. Each request has a fixed word deadline, but sustained queued activity can keep withdrawals unavailable for an extended period. The owner can never withdraw, move, or seize a depositor's pairing.
  • Loading phase. The pool deploys with acquisitions off, so positions can be stocked before the protocol goes live.
  • Ordered anti-steering. Requests settle in the order they were created, so a later callback cannot jump ahead. New deposits wait in a first-in-first-out staging line while requests are open, and a missing request can expire after its fixed deadline. Withdrawals and repricing remain locked until the acquisition queue is empty2.
  • Emergency exit. The team can halt acquisitions and new deposits. Already-issued requests must still process or expire; then active positions may exit normally. Staged positions cannot be cancelled: once the queue is idle, anyone can activate them and the depositor can withdraw through the normal path.
  • Collection whitelist (optional): gates only new listings and relists. Existing positions, allocations, and settlements remain usable. The manager supports owner curation, sticky blocking, and an optional TTT transfer-to-dead-address path; that path launched disabled on mainnet because its required amount was set to zero.
  • Minimum backing (optional): a floor that keeps dust positions from distorting prices and selection weights.
  • Hardened transfers. Standard reentrancy protection and effects-before-interactions apply throughout. Expiry, empty-pool, and slippage refunds become pull credits, so a hostile recipient cannot block ordered processing. Other ETH legs use a non-reverting transfer helper1.

Admin powers are contract-specific. Owners can pause operations, tune bounded settings, manage market and claim gates, and configure future fee routing. They cannot withdraw a depositor's escrowed NFT or backing, or redirect accounted depositor and purchaser ETH credits. Token rewards are administered separately: in withdraw-only migration mode, after open requests clear, the rewards owner can move remaining reward supply to a replacement deployment, so an announced claim window matters. On mainnet, the independent splitter owner also controls the split for future receipts and may close claims and sweep residue after one year.

Technical breakdown

  1. 1.
    Solady ReentrancyGuard (nonReentrant on state-changing entry points) with effects-before-interactions ordering. ETH is sent via SafeTransferLib.forceSafeTransferETH, which can't be reverted by the recipient. Acquisition refunds accrue in acquisitionRefundCredit and are pulled with withdrawAcquisitionRefund; the VRF service fee paid for callback coverage is never part of that credit.
  2. 2.
    The selectable pool can mutate only after every earlier request is terminal. An authenticated callback records an on-time word; the public processor later advances ready requests in order. Strictly after the next request's snapshotted deadline, anyone may expire it and let later ready work proceed.