Safety
Security
How the contracts are designed and tested, the audit and capped beta, known attack surfaces, and how to report a bug.
Contract design
The core contracts are non-upgradeable. Once they are deployed, nobody can change their code, Hardfloor included, so the floor rule cannot be rewritten after launch.
The floor updates in small steps on every swap instead of in large jumps: no single trade can raise it by more than its own floor fee, and payments into a floor add at most 2% of its reserve per second. That leaves no large floor update for a bot to trade ahead of.
Invariant tests
Invariant fuzz tests throw long random sequences of actions at the contracts and check, after every step, that three statements still hold:
- The floor never falls.
- The reserve always holds enough to pay the floor price for all circulating coins, apart from coins locked as loan collateral.
- No round trip makes money: buying and then selling back cannot return more than it cost.
If any statement breaks even once, the test fails.
Audit and capped beta
- An external audit happens before any real money goes in.
- A capped beta follows, with a reserve limit per coin, so the amount at stake stays small while the contracts meet real use.
- Phase 2 features (loans, one-click loops and Floor Wars) are covered by a separate audit scope.
Known attack surfaces
| Surface | Mitigation |
|---|---|
| Contract bugs | Non-upgradeable core contracts, invariant fuzz tests, an external audit and a capped beta. |
| Front-running floor updates | The floor moves in small steps on every swap, and payments into a floor add at most 2% of its reserve per second, so a buy placed just before an update loses more in fees than it gains. |
| Sniping at launch | An anti-snipe fee of 30%, 20% and 10% in the first three minutes that goes to the Floor Wars pot, so a sniper cannot win it back through the floor. |
| Bad fills and price moves | Every trade carries a minimum-out and reverts past it. A buy from another chain that would get fewer coins than its minimum sends the ETH to the buyer's address on Robinhood Chain instead. |
| Trading bots and aggregators | Tested against the hook pools before mainnet. |
| Farming Floor Wars (phase 2) | Ranking by wallets that bought at least $25 net and held, not by volume. Buys in a week's last day count toward the next week, and each winner receives at most 2% of the minimum per counted wallet, less than faking a wallet costs in fees. |
| Front-running Floor Wars payouts (phase 2) | Payouts go into floors in small pieces, at most 2% of a coin's reserve per second. |
| Money left in a coin everyone has sold | Below 1,000 circulating coins the floor does not rise, and anything above its backing goes to the Floor Wars pot, so the next buyer cannot claim it. |
| Price feed manipulation (phase 2 loans) | Loans use no oracle and have no liquidation price, so there is no price feed to push around. |
Reporting a bug
A public bug report address will be announced before the beta.
If you find a vulnerability before then, keep the details private until that address is announced and the issue can be fixed. Never include a seed phrase or private key in a report.