Three layers: the edge shield stops spam countries and bots at the door, the human gate stops scripted mints, and the contracts make it impossible to rug, sweep, or mint free supply. Plus the full walkthrough of what happens to your money after you buy.
Every request is checked at the network edge before any page or API runs. 43 countries/regions are denied with a 403 — no HTML, no page load, no fingerprint. Bots behind datacenter IP ranges, bare-IP calls, and headless scraper user-agents are blocked too, while search engines and AI crawlers stay reachable. Vulnerability-scanner and secret-probe paths (/.env, /.git, wp-login.php, xmlrpc.php,phpmyadmin, .aws, trace.axd, …) are refused at the edge before they can touch the app. Mobile-wallet in-app browsers (MetaMask / Trust / Coinbase) areallowed — they are real users, not bots.
The mint button stays locked until a client-side human check passes: a hidden honeypot field (bots fill it, humans never see it), a minimum reading time (bots answer in milliseconds), and a simple “which one is the squirrel?” puzzle — trivial for people, annoying for scrapers. This sits on top ofthe contract’s own EOA-only + cooldown + per-block cap defenses.
Follow one purchase from your wallet to the real-asset basket. Every step is on-chain and verifiable.
Your wallet signs the mint: X ETH, EOA-only, cooldown + per-block caps enforced by the contract. No bots can front-run you.
The mint fee is forwarded to TokenLaunchFeeLoop. Reentrancy-guarded. 0 amounts rejected. Exact 10/40/50 split, enforced at deploy.
Banked for future stock buys, voting windows, and the recap backstop. Owners can only withdraw it to a destination — never to themselves.
Sits in a governed vault. The DAO can vote to push it into index assets — a real buyback of real things at Chainlink floors.
This leg is minted as a Treasury Vault Unit NFT pegged to the composite basket. Units × basket mark = vault value. Your NFT IS that 50% leg.
Every 24h epoch, CompoundingVault re-invests idle revenue into the basket. Keeper-incentivized. Stale oracle → fail-closed revert, never a blind price.
markOf(tokenId) = units × real basket mark, live. The NFT is tradeable against the mark whenever you want, even when stock markets are closed.
Owner cannot mint NFTs into his own wallet for zero cost.
Fee-loop treasury is only withdrawable by owner to a destination address — audited on-chain, not a single-wallet drain.
Changing the 10/40/50 split emits AllocationChanged publicly; the constructor requires bps to sum to exactly 10,000.
Any stale or zero oracle feed reverts the whole composite mark. Nothing trades on garbage.
Every money-moving function is ReentrancyGuard-protected.
Zero-amount fee submissions revert (require amount > 0).
Strict Content-Security-Policy, X-Frame-Options DENY, nosniff, permission-less (no camera/mic/geo), powered-by header removed, single-edge region deployment.
Full contract audit log → /security/audit
Honest note: the live testnet V2 contract (0xb87Ff5…) is sale-open with maxPerWallet 10, supply 4,444, EOA-reject + cooldown + per-block cap + lifetime cap present in latest source — but the deployed testnet bytecode predates those specific getters (they revert on read). They ship with the mainnet deploy, where they are enforced from block zero.
This page and the live checks are honest: the geo-block list and defenses are shipped in the deployed build. Nothing here is financial advice and nothing here is a securities offer.