Roles

A single owner address, transferring to a 2-of-3 multisig shortly after launch. It can:

• Open or close draws, pause, and trigger escape mode
• Tune the bounded economics: surcharge, bid rate, backing floor, the two protocol cuts, the crown, the surplus split, and the settlement windows
• Admit or disable tickers, subject to the admission timelock
• Withdraw accumulated protocol revenue
• Point the protocol at a rewards contract, a token buyer, and a randomness coordinator

It cannot move escrowed stock, move escrowed backing, or block a withdrawal — and every term that matters to an open pack is frozen onto that pack at purchase, so none of the tuning above can touch one already paid for.

The purchaser of an open pack holds the settlement election: resolve is theirs alone while the acquisition is unsettled, and claimAsToken / claimSettlementAsEth — the two ways to complete an $SP settlement — are theirs permanently. Nobody else can exercise a choice on their behalf; finalize can only ever land the keep-default.

After the 15-minute window, the drawn depositor may finalize — closing an election the purchaser has not used and landing the default, where the purchaser keeps the stock and the depositor keeps their backing.

We run a keeper that submits beacons, settles acquisitions, activates staged listings, and finalizes windows nobody closed. It holds no privilege whatsoever — every function it calls is permissionless. If it stops, settlement is delayed and nothing is at risk; anyone, including you, can call the same functions.

Supplies beacon words to the core contract. It is the only address the settlement callback will accept, and it cannot be changed while a draw is in flight.

These are open, by design, so no part of your exit depends on us:

• processAcquisitions — apply resolved draws and open their windows
• finalize — after the 2-hour finalize window, close an abandoned election to the keep-default, so a purchaser who walks away cannot park a depositor's escrow
• activateStaged — move staged listings into the pool
• refundExpired — refund a pack whose randomness never arrived
• releaseTokenBuyReserve — spend the reserve on $SP; the routing (40% depositors, 40% purchasers, 20% burned) is fixed by the contract, so the caller cannot redirect any of it
• claim, withdraw, claimStranded, harvestFees — your own funds, always available