> HISTORICAL DRAFT — This file predates the agent-only mint and fully on-chain art requirements. The NFT contract is not deployed, and owner controls remain undecided. Refer to the website status, not this file, for current launch status.

# Security and risk

**No independent security audit has been performed.** Do not represent testing as an audit. Commission review and testnet rehearsal before opening public mint.

The single generated EOA is the user-approved temporary admin and immutable treasury exception to a multisig recommendation. Secure and back up its encrypted keystore and password separately. Never commit `.secrets`, print the private key, or expose credentials in logs. Loss/compromise can prevent treasury withdrawals or allow mint pause/resume and ownership transfer. Treasury becomes immutable on lock; changing contract ownership later does not change treasury.

Trust boundaries: Chainlink wrapper and delivery, network/RPC reliability, pinning providers and gateways, wallet UI, and web hosting. VRF failure can leave eggs permanently pending: no admin override/re-request. A pending NFT may transfer, and its eventual reveal follows the token. Pay VRF fee and gas separately; no guaranteed USD price.

Controls: no upgrade, privileged mint or randomness override; request-before-callback state; owner/operator checks; non-reentrancy; exact mint payment and refund; two-step ownership; callback sender authentication; tests for contract rules. These do not eliminate risk. Single-process API rate limits are not a distributed protection. Browser-wallet transaction simulation is essential; don't resubmit a pending request. Agentic-wallet execution is deliberately disabled until its preview validation is tested.