Trust
Security
The latest audit and what it found, what you have to trust, what the admin can and cannot do, and the limitations that remain at launch.
1. Latest audit
The most recent independent audit was completed on 5 October 2026. It covered the final mainnet configuration of the ROOT price oracle and every contract that reads it: the launch burn, scorer registration and per-score burns, and the ROOT buyback. The oracle is the keeper-free design: the time-weighted price from ROOT's own pool multiplied by Chainlink's ETH/USD price.
The audit was read-only. Every finding is backed by a source read or a proof-of-concept test against the real pool code.
| Severity | Found | Status |
|---|---|---|
| Critical | 0 | — |
| High | 1 | Fixed in the code; a residual risk is accepted (section 6) |
| Medium | 3 | 2 fixed; 1 fix scheduled before mainnet (section 6) |
| Low | 7 | 4 fixed; 1 fix scheduled before mainnet; 2 accepted (section 6) |
| Informational | 7 | Confirmations of correct behaviour, and documentation fixes |
What it confirmed. The price accumulator is correct, including when its history buffer wraps around. Permissions, units, both token orderings, Chainlink handling and every fail-closed path are sound. A quiet pool with a single trade cannot be used to move the price.
1.1 Findings and fixes
| Severity | Finding | Fix |
|---|---|---|
| High | ROOT trades in one pool, so nobody arbitrages a skewed price back. Holding the 30-minute average at twice its value cost only the pool's round-trip fee, which made every dollar-priced burn cheap to underpay | Burns are charged at the lower of the 30-minute and 4-hour averages, so a short pump cannot cut the price; the documented cost model was corrected |
| Medium | A large buyback at a known time could be sandwiched slowly: pump, hold one window, let the buyback buy at the inflated price, dump | The buyback now runs every 3 hours and spreads each batch in small equal slices across the next 3 hours, so there is never one large, predictable buy to front-run. Each slice is floored by the same protective price read, the buyback holds while the 30-minute and 4-hour averages diverge, and each call is capped |
| Medium | Starting the oracle from the live spot price let anyone skew its first reading at deploy | The starting price is set explicitly and must be within 5 % of the live price, or the deploy stops |
| Medium | A pushed-down price combined with an unlimited ROOT approval could over-charge a creator | Scheduled before mainnet: the app will approve only the exact ROOT each burn needs. Until then each burn is bounded by an on-chain maximum, and the protective price read makes pushing the price down expensive to hold |
| Low | 32-bit timestamps would have stopped every ROOT trade in the year 2106 | 64-bit timestamps and wrap-safe arithmetic |
| Low | A small price spike at the scheduled time could defer the buyback | A held slice simply moves to the next slot; with slices every few minutes and a new batch every 3 hours, a spike delays at most one slice |
| Low | The launch burn's oracle pointer can be changed instantly by the Safe, unlike the other oracle pointers | Scheduled before mainnet: the same 48-hour timelock as the others |
| Low | The first swaps after launch paid extra gas to open price-history slots | The history buffer is pre-filled at genesis |
| Low | Monitoring compared the average with the live price only, so a sustained skew went unnoticed | Alerts also fire when the 30-minute and 4-hour averages diverge |
The scoring and scorer-reward contracts were audited the same day; every high and medium finding there was fixed, except the conservative scorer cap, which is kept by design (section 6).
2. Trust assumptions
| You trust | For | Bound |
|---|---|---|
| The Eden Safe (2-of-3, hardware wallets) | Parameters, pointers, keeper roles, opening launches | 48 h public timelock on loosening; cannot touch curve/pool funds, locked liquidity, vesting or claims |
| The attestation signer (one key in v1) | Publishing each epoch's scores | 72 h challenge window; adjudicators can dispute; human scores are on-chain |
| The scoring oracle | Fetching and normalising private business data honestly | Inputs archived per epoch; scores are Eden's assessment, not a trustless measurement |
| Adjudicators (Eden reviewers) | Disputes and the manual "Verified" flag | Verification changes only the creator floor and score cap; never automatic |
| Keepers | Running sweeps, buybacks, proofs and snapshots on time | Every amount bounded on-chain; missed runs delay payouts, never lose funds |
| Chainlink | ETH/USD and stock prices | Max-age bounds; burns and buybacks fail closed when stale |
| The ROOT/ETH pool | ROOT price via TWAP | Protocol-favourable 30 min / 4 h read; see section 6 |
| Robinhood Chain sequencer and token issuers | Ordering, liveness; stock token transfers | Stock issuers can block addresses or pause transfers; Eden cannot override |
3. Admin powers
The Safe can, immediately:
- stop new launches (existing curves and pools keep trading; sweeps and claims continue);
- tighten any bounded parameter;
- grant and revoke keeper, poster, publisher and attester roles.
The Safe can, after a 48-hour public timelock:
- re-point fee routing, scorer rewards, buyback, oracle, feed, holder, index and creator-routing contracts;
- loosen parameters within their hard-coded bounds (for example the scorer cap 0.01–100 %, the ROOT pool fee 1–3 %, oracle max ages within their bounds);
- wire price feeds, scorer reward assets and buyback settings for pair assets.
The Safe cannot:
- mint ROOT or any launch token;
- move tokens out of a bonding curve or a graduated pool, or unlock locked liquidity;
- unlock creator or team vesting;
- change a live launch's supply or curve;
- redirect anyone's holder payout, scorer reward or creator fee (claims pay only the owning wallet);
- add a creator tax above 0 for existing launches (the ceiling is 0 and Eden's policy keeps it there).
There are no upgradeable proxies. A new contract version is deployed next to the old one and switched in through the timelock.
4. Keys
- Every role (fee keeper, quality keeper, holder poster, attestation signer, index publisher, identity attester, ops admin, adjudicator, deployer) is a separate, fresh EOA with no EIP-7702 delegation. A preflight script checks this on-chain before ownership hand-off and before launches open.
- Role keys live in a secret store, never in git, chat or terminal history. A leaked key is rotated with a Safe transaction (rehearsed on the demo).
- The deployer holds nothing after the ceremony and is drained.
- Safe owners sign on hardware wallets.
5. Pause and recovery
| Situation | Response |
|---|---|
| Something wrong after launch | Safe stops new launches in one transaction |
| Wrong parameter | Queue the fix; it applies after 48 h (tightening applies at once) |
| Keeper key leaked | Stop ops, rotate the role via the Safe |
| Ops primary down | Hot standby takes the lease automatically |
| Chainlink stale | Burns and buybacks fail closed until it updates; trading is unaffected |
| Indexer down | UI falls back to receipts and RPC |
| RPC provider down | Automatic failover to the next provider |
6. Known limitations at launch
| Limitation | Effect | Mitigation / plan |
|---|---|---|
| ROOT trades in one pool | Moving the TWAP costs only the round-trip pool fee; a held pump can lower USD-pegged burns after the 4 h anchor catches up | Protocol-favourable read; buybacks in small slices every few minutes rather than one large buy; divergence hold; monitors; deepen liquidity or add a venue |
| One attestation signer | Scores are Eden's signed assessment | 72 h challenge window; more signers and published adapter specs planned |
| No sequencer-uptime feed on the chain | After an outage a Chainlink answer up to 25 h old could price burns | Age bound and ops alerts at 50 % / 90 % of max age; wire the feed via the timelock if one appears |
| Conservative scorer cap | With few scorers, lighter scorers earn less than an exact capped share; the rest is burned | Documented; the cap can be raised through the timelock if early pools are thin |
| No narrow emergency pause | The only instant brake stops new launches, not trading or buybacks | A guardian that can only tighten is proposed as a post-launch upgrade |
| Timelocks block hotfixes | A loosening fix takes 48 h | Known changes are pre-queued before launches open |
| Stock pair buyback routes | Stock assets without a route to ETH accumulate in the buyback vault | Multi-hop routing proposed as an upgrade |
| Scheduled audit fixes | The ROOT approval for the launch burn is unlimited; the launch burn's oracle pointer is not timelocked | Both land before mainnet launches open |
| Stock and ETH price freshness | Each feed is checked against its own maximum age; consumers' shorter age limits do not apply on top | Per-asset age bounds; burns and buybacks fail closed when a feed is stale |
| Oracle-priced writes | Gas at inclusion can exceed the estimate | The UI and keepers pad gas for these calls |
| Immutable on-chain text | A launch description cannot be erased | The UI masks personal identifiers |
| Slashing | Off at launch | Enabled only after the full dispute flow is live |
7. Reporting a vulnerability
Security reports: [security contact — to be published].