Verification
Before any HYPE leaves escrow, settle reads the HyperCore state and requires seven checks to pass. Each check closes a specific way an Officiant could take value or keep power.
How verification works
RiteManager.settle(potId) is callable by anyone. It calls verify(potId), which reads the state of the token on HyperCore (on testnet, MockCoreState, the auction's sale record and the deposit-wallet factory) and returns a bit mask with one bit per check. Settlement requires all seven bits. Otherwise it reverts with CheckFailed(n) for the first failing check.
The same verify view drives the Rite timeline on each Pot page, so anyone can see which checks already pass during a Rite.
The seven checks
| # | Check | What it protects against |
|---|---|---|
| 1 | The Core token's ticker equals the Pot's ticker, its deployer is the assigned Officiant, and that Officiant bought it during this Rite | A Rite settled on someone else's ticker, or on a ticker bought outside the Rite and presented for repayment |
| 2 | szDecimals and weiDecimals equal the spec stored when the Pot opened | A token registered with a wrong decimal spec, which cannot be changed later |
| 3 | maxSupply equals the token's total supply converted to Core wei, and the system address holds exactly maxSupply | Part of the supply minted to the Officiant or another address at genesis, or a supply that does not match the EVM token |
| 4 | The linked EVM contract equals predictWallet(token, tokenIndex, officiant) of the deposit-wallet factory, it is deployed, and evmExtraWeiDecimals matches | A link to a contract the Officiant controls, or wrong decimal scaling between EVM and Core |
| 5 | The deployer fee share is 0 | The Officiant keeping an income from every trade on the pair |
| 6 | The freeze privilege is revoked | The Officiant keeping the ability to freeze holders |
| 7 | The pair is listed, with a start price within plus or minus 5% of the reference price for that token | A pair listed at an arbitrary price, or not listed at all |
Check 3 in detail
On HyperCore, genesis can allocate balances to several addresses before it is finalized. For a bridged token, the whole supply must sit at the token's system address, 0x20 followed by zeros and the token index. Tokens then reach users only by crossing from the EVM side through the deposit wallet, so the Core supply stays backed 1:1 by tokens in escrow.
If even one Core wei is minted to another address, check 3 fails.
Check 7 on testnet
On testnet the reference price comes from DemoPriceSource, a contract with fixed demo prices for OLIVE, LYRE, EMBER and the Specimen tokens. The check is real code. Tokens without a reference price can have a Pot, but they are never eligible, because no Rite on them could pass this check.
Additional guard
Separately from the seven checks, settlement reverts with PotCannotCover if the ticker price plus 5% is larger than the Pot. This protects sponsors when an Officiant buys in a later window at a higher price than the Pot was reached at.
Tested failure cases
Each check has a Foundry test in which only that rule is broken and settle reverts. Examples: the fee share left at 100%, part of the genesis supply minted to the Officiant, a wallet created for another finalizer, a start price 6% away from the reference.