Security

Security model

What the code guarantees, who holds which keys, and what still requires trust.

Enforced on-chain

Funds leave the prize vault only through settle(), to the wallet whose committed ticket range contains the winning ticket. There is no withdraw instruction.
A snapshot is committed once per round and can never be replaced. Randomness bound to it must not exist before the commitment.
Each round pays at most once. Prizes are reserved when a snapshot is committed so overlapping rounds can never spend the same funds.
Retrying randomness is refused while the current randomness is available, so it cannot be used to discard an unfavourable result.
Revealed rounds cannot be cancelled. Open rounds can only be cancelled before they close while the lottery is paused.
Only the program upgrade authority can initialize the program; admin transfers are two-step.
Rules and the exclusion list are frozen into each round when it opens. Exclusion lists are versioned and immutable once activated.
All arithmetic is checked; release builds also enable overflow checks.

The admin can

Change parameters and exclusion lists for future rounds (not running ones).
Pause and unpause the lottery (the operator may only pause).
Rotate the operator key and transfer the admin role (two-step).
Start the first round; cancel rounds only in the cases listed above.

Under the deployed code, nobody can

Withdraw or redirect prize funds.
Choose, change or veto a winner.
Edit a committed snapshot or a past round.
Reroll randomness that has been delivered.

Upgrade authority caveat: Solana programs are upgradeable unless their upgrade authority is revoked. Whoever holds that authority could deploy different code, including code that moves vault funds. Check the program's upgrade authority on Solana Explorer (linked from the transparency page); a revoked authority, or one held by a public multisig with a timelock, removes or limits this risk.

Off-chain components

The keeper holds an operator key that can start rounds, commit snapshots and request randomness; it cannot move funds. The website holds no private keys at all. Admin pages require a signed, single-use, domain-bound sign-in message plus an on-chain admin check on every request, and every privileged action is a transaction the program authorizes on its own. See Transparency for what remains trusted.

Stay safe

Nobody from The Lotto will ever ask for your seed phrase or private key.
You never need to send funds to “claim” a prize — payouts are on-chain transfers to the winning wallet.
Verify the $LOTTO mint address and this website's domain before every transaction.

Found a vulnerability? Please disclose it privately to [CONTACT EMAIL]. Do not test against mainnet funds.

Enforced on-chain

Funds leave the prize vault only through settle(), to the wallet whose committed ticket range contains the winning ticket. There is no withdraw instruction.

A snapshot is committed once per round and can never be replaced. Randomness bound to it must not exist before the commitment.

Each round pays at most once. Prizes are reserved when a snapshot is committed so overlapping rounds can never spend the same funds.

Retrying randomness is refused while the current randomness is available, so it cannot be used to discard an unfavourable result.

Revealed rounds cannot be cancelled. Open rounds can only be cancelled before they close while the lottery is paused.

Only the program upgrade authority can initialize the program; admin transfers are two-step.

Rules and the exclusion list are frozen into each round when it opens. Exclusion lists are versioned and immutable once activated.

All arithmetic is checked; release builds also enable overflow checks.

Under the deployed code, nobody can

Withdraw or redirect prize funds.

Choose, change or veto a winner.

Edit a committed snapshot or a past round.

Reroll randomness that has been delivered.

Off-chain components

Stay safe

Nobody from The Lotto will ever ask for your seed phrase or private key.

You never need to send funds to “claim” a prize — payouts are on-chain transfers to the winning wallet.

Verify the $LOTTO mint address and this website's domain before every transaction.

Found a vulnerability? Please disclose it privately to [CONTACT EMAIL]. Do not test against mainnet funds.