Security and trust
What POMY controls, what it cannot control, and how you can check.
What is on chain
Everything below lives on Solana:
- The $POMY token and every transfer of it.
- Every fee harvest into the vault.
- Every card purchase and every transfer to a holder.
- Every card's existence as a Collector Crypt vault token.
What is off chain, and how it is kept honest
- Hourly accounting (windows, time-weighted balances, credits) runs in POMY's database. Every window is reproducible from public data; see Reproducing a window.
- Draw selection uses a snapshot committed before a public blockhash exists, so POMY cannot choose or influence the winner; see The draw.
Keys and custody
- The vault's Solana wallet is controlled by POMY. Its address is published in the site footer. All outflows are visible on chain.
- The Solana signing key lives only in the fulfilment worker, never in the website. Spend is capped per hour and alerts fire on unusual activity.
- POMY never holds your $POMY, never has access to your wallets, and cannot move anything out of your wallet.
What POMY could do wrong, and the mitigations
| Risk | Mitigation |
|---|---|
| Mis-count credits | Every window reproducible; independent reconciliation against the chain via a public RPC; incidents published. |
| Rig a draw | Commit-before-seed; public blockhash; open verification script. |
| Not deliver a prize | Purchase and transfer transactions published on the draw page; deliveries visible in profile. |
| Lose the vault key | Hardware-backed keys, spend caps, monitoring. Float is deliberately limited to a few draws' worth. |
| Disappear | Credits are a promotional balance and carry no guarantee beyond the service operating. The docs say so plainly. Everything already delivered is yours on Solana regardless. |
Your responsibilities
- Keep your wallet's recovery phrase private. POMY will never ask for it.
- Check the URL. POMY's only domain is listed in Contact and status.
- Sign-in messages name the site and your address. If a request asks you to approve a token transfer or spend, it is not from POMY.
Reporting
Security issues: see Contact and status for the disclosure address. Please report privately first.