Blokyz Public Raffle

Published risk audit

Guarded overall risk · 8 findings

Blokyz allocates 7,500 of a 10,000 ERC-721A collection by an uncapped 0.03 ETH public raffle, and the mint contract is unusually trust-minimized for the class: entrant ETH is escrowed and untouchable by the owner until claims open, the Chainlink VRF v2.5 coordinator is pinned at deploy and re-checked in both the request and fulfill paths (closing the usual owner-repoints-randomness hole), the draw seed can never be re-rolled, the off-chain allocator was hash-committed before entries opened, and any entrant can permissionlessly reclaim their full deposit if settlement has not finalized 90 days after the raffle ends. Residual risk concentrates in one place: the contract cannot verify that the posted allocation merkle root actually matches the committed allocator, so allocation honesty is socially — not cryptographically — enforced, and that single unverifiable step sits behind a single-EOA owner key with no timelock between posting a root and freezing it. At review time the allocator manifest was not publicly discoverable, which blunts the community check that mitigation depends on. Separately disclosed: unclaimed refund legs are swept to the treasury 180 days after claims open (NFT entitlements never expire). Overall risk: guarded. Grade: B. Independent analysis — not a formal audit, not an endorsement, no buy/sell advice.