security and status
This program holds a mint authority and, once anyone stakes, other people's tokens. Below is what has actually been demonstrated and what has not, kept apart on purpose.
the ledger
Proven means there is an artifact or a test run behind it today. Unproven means the step has not been taken, not that it failed. Nothing here is described as safe, audited or verified.
Mint authority is revoked in the launch transaction
Compiled-program integration suite, including metadata and authority assertions
proven
No instruction accepts a token creator as a signer
Program source and independent review of the on-chain scope
proven
A solution for one token is rejected by another
Tenant isolation and cross-token replay cases in the integration suite
proven
Splitting a position across wallets does not multiply weight
Wallet-splitting case in the integration suite
proven
Direct transfers into a stake vault credit nobody
Donation case in the integration suite; liabilities stay bounded by the balance
proven
A lapped round stops resolving instead of returning newer numbers
Ring eviction covered by unit tests and by the integration suite
proven
Settlement cannot pay out more than a round reserved
Integer truncation, exercised across three weighted rounds with exact balances
proven
Proof verification fits the compute budget
Measured at 219,715 units against a 300,000 unit request
proven
The SBF build reports no stack-frame diagnostic
Verifier log grepped for stack, frame, exceed and error matches
proven
Two independent reviews found no remaining high-severity issues
One program review and one web transaction review, each within its reviewed scope
proven
The mainnet program bytes match the reviewed release artifact
The finalized ProgramData was dumped and hashed after deployment; it reproduces the release hash exactly
proven
The exact release artifact completes the deployed acceptance path
Two tokens, two wallets, three weighted rounds, exact claims and full withdrawal, run against the public devnet deployment with every transaction finalized
proven
The release build is reproducible from committed source
The pinned container build reproduced the release hash bit for bit on two separate runs. Remote CI has not yet repeated it
proven
The real browser wallet path works against the reviewed artifact
A real wallet completed the flow against the public devnet deployment, and the first mainnet token was launched through this client
proven
A full mining cycle has completed on mainnet
Mainnet has deployments and launches, but no mainnet stake, mine, claim and withdraw cycle has been observed yet. The same cycle is proven on devnet
unproven
An independent security firm has reviewed the program
Not commissioned. The program is live on mainnet without an external audit
unproven
Upgrade and fee control are protected by multiple independent signers
No. Upgrade and platform fee control sit with one key and fee receipt with a second, all held by one operator
unproven
The source is publicly readable
No public repository is configured, so the citations throughout this site are not yet checkable by you
unproven
check it yourself
The useful checks do not require trusting this site. All three read the cluster directly.
Confirm a token's supply cannot grow
spl-token display <MINT> --url mainnet-beta
Mint authority and freeze authority must both read as none. If either is set, the supply is not fixed, whatever any page says.
Confirm the program is what you were told it is
solana program dump <PROGRAM_ID> out.so --url mainnet-beta && sha256sum out.so
The release build hashes to 87223745e93c15d917c2fc4270c4003abb0bb146280deea8ad721ff4bba47ecd. The deployed mainnet program reproduces this hash. A different hash means a different program.
Read a token's frozen parameters
solana account <CONFIG_PDA> --url mainnet-beta
The config PDA is derived from the seeds lode-config and the mint. Supply, round length, halving interval, difficulty target and creator allocation are all in it, and no instruction writes to any of them after launch.
standing prohibitions
Recorded in the repository as rules for anyone working on it, so they survive a change of contributor rather than living in someone's judgement.
No admin, update instruction or economic setter may be added to a launched token.
The token mint may never be removed from the Equihash input block.
The creator allocation ceiling may not be raised above 10% without an explicitly recorded decision.
No random-payout feature: no jackpots, lotteries or prize draws.
No difficulty retargeting.
No claim that a deploy, test run or devnet flow succeeded without the actual output.
reporting
There is no published security contact yet. Saying so is more useful than publishing an address nobody is committed to monitoring. The program is live on mainnet without a disclosure channel or an external audit; weigh both as part of the risk here. §9.3