← Blokyz Public Raffle analysis

Blokyz Public Raffle — Risk Audit

Overall risk

guarded risk

8 findings · v1 · 8/27/2026

Blokyz allocates 7,500 of a 10,000 ERC-721A collection by an uncapped 0.03 ETH public raffle, and the mint contract is unusually trust-minimized for the class: entrant ETH is escrowed and untouchable by the owner until claims open, the Chainlink VRF v2.5 coordinator is pinned at deploy and re-checked in both the request and fulfill paths (closing the usual owner-repoints-randomness hole), the draw seed can never be re-rolled, the off-chain allocator was hash-committed before entries opened, and any entrant can permissionlessly reclaim their full deposit if settlement has not finalized 90 days after the raffle ends. Residual risk concentrates in one place: the contract cannot verify that the posted allocation merkle root actually matches the committed allocator, so allocation honesty is socially — not cryptographically — enforced, and that single unverifiable step sits behind a single-EOA owner key with no timelock between posting a root and freezing it. At review time the allocator manifest was not publicly discoverable, which blunts the community check that mitigation depends on. Separately disclosed: unclaimed refund legs are swept to the treasury 180 days after claims open (NFT entitlements never expire). Overall risk: guarded. Grade: B. Independent analysis — not a formal audit, not an endorsement, no buy/sell advice.

Methodology

Manual review of the verified Solidity source of BlokyzMint (Sourcify exact_match on both creation and runtime bytecode, solc 0.8.24), reasoned to file:line against a Solidity review rubric (admin/ownership powers, upgradeability, custody, randomness integrity, reentrancy, economic traps, honeypot/transfer restrictions, event/error/storage patterns). Supplemented by full ABI extraction from the mint frontend (docs/audits/blokyz/abi/BlokyzMint.json), live on-chain state reads at block 25847334 (docs/audits/blokyz/fixtures/state-block-25847334.json), a full scan of RaffleEntered logs from raffle open through that block (36,496 entries across 5,407 unique wallets), and web/social recon of blokyz.com, mint.blokyz.com, X (@OriginalBlokyz) and discord.gg/originalblokyz. Verified source wins over documentation. All performed 2026-08-27.

How we compute EV & house edge →

Contracts in scope

Findings

8 published findings

Independent analysis — read this

This is HouseMath's independent structural analysis, computed from public on-chain data. It is not a formal security audit, not a guarantee of safety, and not an endorsement of this protocol, its team, or any token. On-chain gambling carries a real risk of total loss. Nothing here is financial, investment, or gambling advice. Do your own research.