Safety

The lifecycle rules that keep acquisitions, withdrawals, refunds, and transfers bounded.

• Depositor-only withdrawal. A position's NFT and its ETH backing can only ever be withdrawn by the depositor who paired them. Active exits wait until every pending acquisition is terminal. Each request has a fixed deadline, but sustained queued activity can keep withdrawals unavailable for an extended period. The owner can never withdraw, move, or seize a depositor's pairing.
• Loading phase. The pool deploys with acquisitions off, so positions can be stocked before the protocol goes live.
• Anti-steering block windows. A VRF word cannot exist before its request is 3 blocks old (request confirmations, the Chainlink mainnet minimum); deposits made while acquisitions are pending are staged and mature only 10 further blocks later (activation delay); any callback landing more than 8 blocks after its request (callback deadline) refunds instead of selecting; and a request with no word can be cancelled by anyone after 30 blocks (selection timeout). Because 3 ≤ 8 < 13, no honored callback can ever select a listing that was deposited after its random word became public. Withdrawals and repricing stay locked while any acquisition is pending². These four windows are pinned explicitly at deploy and readable from the ConfigSet logs.
• Emergency exit. The operator can halt acquisitions and new deposits (withdraw-only mode). Already-issued requests must still resolve or time out; then active positions may exit normally. A still-staged deposit can always be cancelled by its own depositor, returning the NFT and its backing, so a staged deposit can never lock.
• Collection whitelist. Enforcement is on and gates only new listings and relists; existing positions, allocations, and settlements remain usable. The list is owner-curated (Foundation only at launch) and the whitelist contract's optional public entry path is disabled.
• Minimum backing. A floor that keeps dust positions from distorting prices and selection weights: 0.001 ETH in this deployment.
• Hardened transfers. Standard reentrancy protection and effects-before-interactions apply throughout. Refunds (late-callback, empty-pool, slippage, and cancelled requests) are sent with a non-reverting transfer, so a hostile recipient cannot block a callback or ordered processing¹.

Admin powers are contract-specific. The owner can pause operations, tune bounded settings, manage the market gate, and configure fee routing. It cannot withdraw a depositor's escrowed NFT or backing, or redirect accounted depositor and purchaser ETH credits. Emissions live inside the pool contract itself; there is no separate rewards contract, migration mode, or fee splitter in this deployment.