Security
Read the contracts before you trust them
Experimental contracts, unaudited. This page names every role, what it can do and what binds it.
The owner can never move capital
Invariant I7, checked by the fuzzer: no owner function reaches bond capital, premium balances, earned premium or compensation.
Owner
A TimelockController with a 48 h minimum delay on BondBook, ProbeLog and Compensation. Proposer and executor: the machine wallet.
Sets parameters inside the bounds written in the code, adds or removes probers, sets the guardian and the publisher, withdraws the protocol reserve and ETH nobody is owed. Every change waits 48 h in public.
Prober
Decides what was measured. One key today.
It could report failures that did not happen. The outage rule voids windows where half the services fail at once, every raw record is published with its proof of time, and a second prober turns each slot into a majority vote.
Registrar
Adds watched services and records claims after checking /.well-known/bond.json.
It cannot touch money. A claim only names the operator who may issue a bond.
Compensation publisher
Posts the customer list of a slashed epoch as one Merkle root.
The contract refuses a root above the slash and any leaf above 3x what that customer paid. The list is recomputable from public USDG Transfer logs, so a wrong root can be shown wrong.
Guardian
Can pause new issues and new backing.
Exits, settlement, compensation claims and premium claims never pause.
Binder
Binds the $PBI token address.
Once, irreversibly, outside the timelock, when the token exists. It opens the $PBI legs and nothing else.
Relayer
Pays the gas of passkey accounts and settles x402 payments.
It submits what a passkey or a payer signed. It cannot sign for them, and it only pays for calls to PBI's contracts, USDG and $PBI.
Timelock
0x30a9DA9b...74ddBondBook
0xe43B9179...5292ProbeLog
0x091A79A6...e387Compensation
0xE6774598...C272Passkey account factory
0x88FfDB2E...4571Tests run on every build: unit tests, fuzzing of the slash formula, the invariant suite, and fork tests against this chain with real USDG, the Pons fee escrow and the Chainlink feeds. Found something? Write to the X account in private; the dev log records every fix with its transaction.