Security
Where the money sits
Prize pools never touch our wallet. They sit in a contract with exactly three exits.
The escrow contract
Every pool is held by the Sidequest escrow contract on Robinhood Chain, keyed to its bounty. The contract can move a pool in three ways only: pay the winners and the treasury when a resolver awards the bounty, refund the creator when a resolver declines it, or refund the creator when they claim a stale bounty themselves. There is no function that lets anyone, including the owner, withdraw escrowed funds to another address.
Who can trigger a payout
Only wallets on the contract's resolver list, managed by the contract owner. The operator signs each payout from their own wallet; there is no server key that can move money. Creators cannot pay themselves or their friends: their stars are advisory and the payout amounts are checked against the pool on-chain.
Never stranded
If a funded bounty sits unreviewed past the stale window (60 days at launch), the creator can call the contract directly and take the full deposit back. The window is fixed per bounty when it is funded and cannot be extended afterwards.
What to check yourself
Every fund, payout and refund is a transaction on Blockscout. Bounty pages link to the funding transaction and the escrow address. Only trust the escrow address shown on this site; lookalike explorers and copied addresses are the most common scam.
Limits
The contract has an automated test suite but has not had an independent audit yet. Start with small pools while it is new. Smart contracts can have bugs and wallets can be compromised; keep your keys safe and check every transaction before you sign.