- /disclaimer: independent-resource, affiliate, earnings, risk, and
not-advice disclosures; linked from all footers.
- Self-service alerts: members opt in with their email on /my/:id to get
"you've been paid" + "upgrade needed" emails for their own position
(same watcher as the owner alerts, extended). Signed unsubscribe link
(/unsubscribe?id=&t=HMAC), on-chain-registration check, rate-limited,
masked-email status, confirmation email.
- Admin login: timing-safe compare + per-IP lockout (8 fails -> 15 min,
escalating). Previously unlimited/brute-forceable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Source submitted and Exact Match confirmed on Polygonscan (TRUSTCorona,
Solidity 0.8.28) via the CDP-assisted flow. The two-registry explainer
becomes a both-registries-verified statement.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A team member checked Polygonscan and saw unverified bytecode while the
page claims verified source. Both true: the source is exact-match
verified on Sourcify; Polygonscan is a separate registry nobody
submitted to. The page now explains the two-registry situation, that
the displayed bytecode is identical, and that Polygonscan publication
is in progress.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Shareable page from the 2026-08-13 source review: code immutability
(no proxy/delegatecall/selfdestruct, Sourcify exact match), same-tx
distribution (no pooled funds), locked prices and fee constants, the
honest list of owner powers with the 50% entry-fee cap, where unmatched
pass-ups go, and verify-yourself links. Linked from all public footers,
the payment-proof note, and the chatbot (canned + AI prompt).
Also: passed-over lists now exclude structurally-skipped uplines — a
level-N payment never checks the first N-1 uplines, so listing them as
"not eligible" was misleading.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
martbost