History and reviews
The record of how this was built and run, kept in the public repository and shown here.
Changelog
Every public release of the source code.
Incident log
Every recorded incident, and the problems caught before they mattered.
Security bounty
How to report a problem, the wallet and every decided report.
Verify a receipt yourself
Recompute a real receipt in a terminal.
Press kit
Logo files, a short description and the contact address.
Published reviews
Every review is published in full in the public repository, with the response to it where there is one. None of them is an audit by a security firm.
| Review | Status | Report |
|---|---|---|
| Blind review 1, by a new Claude agent that saw only the code and none of the builder's conclusions. It found 2 High, 4 Medium, 7 Low and 6 Info issues. Each one is fixed or documented in docs/burn-receipts/CHANGELOG.md. | completed 2026-10-09 | docs/burnticker/reviews/2026-10-09-claude-blind-1.md |
| Blind review 2, by a new Claude agent that had not seen the code before. It read the earlier reports only after writing its own findings. It found 5 Medium, 4 Low and 8 Info issues. | completed 2026-10-10 | docs/burnticker/reviews/2026-10-10-claude-blind-2.md |
| Blind review 3, by a new Claude agent that had not seen the code before. It found 3 Medium, 6 Low and 6 Info issues. The same report holds its re-check of the round-3 fixes, which found 4 Low and 2 Info issues. | completed 2026-10-10, review and re-check | docs/burnticker/reviews/2026-10-10-claude-blind-3.md |
| Pair review 1, by a new Claude agent that reviewed the pair program (pair_curve) blind, against a checklist written in advance. It found 2 High, 2 Medium, 3 Low and 3 Info issues. The exploit tests are committed. The fixes have not landed yet. | completed 2026-10-10, findings open | docs/burnticker/reviews/2026-10-10-pair-curve-blind-1.md |
| Pair review 2, by a second new Claude agent that reviewed the pair program blind. It looked hardest at the economics, at griefing and at whether the program keeps running. It found 3 High, 2 Medium, 4 Low and 5 Info issues. The exploit tests are committed. The fixes have not landed yet. | completed 2026-10-10, findings open | docs/burnticker/reviews/2026-10-10-pair-curve-blind-2.md |
| A re-check by a new Claude agent of the fixes for the pair program's blind reviews (commit 4eda2e3d). Every High is fixed. R2 M-1 is only partly fixed: a curve sell after the deadline and before void_pair is still possible. It found one new Low. Tests for what is left are committed (review_pc3.rs). This report was missing from this list until review 2 counted the report files on 2026-10-11 and found ten. | completed 2026-10-10 | docs/burnticker/reviews/2026-10-10-pair-curve-recheck.md |
| A blind review of the locked-liquidity release by a new Claude agent. It covered register_fee_key, claim_lock_fees and lock_lp in both programs, with the real Raydium lock program loaded in place of the mock. It found no Critical or High issues, 2 Medium, 3 Low and 8 Info. The exploit tests are committed and set to be skipped. Fixes are in progress. | completed 2026-10-11, findings open | docs/burnticker/reviews/2026-10-11-lp-lock-blind.md |
| A blind review of the winner-takes-the-burn release by a new Claude agent. It covered link_pair, submit_pair_result, forward_to_winner and the paired crank gate. It found 1 High: a losing coin's queue can get stuck when the conditions for the forward can never be met. It also found 2 Medium, 4 Low and 7 Info issues. The exploit tests are committed and set to be skipped. Fixes are in progress. | completed 2026-10-11, findings open | docs/burnticker/reviews/2026-10-11-pair-forward-blind.md |
| A re-check by a new Claude agent of the pair-forward round-2 fixes. H-1 and the Lows are closed. Part of M-1 is still open: a losing side's attesters can hold back its losses. It found one new High: the 30-day unlink evidence could unlink a healthy open pair. It also found one new Medium. The exploit tests are committed and set to be skipped. Round 3 is in progress. | completed 2026-10-11, findings open | docs/burnticker/reviews/2026-10-11-pair-forward-recheck.md |
| An adversarial review of a pull request by ChatGPT Codex, against the same checklist written in advance. It reviewed public commit 58d43eae. It found 2 High and 5 Medium new issues. It also found places where the checklist did not match the code, and issues left over in the pair program. Each one is answered in docs/burnticker/reviews/2026-10-10-chatgpt-pr-review-response.md. | completed 2026-10-10 | docs/burnticker/reviews/2026-10-10-chatgpt-pr-review.md |
| A second adversarial code review by ChatGPT Codex, with a review of the live site, against the same checklist. It reviewed public commit 07b7b4f5. It found three P1 issues. F1 is the order of the keeper's fence. F2 is that old unlocked pairs dropped out of the scan. F5 is the same as the pair-forward issues RN-1 and RN-2. It found three P2 issues: F3 on the launch confirmation, F4 on recovering from a failed signing, and F6 on reversed pair wording. It also suggested cuts to the site and found ten explanations that did not match. Each one is answered in docs/burnticker/reviews/2026-10-11-chatgpt-pr-review-2-response.md. F5 is handled in pair round 3. | completed 2026-10-11 | docs/burnticker/reviews/2026-10-11-chatgpt-pr-review-2.md |
| A third code review by ChatGPT Codex, of the changes from 782e31ec to 191d3b3b (public commit 191d3b3b). It found one P2, F1. When the program data account could not be read, the page showed 'upgrade authority none (chain)'. When a mainnet lookup failed, it showed 'not deployed'. The answer is in docs/burnticker/reviews/2026-10-11-chatgpt-review-3-response.md. | completed 2026-10-11, F1 fixed with regression tests | docs/burnticker/reviews/2026-10-11-chatgpt-pr-review-3.md |
| A third review by ChatGPT of how the live public site works and reads, checked against public commit 191d3b3b. It suggested ten practical changes, and nine are done. The launch summary shown before a wallet connects is on hold while creator launches stay closed. The answer is in docs/burnticker/reviews/2026-10-11-chatgpt-review-3-response.md. | completed 2026-10-11 | docs/burnticker/reviews/2026-10-11-chatgpt-ux-review-3.md |