Security & limits
Not audited
GENESIS has not been audited. Treat the contracts as pre-audit code and don't deploy them with significant value until they've been reviewed.
Design guarantees
- VRF and Beacon: for a given key and input there is exactly one valid output, and the contract checks the proof. Operators can delay results but not choose them.
- Fair Selection: entrants are frozen before the seed exists, and winners can be recomputed by anyone.
- Automation: keepers never supply perform data. The registry re-runs
checkUpkeepon-chain. - Oracle: threshold signatures from distinct signers, then a median. Reports are bound to the chain, the contract, the feed and the round.
- Discounts: based on stake, not balance, so flash loans don't work.
- Payments: fee-on-transfer tokens are rejected, and exact-gas calls protect callbacks.
Known limitations
| Area | Limitation | Mitigation |
|---|---|---|
| ECVRF | Custom keccak-based suite on secp256k1, following RFC 9381's structure | It won't match RFC test vectors. Get it reviewed |
| Liveness | Operators can refuse to answer. There's no request timeout, refund or VRF slashing yet | Run several operators with separate keys |
| Beacon | One key per deployment | A threshold beacon would remove this trust point |
| Automation | Keepers are paid for performs that revert inside the target | Make targets re-validate and fail cheaply |
| Commit–Reveal | The last revealer can withhold (one bit of influence) | Bonds larger than that bit is worth |
| Fair Selection | Up to 5,000 entrants; getWinners gas grows with entrants × winners | Split large draws |
| Owner powers | The fee-manager owner sets prices and the GENESIS/HYPE rate. Staking owners can slash | Use a multisig and a timelock |
| Rates | A fixed GENESIS/HYPE rate drifts from the market | Use a price feed once GENESIS trades |