π‘οΈ Security & Governance β
We'd rather tell you exactly where we stand than imply more assurance than we have. This page covers three things: how the code is reviewed, who controls what, and how to report a problem.
Audits β
Our contracts have been reviewed internally, with adversarial testing workflows, not by a paid external audit firm. We have not commissioned formal third-party audit reports, and we're not going to pretend otherwise.
What that means in practice:
- Reviews are conducted in-house, supported by multiple adversarial review passes designed to attack the contracts rather than confirm they work.
- The findings and the fixes are in the public repositories. Review notes, the issues raised, and the commits that resolved them are all readable alongside the code β for example, the marketplace stack carries its review documents in-repo.
- We do not issue formal audit reports or certificates.
What this is not
An internal review is not an independent audit. If your risk tolerance requires a third-party audit before you interact with a contract, it hasn't had one β please size your exposure accordingly.
What you can verify without trusting us, which we think matters more than a PDF:
- Both mainnet contracts are source-verified on Sourcify β the deployed bytecode provably matches the published source.
- $LAZY has no admin key and no supply key. It cannot be minted or reconfigured by anyone.
- The SCT and Lazy Secure Trade each hold their own contract ID as admin key β no person can delete or re-key them.
Details and reproducible commands: What cannot be changed.
Who controls what β
Different parts of the ecosystem sit behind different levels of control. Here is the honest picture, including the parts that are not yet where we want them.
| What | Controlled by | Status |
|---|---|---|
Smart Contract Treasury (0.0.1311003) β the entire $LAZY supply | 0.0.1310986 β 2-of-3 threshold key | β Multi-signature |
NFT treasuries (e.g. 0.0.697777 β Gen 1, Gen 2, Mutants, Mobsters) | Team account | β οΈ Single key |
Contract deployer (0.0.6284762) | Team account | β οΈ Single key |
The treasury that holds the $LAZY supply is the one that's already multi-sig β that's the position we prioritised, because it's where the value is. Verify the threshold yourself:
curl https://mainnet-public.mirrornode.hedera.com/api/v1/accounts/0.0.1310986The response contains a ThresholdKey with threshold: 2 over a list of three ED25519 keys.
The NFT treasuries and the deployer account are currently single-key. We're not going to describe the project as "multi-sig" without saying so. The multisig tooling to move them is built and in production use β the plan is to migrate them once the full deployment is complete.
Signers β
The 2-of-3 signers are team members. Signing keys are generated and held off-chain, so individual signers do not necessarily correspond to public Hedera account IDs β only the threshold account itself (0.0.1310986) is on-chain and inspectable.
Protect yourself β
A few habits that prevent most losses on any chain, not just ours:
- Check token IDs against π Contracts & Tokens before you buy or sign. Imposter tokens with identical names are trivial to create.
- Review allowances. An allowance you granted once persists until revoked β use Revoke Allowances to audit and clear them.
- We will never DM you first. No founder, team member or moderator will message you offering support, a mint link, or a swap. Treat any such message as a scam.
- Read what you're signing. A wallet prompt that asks for more than the action you initiated is a red flag.
Reporting a vulnerability β
Found something? Please tell us before telling the internet.
Email lazysuperheroes@protonmail.com with "SECURITY" in the subject, or open a ticket in our Discord and ask for a private channel with the dev team.
Please include what you found, how to reproduce it, and which contract or dApp is affected. Give us a reasonable window to fix it before public disclosure.
No formal bug bounty β yet
We don't currently run a paid bug bounty programme. That doesn't mean we won't recognise good-faith disclosure; talk to us. All of our code is open source, so review is welcome and encouraged.
Related β
- π Contracts & Tokens β every deployed ID, with verification steps
- π¦ NPM Packages β the open-source toolkit
- ποΈ Revoke Allowances