Deployed bytecode cannot be replaced through a proxy or administrator.
Verify the evidence, not a promise.
Luckotto V1 is non-upgradeable software with published source, reproducible build artifacts, executable cryptographic evidence, and public settlement inputs. Production operators must still own monitoring, resolver availability, transaction submission, and customer operations.
Published source and compiler input are tied to the configured deployment.
Ethereum vectors, drand beacons, Noble comparisons, and four execution clients are covered.
No managed uptime, monitoring, resolver, support, or response-time SLA is provided.
Completed evidence
Executable checks across every critical layer.
The repository records commands, pinned sources, fixtures, and expected results so another reviewer can repeat the checks.
Authoritative precompile vectors
All 64 valid and invalid cases used by production for G1 addition, pairing, and map-to-G1 pass against pinned Ethereum execution-spec vectors.
Official drand implementation
64 Quicknet beacons accepted by the official Go implementation reproduce the same hash-to-curve points and accepted signatures in Solidity.
Noble implementation comparison
32 generated key/signature pairs match Noble’s G1 hash-to-curve output; correct pairs pass and the full wrong-key matrix fails.
Four-client differential
Geth, Reth, Besu, and Nethermind completed 199,216 calls with zero cross-client mismatches, including exhaustive bit mutations.
Gas boundary checks
Local, mainnet, and Sepolia checks cover the exact native precompile gas boundaries used by the verifier.
Exact deployed bytecode
Read-only mainnet and Sepolia simulations match the compiled runtime template and exercise the deployed verifier behavior.
Canonical settlement fixtures
Real mainnet and Sepolia headers and Quicknet beacons drive forked placement, settlement, and claim paths; mutated inputs revert.
Symbolic and static checks
Halmos proves early rejection properties, while Slither and the regression suite cover contract and application boundaries.
Public inputs still depend on live infrastructure.
- Ethereum network liveness, canonical block history, and working EIP-2935 storage
- Correct EIP-2537 behavior across the execution clients processing transactions
- Quicknet beacon availability and the pinned distributed public key
- RPC availability for reads, transaction submission, and recent-block confirmation
- Sufficient transaction fees and inclusion before the settlement proof deadline
Protocol evidence does not operate the casino.
- Validate beneficiary wallets before committing immutable positions.
- Archive exact ticket files and signed customer receipts without publishing PII.
- Run redundant RPCs, canonical event indexing, resolver monitoring, and alerts.
- Explain variable payout, settlement timing, expiry, and claim responsibilities.
- Complete claims and any bankroller exits before the delayed wind-down failsafe.
Reproduce locally
Run the same offline evidence.
Networked checks require explicit read-only RPC configuration. The packaged source, compiler input, hashes, and ABI remain available from the resources page.
cd contracts
make security-corpus-test
make security-generated-check
make security-formal
make check