Keep your wallet yours.

Two rules we never break

1. We will never message you first. Not on X, not on Telegram, not anywhere. If someone DMs you about this project, it is not us, whatever the profile picture says.
2. We will never ask for your seed phrase or private key. Nothing legitimate ever needs them. Anyone who asks is stealing from you, and asking is the entire scam.

Our real addresses (Robinhood Chain · 4663)

An attacker can deploy a contract at an address that looks like one of ours if you only read the first and last few characters. So compare the whole thing, or click through to the explorer and check it there.

A quick sanity check that costs nothing: our addresses all start with 0x1DFE… (RIGS), 0x6ACC… (GMTS) and 0x9111… (treasury). If something asks you to approve a contract that is none of the above and none of the five named in the next section, so stop.

Approvals: know what you have signed

An approval is permission for a contract to move a specific token out of your wallet. Marketplaces need it; it is normal. The part to understand is that an approval has no expiry and no spending limit unless the contract chooses to add one, so it stays active until it is used or revoked, and you will not be asked again for that token.

That is the whole reason this page exists: not to alarm you, but so you can look at the list yourself and decide which permissions you still want standing.

Only these ever need an approval from you

• RIGS, when you stake with the older staking contract. (The new no-custody staking needs no NFT approval at all.)
• GMTS, when you lock a boost, or buy a specimen paying partly in GMTS.
• The specimen certificate contract, when you buy a rock with USDG or GMTS.
• OpenSea or Seaport, only when you list something for sale yourself.

Nothing else. If a page asks you to approve any other contract, it is not us, no matter how much it looks like us.

How to see and take back what you have given

1. Open a revoke tool (revoke.cash is the well-known one) and connect the wallet you actually use.
2. Switch it to Robinhood Chain · 4663.
3. Read the list. Anything you do not recognise, revoke it. Revoking is a normal transaction and costs a small amount of gas.
4. Revoking never unstakes anything, never moves an NFT, and never touches earned GMTS. It only removes permission. Nothing is lost by revoking.

Is this the real site?

• We only ever link to it from our own accounts. A link in a DM, a comment, or a reply is not a link from us. Check the domain letter by letter before you connect anything.
• Real pages never ask for a seed phrase. Not to "validate", not to "migrate", not to "restore". There is no such feature and there never will be.
• Be suspicious of urgency. "Before it expires", "last chance", "your wallet is at risk, act now". The rush is the weapon. Nothing here is ever that urgent.
• An unexpected mint or claim is bait. If you did not ask for it, it is a trap that exists to get one approval out of you.

If something has already gone wrong

1. Move what is left, first. If the wallet is compromised, send remaining assets to a fresh wallet whose key has never touched that machine. Speed matters more than tidiness.
2. Revoke every approval from the compromised wallet, even though it is now empty, which stops a future deposit being taken too.
3. Do not pay a "recovery" fee. Nobody can reverse a blockchain transaction. Services promising to get your assets back are taking a second payment from the same victim.
4. Write down what you signed, and when. The transaction hash, the contract, the site you were on. That record is the only thing that helps afterwards.
5. Assume any key that was on that computer is gone forever. Do not reuse it, and do not reuse a key you have ever typed into a website.

Contract rules you can verify, not trust

The four vault contracts in our open-source repo (the commitment vault, the token locker, the vesting vault and the barter contract) were written with no owner, no pause, no upgrade path and no rescue function. There is no administrative key that can redirect anything, because no such function was written. Verify it rather than taking our word for it: the source is public at github.com/goodsmash/goodsmash-vaults and the compiled contracts are readable on the explorer.

One honest limit: a contract with no owner can also never fix a mistake or recover a token sent to it by accident. That trade was made deliberately. A rescue function that saves one person's stray token is the same function that opens someone else's lock.