How this marketplace works,
and how to check that it does

1The object this document describes

Name the application and the fingerprint, not the project. Everything after this section is about that exact object and nothing else.

Application 770868027, on Algorand's test network. Approval program of 6,429 bytes, fingerprint fa74919269d4e64f. Quote that number and that fingerprint rather than the name of the project: two versions of the same contract carry two different fingerprints, and a green check on one establishes nothing about the other.

How you check you are looking at the right object: ask the network for the application's program and compute its fingerprint yourself. If it does not match, everything below is about something else.

A successor is written and not engraved. It carries the ceiling on commission, the staking scale and the currencies described in Part III. The refusals recorded throughout Part II were obtained on the contract above, not on the successor, and every one of them will be measured again against whichever program is finally engraved on MainNet.

Describing the successor as though it were the object of this document would make the text carry guarantees nobody can check, which is exactly the white paper of intentions this project refuses to write. Leaving it out would let you believe that what you read is what you will use. So it is named here, in the first section, rather than buried at the end.

2Why this marketplace exists

Not a gap in the market. A wreck: platforms died while their contracts kept running, and the pieces they listed are still there with nobody indexing them.

On Algorand, a token is called an ASA. Tens of thousands of non-fungible ones were minted in 2021 and 2022, at the dawn of the ecosystem, by isolated creators and small communities. Most of them exist nowhere. The large marketplaces only ever listed complete collections, promoted on social media and integrated by hand. Everything else, which is the majority, cannot be found, browsed or traded, even though the tokens are still on chain and people still hold them.

Then the marketplaces themselves went. Measured by real HTTP requests, not recalled. Every line carries the date it was taken, and the reason is in the note below the table.

How much is actually sitting there

The escrows were swept on 11 September 2026, 307,160 applications read page by page in 169 seconds. A contract is recognised by the vocabulary of its stored state, never by the fingerprint of its program, which changes with every version.

The cold, certain floor is AB2 Gallery: 14,732 listings whose most recent is three years old. A separate measurement reached it by another route entirely, walking the 918,261 transfers signed by that marketplace, and found 14,546 pieces still deposited, belonging to 4,523 people, 1,992 of whom hold exactly one. Those two numbers count different things — listings against pieces still in escrow — and two independent instruments landing within 1.3 per cent of each other is what makes the measurement worth quoting.

So ASA Compass is not one more marketplace. It is the one that repairs that abandonment by indexing what the others dropped. Everything in Part III follows from it: a royalty offered to every creator rather than a selected few, because their original platforms are gone; a marketplace that shows you what is for sale elsewhere, because nobody else can.

3What the index holds, and what it leaves out

A catalogue that says what it excludes is worth more than one that implies it holds everything.

The chain was swept rather than searched. Asking the public indexer for a name only matches a literal substring: Punk finds PUNKY, while OG Punk finds nothing at all, because that exact string does not exist. A catalogue cannot be built by looking up names you already know. So the whole window was swept, asset by asset, and the index is ours.

Why the usual definition of an NFT had to be widened

The common test for a non-fungible token is total == 1 and decimals == 0. Applied here, it empties the catalogue of the very thing this project is looking for.

One of the oldest mints on Algorand, 1800's Non Fungible Tokens, has a total of twenty. It is not a unique piece, it is a limited edition: twenty copies of the same token. The usual test threw it out, along with Newspaper Graphics (edition of fifteen) and the whole Print Series (editions of fifty). On that one creator, widening the definition took the catalogue from 8 objects to 53. Collections of 2021 use that form heavily, which is plausibly one reason the large platforms never listed them: their definition of an NFT cannot see them.

The definition used here: a collection object is either a unique piece (total == 10^decimals, which also covers fractional ARC-3 pieces) or a limited edition (decimals == 0, a run between 2 and 10,000, and a media URL). The URL requirement is what keeps small community currencies out: they point at no media.

What is deliberately not in the catalogue

Entries that are not collections at all. Some catalogue keys turn out to be aggregates built from a fragment of a title: a key mingo holding 257 pieces from 8 unrelated creators, because the word Flamingo was cut in two and its tail kept as a collection name. Those are the opposite defect from the one grouping fixes: they are already too merged. They are never grouped further, which would build exactly the jumble this catalogue exists to avoid.

Pieces whose media never came back. They stay in the index and say so, rather than being quietly dropped so the coverage figure looks better.

Nothing is removed for what it depicts. The catalogue organises access to sensitive content; it does not withdraw it. That is the platform's stated position, in its author's words:

Je crois que tout devrait être montré, mais je crois aussi qu'une portion de ce qui est montré devrait être assumée par ceux qui décident de le regarder. Dogebarb, 10 September 2026

Which commands three things for anyone building on this index: nothing is deleted from the catalogue on the grounds of its content; the decision belongs to the visitor, never to the platform, which only asks them to own it; and what the platform shows is not what it endorses. For an exhaustive catalogue, that is the only position that holds.

4How a piece enters the vault, and how it leaves

It enters by one gesture and leaves by four doors. Every other route was presented to the contract and refused.

It enters by a single gesture and never otherwise. The seller sends the piece to the vault in the same atomic group as their listing call. The contract reads what actually moved in that group rather than trusting an argument: you cannot misdeclare what you deposited.

Five refusals guard that entrance, all of them obtained:

The fourth deserves a word, because it protects the buyer and not the market. An asset somebody retains clawback rights over can be taken back from its buyer after the sale. The contract refuses to let it in, at all four deposit doors: listing, auction, offer, and offer acceptance. An independent review found that the offer path had been left out; it was closed, and the refusal was obtained on that exact path.

It leaves by four doors and no others: a sale, a withdrawal by the seller, the reclaiming of an expired listing by anyone at all, and the claiming of a piece the market owes. In the first three, the piece leaves along with the closing of the vault's position, once the vault holds no other copy.

5Buying: what it costs, what succeeds, what fails

The buyer pays the listed price plus the commission, and nothing else. The seller receives their price in full.

The buyer pays the listed price plus the commission, and nothing else. The commission is 2.5 per cent at most, ever, and section 3 continues below with what that ceiling means and how the rate falls beneath it. What follows here is the mechanism, measured to the unit on the test instance, on a listing at 0.5 ALGO. The rate in force on the instance that was measured was one per cent, which is where the 5,000 in the middle row comes from; the arithmetic of the mechanism is the same at any rate, and the rate itself is read from the contract rather than from this table.

The commission is added to the price, it is not deducted from it. The seller receives their price in full. That is measured rather than inferred: on a sale of 500 units in a currency, the seller received 500, not 495. The surplus line matters too, and it comes from a defect: the contract used to require enough and keep the rest, so a buyer who rounded up, or whose interface miscalculated the commission, silently left the difference behind. That is not theft, it is worse: a quiet loss on a market whose whole promise is that you get back what you put in.

The fixed opening fee, currently 25,000 microALGO, is paid by the SELLER when they open their listing, not by the buyer. The operator can adjust it, under a hard ceiling of 250,000 that is written into the code; the attempt to exceed it is refused by frais au-dessus du plafond.

THE COMMISSION IS 2.5 PER CENT, AND THAT IS ALSO THE MOST IT CAN EVER BE. The figure is not a default setting that happens to sit at 2.5 today. It is a ceiling written into the contract's code, which cannot be changed after deployment by anyone, including its author and including whoever might own this marketplace in the future. The rate can be lowered. It can never be raised. That is a guarantee you can read on the chain yourself rather than a promise you have to take from us, and it is the reason the number is stated this way round.

Below that ceiling, the rate falls in evenly spaced tranches of what you have staked. Neither the width of a tranche nor the rate at each one is fixed in the code: both are set by the operator, adjustable after the fact, and until they are set no discount applies to anyone at all: the contract starts with tranches switched off, base rate for everyone. Each tranche's own rate is set individually rather than computed from a formula, so an operator can shape the curve, not just its slope. Adjusting any of it can only ever move the rate down from the ceiling: the contract checks the ceiling both when the tranches are set and again when a rate is applied, because a guard placed at one end only is a guard you get around from the other.

The tranches are evenly spaced on purpose, and it is not a matter of taste. An earlier version let the operator place thresholds anywhere, and working out which one a given deposit landed in took a full pass over all of them: measured at 940 units of compute out of the 700 a single ordinary transaction is granted, which refused the purchase outright, not only the discount. Someone holding a stake, even an unmatured one, could no longer buy at all. With even spacing, which tranche a deposit falls in comes from one division rather than a search, and the same call now costs 648 units: comfortably inside the budget of one ordinary transaction, with no second transaction for a wallet to compose on its own.

Two further bounds keep that scale honest, and they exist because a ceiling on the rate alone would not have been enough. A staked deposit only counts once it has matured, seven days by default: otherwise you would stake just before buying and withdraw just after, and the tiers would mean nothing. And the maturation period is itself capped at ninety days, because an operator who set it to five years would put the whole scale out of reach and so remove the discount without touching a single rate. Closing one door and leaving the window open is not a guard.

Both of those were attacked rather than assumed. A counterfeit staking application, declaring a hundred thousand billion tokens held since 2020, is not believed and pays the full rate. A deposit made at the last minute earns nothing. And the eight rules that guard how the tiers are set each refused a call built to break them.

What buying refuses, all obtained:

The first one is not about money. A seller buying their own listing loses only the commission, and in exchange writes a price of their own invention into the piece's history. This market's archive of real prices is its argument; a fabricated one stays in an immutable contract forever, and a single fabricated price makes a whole series doubtful.

One design fact that matters to you as a user: the asset opt-in can travel in the same group as the purchase. That is not a given, other marketplaces prevent it by locking their group size. Here, someone who discovers a piece buys it in one wallet gesture.

And if a purchase fails, it fails entirely. Payment and delivery travel in the same atomic group: nobody pays without receiving. The most common reason a gesture fails on Algorand is not the contract at all, it is that an account has not opted in to the asset it is about to receive, which costs it 0.1 ALGO of held balance.

6Auctions, the reserve, and who the guard protects

Once a bidder meets the price the seller asked for, the seller can no longer walk away. That guard protects the bidder, not the market.

An auction has a starting price and, if the seller wants one, a reserve. A reserve of zero means the starting price serves as the reserve: agreeing to open at a hundred is agreeing to sell at a hundred.

Duration: one hour minimum, thirty days maximum. Both bounds refuse, by duree trop courte and duree trop longue. A bid placed in the last ten minutes pushes the end back by the same amount, with total extensions capped at twenty-four hours; without that cap, last-minute bids would postpone the ending indefinitely.

An outbid bidder is repaid immediately, rather than having their money sit until the close. It is simpler and more honest, and it avoids having to repay a crowd of losers in a single closing transaction, which the size of an atomic group would forbid anyway.

THE GUARD THAT MATTERS MOST HERE PROTECTS THE BIDDER, NOT THE MARKET. Once a bidder has met the price the seller asked for, the seller can no longer withdraw the piece: the attempt is refused by reserve atteinte, vente due. Without it, a seller could let the bidding climb and pull out at the last moment, which would make taking part worthless. Tested on an auction actually run, with a bid actually placed.

And the worst case the contract knows about, which is a winner who cannot receive. A winner is not a signer of the closing call, which anyone may make. If they have not opted in to the pieces, the delivery is rejected by the protocol and the close fails. Without a fallback it would fail forever: the seller's pieces and the winner's money would both sit in the vault with no method able to get them out. So the auction settles as though the reserve had not been met: the money goes back to the bidder, the pieces back to the seller, and each recovers their own. The seller loses the sale, which is a pity, and keeps the piece, which they otherwise would not.

Why the requirement is not imposed at bidding time instead, which is the obvious fix. It would prevent nothing: nothing obliges a bidder to stay opted in until the close, so they could opt in to bid and opt out before the end. The fallback is not a second best for want of something better, it is the only protection that holds. That argument came from the adversarial review, and it is better than the one the contract was built on.

The operator cannot help themselves to bids. They can set the share withheld from a defaulting bidder, but never above twenty per cent, and the attempt to exceed that engraved ceiling is refused by part retenue trop elevee, tested to the unit.

7Offers: money before the piece

The one path where money arrives before the goods, which is why it carries the most guards.

An offer is the one path where the money arrives before the goods, which is why it carries the most guards. The offerer puts money in the vault against a piece that is not theirs yet, and nothing guarantees the owner will want to sell.

The seller deposits nothing. The piece only moves at the instant its holder accepts, inside the same atomic group. Someone who will not put their collection into an escrow therefore still has a complete way to sell.

The contract requires the offerer to have opted in to the piece before offering on it, rather than letting them pay for nothing: acceptez la piece avant d offrir dessus. And it refuses an offerer who has opted out since, because otherwise the seller would meet a protocol error naming neither the offer nor the reason, over something they did not cause and cannot fix.

An offer can carry a deadline. Past it, the offer can no longer be accepted, offre expiree, and anyone can return it to its author. Before it, that return is refused by pas encore expiree. The same offer refused both, before and after: it was time that changed the outcome, not the way the transaction was built.

When the sale concludes, the piece goes directly from seller to buyer, without passing through the vault. That detail comes from a defect. An earlier version routed it through the vault, which had never opted in to a piece somebody merely made an offer on, so no offer could ever complete on a one-of-one, which is to say on nearly the whole catalogue. It was the feature ranked first in the project's own research, and it was unusable at a hundred per cent. The direct route also avoids tying up another 0.1 ALGO, and avoids the vault holding, even for an instant, property nobody asked it to keep.

An offer in a currency pays for its own storage. The offerer sends the necessary ALGO in the same group, failing which depot en ALGO manquant pour la boite. That closes a defect from the adversarial review: offers in a currency were being financed out of the vault, and repeated offers would have drained it.

8Debts: what could not be paid to you comes back to you

An account can stop being able to receive an asset between the moment it is owed something and the moment it is paid. The contract writes down the debt rather than holding or blocking.

The problem debts solve is ordinary and involves no bad actor. An Algorand account must have opted in to an asset to receive it, and it can opt out at any time, including between the moment something is owed to it and the moment it is paid. People opt out to recover the 0.1 ALGO each position ties up, usually without thinking about what is still owed to them.

The contract neither blocks nor keeps: it records a debt in that person's name, which they claim once they have opted back in.

Tested to the end, with balances compared before and after:

• Money comes back to the exact figure. A seller paid in a currency they had opted out of cannot claim before opting back in, acceptez cette monnaie avant de reclamer; once they do, they receive their price in full.
• A one-of-one piece returns to its owner. A seller who opts out of their own piece while it sits in the vault, then withdraws their listing, gets it back after opting in again.
• The withdrawal itself was not blocked, and that is the point. The contract could have refused it on the grounds that the piece cannot be handed back. That refusal would have sounded prudent, and it would have locked the piece and the listing both, with no way out for anyone. Instead it records a debt and lets the listing close. Refusing cleanly can be worse than deferring.

The operator cannot sweep up what is owed to you for TWO YEARS. The attempt on a recent debt is refused by cette creance n a pas encore expire. The delay is not a comfort setting: it is the whole thing that separates this method from the confiscation the reviews closed elsewhere. Shortening it would reopen that defect by another door. And an expired debt that has not yet been swept remains claimable by its owner, because expiry is a door the operator may open, not a deadline that erases you.

A DEBT OVER A PIECE NEVER EXPIRES, AND THE ASYMMETRY IS DELIBERATE. A reader will find a two-year limit on money, none on pieces, and take it for an oversight. It is a decision, and the reason is not technical: a sum of money is fungible and replaceable; a work is not. It has an author, a history, sometimes a value to its owner that has nothing to do with its price. Recovering three forgotten ALGO after two years and taking somebody's artwork do not read the same way, even though the code makes the same gesture.

And the cost of that decision is accepted with open eyes: a single unclaimed piece makes this market impossible to close, permanently. Its storage keeps the vault's minimum balance above that of a bare account, and closing requires a bare account. That is exactly what the two-year limit prevents on the money side, and it is left open here on purpose. Adding an expiry to make the market closable would be undoing a decision, not fixing an oversight.

One fact that says who these guards really protect. Algorand does not let the creator of an asset close their position in it. A minter can therefore never end up in this situation with their own pieces. The debt mechanism protects resellers, which is to say most of the people on a secondary market, and the ones with the least recourse if a contract decides to keep what is theirs.

9Other currencies: how one enters the market, and how it leaves

The market does not only sell in ALGO, and a currency that cannot be closed would make the market itself unclosable.

The market does not only sell in ALGO. The operator can open other currencies, and a listing can be denominated in one of them.

Opening one takes three things, each with its own refusal, all obtained: that it be the operator doing it, seul l exploitant; that they have opted in to it themselves, acceptez cette monnaie avant de l ouvrir, failing which they could not collect the commissions it earns; and that it be given a floor price, un plancher est obligatoire.

EACH CURRENCY CARRIES ITS OWN FLOOR, EXPRESSED IN ITS OWN UNITS, and this is the thing to understand before reading any figure in this document. The four currencies open today carry a floor of 100 units, and since they have two decimals, that is 1.00 of their unit, not 100 microALGO. A bound written in microALGO applies to ALGO and to nothing else. That distinction was not obvious in advance: it showed up when a sale in a token was actually run on the test network, and a listing at five units was refused as being below a floor that meant nothing there.

A floor can only go down, refusal un plancher ne peut que baisser. The operator cannot raise the minimum price of a currency after sellers have settled into it.

A currency can be closed, and that is what was missing once. An adversarial review established that the market became impossible to close the moment a currency was accepted: the opt-in and its floor storage, 0.1093 ALGO, had no method that could undo them. There is now a closing method, and the four currencies open on the test instance all close in simulation, 96 units of budget each.

Two refusals guard it, both obtained: acceptez cette monnaie avant de la fermer, if the operator has opted out and could not receive what is due to them; and le coffre detient encore cette monnaie, for as long as the vault still holds units of it.

10The exempt token, and a rule that was removed rather than repaired

The best fact about this contract is a rule that was deleted, because it could be rented for the length of a single transaction.

The market can designate ONE currency that pays no commission. The designation is the operator's alone, ALGO cannot be the exempt one, refusal l'ALGO ne peut pas etre exonere, and it can only be done once: le jeton exonere est deja fixe.

This is the most useful thing in the contract, and it is made of a rule that was deleted.

An earlier version exempted anyone who held a million units of a partner token, which looked like a good way to create durable demand for it. The independent review measured something else: the contract was not reading a holding, it was reading a balance at an instant. It was enough to borrow the tokens inside the same atomic group and give them straight back. A commission of ten for an account holding three thousand tokens; a commission of zero for the same purchase with a hundred thousand tokens borrowed and returned in the same transaction, rounds 66868169 and 66868179. One large holder could have exempted the entire market by lending.

NO VIRTUAL MACHINE INSTRUCTION TELLS YOU HOW LONG AN ACCOUNT HAS HELD AN ASSET. A contract therefore cannot measure a holding, and any rule that depends on one is defeatable inside a single group. That was not a guard to strengthen, it was a rule not to write, and it was removed rather than patched.

What replaced it is not defeatable the same way: the exemption is on the currency you pay in, not on what you hold. Paying in a currency means actually parting with it, and you cannot borrow an expense.

And atomicity, here, worked against the contract instead of for it. Everywhere else it guarantees a buyer will not pay without receiving; there it guaranteed the lender would get their tokens back, which is exactly what made the instant loan free and safe. The same mechanism protects or betrays you depending on what you ask it to guarantee.

11Handover, suspension, closing, immutability

The four things an operator can do to the market itself, and the exact shape of what they cannot.

Handing over the operator role, and the warning the contract cannot give

The role is handed over in TWO steps: the operator proposes, the recipient accepts. A role sent in one gesture to a mistyped address would never come back. Proposing the null address cancels a proposal in flight, on purpose by the same gesture.

Three refusals guard it, all obtained: proposing is the operator's alone; accepting when nothing has been proposed gives aucun transfert de role en cours; and accepting a role proposed to somebody else gives ce role n a pas ete propose a ce compte. The first of those is not decorative: without it, anyone at all could take the role whenever no proposal was in flight, since the null address is the value at rest.

BUT THERE IS A WARNING THE CONTRACT CANNOT GIVE, AND SAYING SO IS BETTER THAN LETTING YOU ASSUME A GUARD EXISTS. A new operator must have opted in to every open currency, or every sale denominated in the ones they have not will fail, because the contract cannot pay them their commission.

The contract keeps no index of open currencies: it counts them, it cannot enumerate them. No guard is therefore possible at handover time, and it falls to the interface to check and to announce it. Saying where a guard is impossible is worth more than letting you believe there is one.

Suspension, and what it is really for

The operator can close off NEW deposits without touching anything already deposited. It is the only way to stop the bleeding if a defect were found after opening, and it is built so that nobody becomes a prisoner of their own property: withdrawals, claims, auction closings and reclaiming of expired listings all stay open, permanently and by design.

Tested by actually suspending a twin instance: listing was refused there by nouveaux depots suspendus, then the suspension was lifted and the state checked again. Never testing it would have meant discovering on the day of an incident that it does not work. The method moves no funds at all.

Bidding counts as a deposit, and that had been missed. A bid puts money in, so a suspended market was still taking deposits through its auctions until the guard was added there too. It is the kind of gap that only shows up when you ask which doors let value in, rather than which methods look dangerous.

Closing and immutability, in their exact form

This is the section a suspicious reader will check first, and it is the one most often said badly. Both halves are true, and they do not say the same thing.

THE CODE CANNOT BE CHANGED, INCLUDING BY ITS CREATOR. A real attempt to replace the program was presented to the test instance, signed by the account with the best chance of getting through, its creator, with a valid replacement program. The approval program rejects it. An immutability nobody has ever tried to violate is a claim, not a guard.

THE MARKET CAN BE CLOSED, BUT ONLY WHEN IT NO LONGER HOLDS ANYTHING. Writing "this contract refuses to be deleted" would be false, and verifiable as false in a few minutes: the closing method is in the public interface and nobody hid it. Closing is the operator's alone, and it is guarded. As long as the vault holds property, it is refused by le coffre garde encore quelque chose, and the condition is not declarative: the contract reads the minimum balance the protocol imposes on the vault. One open listing, one unreturned piece, one pending offer, each shows up in that figure and each blocks the close.

The whole sequence was run on a twin instance that really did disappear from the chain: closing refuses while anything remains; a piece held by a debt leaves when its owner claims it; a currency the operator opted out of only closes after opting back in; a currency the vault still held units of closes once everything else is gone; then the deletion goes through, the application becomes unfindable, and its balance returns to its operator.

And what was verified was the ABSENCE, not the success. A successful transaction receipt tells you a transaction went through. It never tells you the object is no longer there.

This is not a weakness dressed up as a feature. Total immutability would mean a dead contract could hold property forever, which is precisely the problem this project measured elsewhere, in the pieces still stuck in the escrow of a marketplace that shut down. What is true here is narrower and better: the market cannot be closed while it is holding anyone's property.

12What the contract cannot do, even if its author wanted it to

Not promises. Impossibilities, written into code that rejects its own replacement.

• Change its own rules. The program rejects its own replacement.
• Take a deposited piece. No path sends a piece out of the vault to anyone other than its depositor, its buyer, or its claimant.
• Withhold more than twenty per cent of a bid, an engraved ceiling.
• Charge a fixed fee above 250,000 microALGO, an engraved ceiling.
• Sweep a debt before two years.
• Raise the floor price of a currency once sellers are in it.
• Exempt ALGO from commission, or change the exempt token once set.
• Disappear carrying what was entrusted to it.
• Stop anyone from reclaiming an expired listing. Anyone may do it, and the property goes back to its seller, because the destination is written in the listing rather than chosen by the caller. The worst a stranger can do is return somebody's property to them at their own expense.

That last one is worth a sentence of its own. Nothing on Algorand triggers itself; something must call. This marketplace makes those calls as a courtesy, and the point of leaving them open to anyone is that if this marketplace disappears, nobody is left a prisoner.

13The numbers, for anyone who wants to know what a gesture will cost

What a gesture costs, what comes back, and the compute budget that explains every bound above.

What a listing asks of the seller, one piece in ALGO, in microALGO:

Measured end to end on a test-network instance running this contract: a seller opens a listing and withdraws it immediately. They pay 190,800 and get back 155,800. Opening then withdrawing a listing therefore costs 35,000 microALGO, being the market's fixed fee and 10,000 of network fees, plus the fees of the transactions themselves. Everything else comes back.

Why the seller provisions the exit fees at all. The transactions the vault emits to return a piece or pay a seller cost network fees. While those were charged at zero, they fell on whoever happened to call the method, so the vault could emit nothing without a third party agreeing to pay for it. The rule underneath is that neither the market nor its operator fronts the cost of a gesture somebody else asked for, and what is not consumed comes back with the rest.

The bounds and the ceilings:

The compute budget, which explains every bound above. Algorand grants 700 units to an application transaction. Measured on the test instance:

At three pieces there are eighteen units of margin left. The limit of three is not a cautious setting, it is the wall. Each further piece costs about 111 units, because the contract walks the transaction group.

The ceiling bid counts UNITS of a currency, not value. A currency with a very large supply reaches it without any real fortune behind it, and a currency with many decimals reaches large unit counts quickly. Worth knowing before opening one.

14The theme of twenty-five

Decided · four of six constants already carry it

Every charge on this platform is a twenty-five. Learn the number once and the whole fee schedule follows.

Partout où on a des frais, on dirait que ça devient ma règle. Soit zéro point zéro vingt-cinq à chaque fois qu'on fait une action, vingt-cinq ALGO pour l'outil de récupération. Donc on est dans le thème du vingt-cinq. Je trouve que c'est juste, personnellement. Dogebarb, 11 September 2026

Wherever we have a fee, it seems to become my rule. Either nought point nought two five each time an action is taken, or twenty-five ALGO for the recovery tool. So we are in the theme of twenty-five. I think that is fair, personally.

15The commission, and the ceiling written into the code

Ceiling engraved in the successor · scale measured on the test network

2.5 per cent is not a starting price that happens to sit there today. It is the most anyone can ever be charged, and the rate can only go down from it.

The commission is added to the price, it is not deducted from it. The seller receives their price in full. That is measured rather than inferred: on a sale of 500 units in a currency, the seller received 500, not 495. The buyer pays the listed price plus the commission, and nothing else, and anything paid above that comes back.

The figure is a ceiling written into the contract's code, which cannot be changed after deployment by anyone, including its author and including whoever might own this marketplace in the future. The rate can be lowered. It can never be raised. That is a guarantee you read on the chain rather than a promise you take from us, which is why the number is stated this way round.

The contract checks that ceiling at both ends. Once when the scale is set, and again when a rate is applied to a sale. A guard placed at one end only is a guard you get around from the other.

16The scale: ten tranches of twenty-five million

Decided 11 September 2026 · written, not engraved

Locking XDB lowers the commission a quarter point at a time, and reaches zero exactly at the tenth tranche the contract allows.

Locking, not holding, and the reason is a defect we found in our own code

A balance can be borrowed for the length of a single transaction. Algorand groups transactions atomically, so a wallet can be handed millions of tokens, buy something, and hand them straight back, all in one go, keeping nothing. We measured it against our own contract before anyone else could: the same purchase cost full commission with 3,792 units held, and zero commission with 100,000 units borrowed and returned inside the same group, at rounds 66868169 and 66868179.

No instruction on Algorand can say how long an account has held an asset. A contract therefore cannot measure holding at all, and any rule that depends on it is defeated inside the same group. That was not a guard to strengthen; it was a rule that should not have been written, and it was removed rather than patched.

Both of those were attacked rather than assumed. A counterfeit staking application, declaring a hundred thousand billion tokens held since 2020, is not believed and pays the full rate. A deposit made at the last minute earns nothing. And the eight rules that guard how the tiers are set each refused a call built to break them.

The staking contract exists and is deployed on the test network, application 770940665, and the market contract already knows how to read it. What it deliberately does not hold is the scale itself: it records how much and since when, and nothing else, so that changing a tranche never means redeploying it or re-locking anybody.

17A royalty for every creator, not a selection

Decided 11 September 2026 · no contract carries a line of it yet

2.5 per cent to the creator on every resale that goes through this market, offered to all 4,076 creators in the catalogue rather than to a chosen few.

C'est un autre nouveau service qui est incroyable. Je trouve qu'on offre ce qui est du jamais vu : la capacité — on va donner la chance à TOUS les créateurs, pas des sélectionnés, à tous les créateurs DEPUIS LE DÉBUT — de recevoir une commission sur les transactions de leur collection, de leur pièce. Pour tout le monde, tout le monde. Dogebarb, 11 September 2026

It is another new service, and it is incredible. I think we are offering something never seen before: the ability — we are going to give the chance to EVERY creator, not a selected few, to every creator SINCE THE BEGINNING — to receive a commission on transactions of their collection, of their piece. For everyone, everyone.

The mechanism, in its final form:

Why 2.5 per cent rather than 5, and the argument is its author's

Deux point cinq pour cent sur un marché où il y a beaucoup d'activité, c'est mieux que cinq pour cent sur un marché où il n'y en a pas beaucoup. Et pour un utilisateur, payer cinq pour cent, je trouve que c'est beaucoup, parce que c'est pour toujours, à chaque fois qu'un actif est échangé. Je trouve qu'exiger cinq pour cent, c'est un peu greedy. Dogebarb, 11 September 2026

Two point five per cent on a market with plenty of activity is better than five per cent on a market without much. And for a user, paying five per cent is a lot, I think, because it is forever, every time an asset changes hands. Asking five per cent is a bit greedy, I think.

4,076 distinct creators are named in the published catalogue, counted on the creator field of its 4,091 entries. That is the scale of what « everyone » means here: four thousand people to whom a royalty opens on pieces minted four or five years ago, on a market whose original platforms are dead.

The buyer's XDB lowers our commission, never the royalty

An earlier shape had the creator's royalty falling with the buyer's staked XDB. Cutting our own commission is giving up our revenue; cutting the royalty is giving away a third party's money, and that third party agreed to nothing. The rule that came out of it, in its author's words: tu as raison sur l'aspect de redirection du créateur vers un objet de spéculation — you are right about redirecting the creator towards an object of speculation. The creator always receives their full percentage.

18XDB: what it is, and what it opens

Token measured on chain 11 September 2026 · two of its uses exist today

Full disclosure first: XDB was created by the people who run ASA Compass. Nothing on this site requires it.

XDB, also called Dogebarb, is an Algorand asset with two decimals, asset ID 1290751153. It is the currency of this marketplace alongside ALGO. It was created by the people who run ASA Compass, and accepting it here is how they give it a use instead of a promise. Every listing, every sale and every offer works in ALGO. Anyone can read the link between the token and this project off the chain in a few minutes; it is far better that you read it here first.

The token is inert, and that is its most important property

The supply of 200 billion is therefore final. No dilution is possible and no balance can be seized, which is what makes the token usable as collateral inside a contract: a clawback-able token would not be.

Three different things are called a reserve, and they are not the same size

Say which one you mean, every time. The asset's reserve field is an address, and it is the zero address. The exchange pool is what actually sets the price. The supply is everything that exists. Burning nine billion XDB would be 4.5 per cent of the supply and 65.7 per cent of the exchange pool: the same measurement changes its conclusion depending on which denominator goes unsaid.

The liquidity is locked, and the lock is cryptographic

95.44 per cent of the pool shares sit in two accounts that have no private key. They are the accounts of applications 2842666357 and 2313510156, which was verified by deriving each address from its application ID: both match to the character. An application account cannot sign, so the shares cannot leave except through the program itself. Both applications carry the same 2,160-byte program, fingerprint 2dd88f58567442f6: they are liquidity locks.

What locking XDB opens

One lock, three doors. That was decided on 11 September 2026, in three words: un seul verrouillage, trois portes. A visitor learns one number and understands the whole system.

There is a shorter page about all of this, written for someone who wants to understand what the token is for rather than check how it behaves: what XDB does here. It says the same things in fewer words. This section is the one that names the measurements.

19Two units in twenty-five go back to the pool

Decided 11 September 2026 · no contract carries it yet

Eight per cent of everything the platform collects is paid into the XDB-ALGO exchange pool, in ALGO, and the shares it receives are put somewhere nobody can withdraw them from.

Si on a le thème du vingt-cinq sur tout ce qui est commission, tout ce qui est charge, tout l'argent qu'on reçoit — si sur vingt-cinq on gardait toujours DEUX UNITÉS. Dogebarb, 11 September 2026

If we have the theme of twenty-five across everything that is a commission, everything that is a charge, all the money we receive — what if out of twenty-five we always kept TWO UNITS.

The exclusion of the royalty is its author's own, unprompted: ça, c'est juste sur NOTRE charge à nous, pas sur celle des créateurs. Les créateurs gardent leur deux point cinq. — that is only on OUR own charge, not the creators'. The creators keep their two point five. It is the second application of a rule stated earlier in a different context: you do not dispose of a third party's money.

Paid in ALGO, and nothing is burned

The original shape had one unit staying in ALGO and one unit buying XDB, with both then paid into the pool. That step turns out to do nothing, and the reason is simple enough to check by inspection: the only place to buy that XDB is the pool itself. The token leaves one side and comes back the other. Measured against the real reserves, the two routes end at the same numbers, to the token.

So the decision, in its author's words: on verse en ALGO et on ne brûle rien — we pay in ALGO and we burn nothing. What rises is the quantity of ALGO facing the same quantity of XDB. The effect on price is real; it simply comes through the other side of the balance.

20Everything that is charged stays adjustable

Permanent rule · the contract already applies it, and applies it the right way

The value can be set. The ceiling is engraved. That pair is what makes a contract worth trusting.

Ce qui est certain, c'est que toutes les charges, tous les frais, ça doit être changeable. Il faut que ce soit inscrit dans le contrat intelligent. Parce que si le prix du XDB devient trop grand et que toutes les charges deviennent trop grandes aussi — comme la quantité nécessaire à verrouiller pour débloquer certaines choses — la tokenomique ne fonctionnera plus. Il faut qu'on ait la possibilité de changer avec le temps. Absolument tout ce qui nécessite un paiement, XDB ou ALGO, il faut que ce soit modifiable. Dogebarb, 11 September 2026

What is certain is that every charge, every fee, has to be changeable. It has to be written into the smart contract. Because if the price of XDB gets too big and all the charges get too big with it — like the amount you have to lock to unlock certain things — the tokenomics will stop working. We have to be able to change with time. Absolutely everything that requires a payment, XDB or ALGO, has to be modifiable.

That is what makes the contract checkable once and for all: you can satisfy yourself that the commission will never exceed 2.5 per cent, even if whoever operates this marketplace changes their mind, and even if it is somebody else by then.

21What is not done yet

Publishing these makes the rest of this document stronger, not weaker.

1. Nothing in Part III is engraved in any contract. The royalty, the tranches of twenty-five million, the lock that opens three doors and the eight per cent returning to the pool were all decided on 11 September 2026. The word "royalty" does not appear once in any of the three contract files. That part is entirely new code, not a setting, and this document says so rather than describing it in the present tense alongside rules that have refused real transactions.
2. One question about the royalty is open and its answer is not ours to assume. When a creator has not turned theirs on, does the buyer pay less, or does the platform keep the 2.5 per cent? The honest answer is that it should not be charged at all, and it has not been confirmed.
3. The lock that will hold the platform's own pool shares does not exist yet. It is decided that it will be the project's own contract, audited and with its source published, which is different from every other file in this project and deliberately so: a contract that holds other people's liquidity has to be checkable by somebody who is not us.
4. All of this is on the test network. The program engraved on MainNet will have to be measured in its turn and its fingerprint compared. Until that is done and published, this document describes the test network and says so.
5. The contract described here is not the one that will go into production. The successor is written and not engraved anywhere, and it carries the staking-linked commission scale: the rate falls in tiers below 2.5 per cent as the engraved ceiling, described in section 1 and section 3. The refusals recorded throughout this document were obtained on the contract in service, not on the successor, and everything here will be re-measured against whichever program is finally engraved on MainNet, its rule count included.
6. Multi-copy listings are engraved nowhere. The mechanism is written, it compiles, and it has been tested on disposable instances. Until it is engraved, a listing holds three pieces at most.
7. Two rules out of eighty-two were never made to refuse, because they are out of reach. commission superieure au montant would need a price of zero, which both entry doors refuse; cette piece n est plus au coffre would need a clawback-able piece to have entered the vault, which both deposit doors refuse. They stay in as defence in depth, and their unreachability rests on refusals obtained upstream, not on an argument about the code.
8. A listing holds at most three pieces, with eighteen units of budget left at three. That is a limit rather than a defect, but it leaves no room: any guard added to that path would bring it down to two.
9. One correction is read rather than measured. The fix preventing one seller from recovering a reserve another seller paid was verified by reading the code. Proving it would take two sellers of the same multi-edition asset and a withdrawal by the first before the second. That has not been done, and it is recorded here as read rather than observed.
10. One limit is proven on a copy and can never be proven here. Sending the vault exactly the floor amount of a currency used to stop that currency closing, and the market with it, for about a dollar. The remedy is in place and tested, but the bench that tests it destroys by construction the instance it measures: it has run on six disposable instances and can never run on the test one. A debt that cannot be repaid is not a debt, it is a limit, and it belongs here rather than on a list of things to do.
11. A per-buyer purchase limit, when it exists, will count what the buyer HOLDS. That penalises someone who received copies as a gift or bought them elsewhere, and it is a deliberate choice. It also means that, on a chain where an account is free, any per-account limit is a speed bump and not a barrier. Saying so is not an argument against it: it is what lets you pay the right price for it instead of buying an expensive guarantee you will not get.
12. The site and the contract have to move together. The multi-copy mechanism changes two method selectors, and a selector that matches no method is rejected by the virtual machine rather than by the contract, so listing and buying would both stop at once with a message that has nothing to do with what the user was trying to do. When the contract cannot speak, the protocol speaks in its place, and it speaks badly.

22How to check any of this yourself

The benches are in the repository, they submit nothing, and a rule counts only if it actually refused.

The benches are in the repository, one chapter per family of rules. A full replay runs with one command and submits nothing: it simulates against the test instance, costs no ALGO and changes nothing. A rule is counted only if it actually refused a transaction built on purpose to break it, and if the refusal message, read back from the contract's own published interface, matches the expected one exactly.

Three methodological precautions are what give those figures their value, and a careful reader will want to know them.

Every chapter also builds a gesture that MUST succeed. Without it, you cannot tell a contract that guards from a bench that does not know how to compose a valid call. A bench that only ever collects refusals proves nothing.

A case that could not be built is declared as such, with its reason, and counted neither as proven nor as absent. A silent failure makes an untested path indistinguishable from a covered one.

A refusal from the protocol is not a refusal from the contract. Insufficient balance, an asset not opted in, a missing reference: those arrive before the contract runs, and counting them against it would invent defects that do not exist. The bench names them explicitly rather than guessing.

Seven security reviews were carried out, on six versions of the contract, and the versions they examined are archived so each review can be replayed against the exact object it looked at. The last two worked blind, without knowing of each other, and they have not a single finding in common. Zero out of five. That does not mean the reviews were poor. It means the coverage of any single review is far narrower than it looks, and this project measured that instead of assuming it. It is the reason there were seven and not one.

23Who wrote this

There is no authority here for you to defer to, so nothing in this document asks you to.

The contract, the guards and the bench that made them refuse were written and run by Claude, an AI agent, under the direction of this project's author. That is stated plainly rather than shown as a badge, because a badge would suggest a company examined and endorsed this marketplace, and none did.

Which is exactly why this document is built the way it is. There is no authority here for you to defer to, so nothing in it asks you to. The instance is named, its fingerprint is published, the bench can be replayed by anyone and submits nothing, and every mechanism is described by what it actually refused rather than by what it is meant to prevent. Check the parts you care about; none of it depends on trusting who wrote it.