Contracts
Seven contracts covering the state machine, token-bound registry, vault, fee router, distributor, and two phase-2 modules — with no admin key on the distributor, ever.
DsupSpecimen.sol ERC-721, state machine (HYDRATED / TUN /
REHYDRATING), tunSince, survivorMarks,
transfer guard on non-hydrated states,
state-reactive tokenURI
DsupRegistry.sol ERC-6551 binding, deterministic TBA addresses,
seed-at-mint loot table resolution
DsupVault.sol swap / snipe / deposit, inventory accounting,
reserve floor guard, ETH fee collection
DsupRouter.sol fee intake → 35/35/20/10 split, stock-token
swap execution, epoch accounting
DsupDistributor.sol weekly epoch, dual-pool weight snapshot,
direct-to-TBA transfer, permissionless
distribute() + caller bounty
DsupEvents.sol [phase 2] commit-reveal rounds, trait-weighted
odds, parimutuel settlement, survivor marks
DsupLoans.sol [phase 2] HYDRATED-only collateral, LTV = 50%
of vault deposit price, liquidation = forced
vault deposit
Non-negotiable:
- No admin key on the distributor. None. Not a pausable, not a guardian.
- Vault parameters behind a timelock.
- Weight math frozen and tested before mint, not patched after.
- ≥95% branch coverage on the distributor and the state machine specifically.
- Third-party audit before the vault holds meaningful inventory.
DsupSpecimen.sol is the only contract that can block a transfer, and it does so with a single guard checked on every transfer hook: revert unless state == HYDRATED. Every other contract — vault, router, distributor, events, loans — inherits that restriction by calling into the specimen contract rather than re-implementing it, which is the same "guard lives at the source, not at each call site" pattern used for the vault's deposit-blocking in §6.
No admin key on the distributor specifically (not the whole protocol) means the weekly distribute() call, the 35/35/20/10 split, and the tun weight table cannot be changed by anyone post-deploy — including us. The vault's timelocked parameters are a deliberately smaller set: the fixed price X and the 20% reserve floor, both of which may need real-world tuning that the distributor's core math should not.