Printing to PDF keeps this page exactly as you see it, dark background and all. In the print dialog, turn Background graphics on and Headers and footers off: the page numbers and the footer rule are part of the document itself.
1The object this document describes
Name the application and the fingerprint, not the project. Everything after this section is about that exact object and nothing else.
Application 770868027, on Algorand's test network. Approval
program of 6,429 bytes, fingerprint
fa74919269d4e64f. Quote that number and that
fingerprint rather than the name of the project: two versions of the same
contract carry two different fingerprints, and a green check on one
establishes nothing about the other.
How you check you are looking at the right object: ask the network for the application's program and compute its fingerprint yourself. If it does not match, everything below is about something else.
Application 770868027 answers on TestNet and returns 404 on MainNet. No ASA Compass contract has ever taken a real commission from a real sale. Earlier versions of this document said the live instance, which read as though a market were running; it is not, and the wording has been corrected everywhere rather than footnoted.
A successor is written and not engraved. It carries the ceiling on commission, the staking scale and the currencies described in Part III. The refusals recorded throughout Part II were obtained on the contract above, not on the successor, and every one of them will be measured again against whichever program is finally engraved on MainNet.
Describing the successor as though it were the object of this document would make the text carry guarantees nobody can check, which is exactly the white paper of intentions this project refuses to write. Leaving it out would let you believe that what you read is what you will use. So it is named here, in the first section, rather than buried at the end.
2Why this marketplace exists
Not a gap in the market. A wreck: platforms died while their contracts kept running, and the pieces they listed are still there with nobody indexing them.
On Algorand, a token is called an ASA. Tens of thousands of non-fungible ones were minted in 2021 and 2022, at the dawn of the ecosystem, by isolated creators and small communities. Most of them exist nowhere. The large marketplaces only ever listed complete collections, promoted on social media and integrated by hand. Everything else, which is the majority, cannot be found, browsed or traded, even though the tokens are still on chain and people still hold them.
Then the marketplaces themselves went. Measured by real HTTP requests, not recalled. Every line carries the date it was taken, and the reason is in the note below the table.
| Platform | Address | State on 11 September 2026 |
|---|---|---|
| AB2 Gallery | ab2.gallery | Gone — does not resolve. Its escrow still holds the largest pile of anyone's pieces |
| ZestBloom | zestbloom.com | Gone — does not answer |
| Shufl | shufl.app | Gone — HTTP 530, origin unreachable |
| Asalytic | asalytic.app | Gone — HTTP 404 |
| Dartroom | app.dartroom.xyz | Gone — does not resolve |
| AlgoGems | algogems.io | Gone — does not resolve. It answered in August |
| NFT Explorer | nftexplorer.app | Parked — answers 200, serves a parking page that says so in its own markup |
| AlgoXNFT | algoxnft.com | Gone and repurposed — the domain now serves an online betting site |
| Rand Gallery | randgallery.com | Answers, but not as a marketplace — the domain now serves a lending platform |
| Exa Market | exa.market | Alive — a full marketplace. It was down for a time and came back |
| allo.info | allo.info | Alive — the reference explorer |
| Vestige | vestige.fi | Alive — DeFi analytics |
Gone is not a state. It is a reading. A marketplace can be dark one month and back the next: Exa Market was listed here as gone, and it is not. It was down for a time and it came back, and the entry that said otherwise had already been corrected in this project's own notes without this table hearing about it.
So a verdict with its date is information and a bare verdict is a trap, including the ones in the other direction: a site that answers today can be a shell tomorrow. Redo the ten requests rather than trusting this table, which is the only thing it is really for. It took under a minute to measure, and three of its ten lines had gone stale in a fortnight.
A dead marketplace does not take its contracts with it. Listings made years ago are still open on chain, still executable, and nobody shows them any more. The pieces are not lost; they are unindexed. That is a cataloguing problem, not a blockchain problem, and it is the one thing this project is built to fix.
How much is actually sitting there
The escrows were swept on 11 September 2026, 307,160 applications read page by page in 169 seconds. A contract is recognised by the vocabulary of its stored state, never by the fingerprint of its program, which changes with every version.
| Whose escrow | Live applications | Period of the listings |
|---|---|---|
| AB2 Gallery, sales | 14,732 | June 2021 → July 2023 |
| AlgoXNFT and Exa Market, sales (one shared contract) | 11,476 | Nov 2021 → Sept 2026 |
| AlgoGems, sales | 8,568 | March 2022 → Sept 2025 |
| AlgoGems, auctions | 990 | — |
| AlgoXNFT, auctions | 315 | — |
| ZestBloom | 31 | Feb 2022 → — |
| Shufl, Asalytic, Dartroom, NFT Explorer, Rand Gallery | — | no contract identified |
The cold, certain floor is AB2 Gallery: 14,732 listings whose most recent is three years old. A separate measurement reached it by another route entirely, walking the 918,261 transfers signed by that marketplace, and found 14,546 pieces still deposited, belonging to 4,523 people, 1,992 of whom hold exactly one. Those two numbers count different things — listings against pieces still in escrow — and two independent instruments landing within 1.3 per cent of each other is what makes the measurement worth quoting.
Exa Market and AlgoXNFT share one contract. The state vocabulary identifies a FAMILY of contracts, not a brand, and this one is alive: its most recent listing is dated 7 September 2026, four days before this document. Around a fifth of the pile was deposited in December 2024 by an account whose address begins with the marketplace's own name.
So two lines of the table above describe brands whose pieces sit in the same escrow, and the chain alone does not separate them: the fee account is identical on a listing from 2023 and one from 2026, and every listing is created by its own seller. Pouring those 11,476 listings into a page of lost property would announce as abandoned what is on sale today, on a site that works. The distinction costs nothing to state and everything to get wrong.
So ASA Compass is not one more marketplace. It is the one that repairs that abandonment by indexing what the others dropped. Everything in Part III follows from it: a royalty offered to every creator rather than a selected few, because their original platforms are gone; a marketplace that shows you what is for sale elsewhere, because nobody else can.
3What the index holds, and what it leaves out
A catalogue that says what it excludes is worth more than one that implies it holds everything.
The chain was swept rather than searched. Asking the public indexer for a name only matches a literal substring: Punk finds PUNKY, while OG Punk finds nothing at all, because that exact string does not exist. A catalogue cannot be built by looking up names you already know. So the whole window was swept, asset by asset, and the index is ours.
2021–2022, from every asset created to the objects kept
Why the usual definition of an NFT had to be widened
The common test for a non-fungible token is total == 1 and decimals
== 0. Applied here, it empties the catalogue of the very thing
this project is looking for.
One of the oldest mints on Algorand, 1800's Non Fungible Tokens, has a total of twenty. It is not a unique piece, it is a limited edition: twenty copies of the same token. The usual test threw it out, along with Newspaper Graphics (edition of fifteen) and the whole Print Series (editions of fifty). On that one creator, widening the definition took the catalogue from 8 objects to 53. Collections of 2021 use that form heavily, which is plausibly one reason the large platforms never listed them: their definition of an NFT cannot see them.
The definition used here: a collection object is either a
unique piece (total == 10^decimals, which also covers
fractional ARC-3 pieces) or a limited edition
(decimals == 0, a run between 2 and 10,000, and a
media URL). The URL requirement is what keeps small community currencies
out: they point at no media.
The ceiling of 10,000 copies is not a truth. It is where a token without decimals stops being a collectible and starts being a currency, and nobody has established that number. It lives in one named constant so it can be changed rather than argued about, and this document would rather say so than present it as a finding.
What is deliberately not in the catalogue
Entries that are not collections at all. Some catalogue keys turn
out to be aggregates built from a fragment of a title: a key
mingo holding 257 pieces from 8 unrelated creators, because
the word Flamingo was cut in two and its tail kept as a collection
name. Those are the opposite defect from the one grouping fixes: they are
already too merged. They are never grouped further, which would
build exactly the jumble this catalogue exists to avoid.
Pieces whose media never came back. They stay in the index and say so, rather than being quietly dropped so the coverage figure looks better.
Nothing is removed for what it depicts. The catalogue organises access to sensitive content; it does not withdraw it. That is the platform's stated position, in its author's words:
Je crois que tout devrait être montré, mais je crois aussi qu'une portion de ce qui est montré devrait être assumée par ceux qui décident de le regarder. Dogebarb, 10 September 2026
Which commands three things for anyone building on this index: nothing is deleted from the catalogue on the grounds of its content; the decision belongs to the visitor, never to the platform, which only asks them to own it; and what the platform shows is not what it endorses. For an exhaustive catalogue, that is the only position that holds.
4How a piece enters the vault, and how it leaves
It enters by one gesture and leaves by four doors. Every other route was presented to the contract and refused.
It enters by a single gesture and never otherwise. The seller sends the piece to the vault in the same atomic group as their listing call. The contract reads what actually moved in that group rather than trusting an argument: you cannot misdeclare what you deposited.
Five refusals guard that entrance, all of them obtained:
| What was attempted | What the contract answered |
|---|---|
| Deposit somebody else's piece | piece deposee par un tiers |
| Send the piece somewhere other than the vault | piece mal adressee |
| Call without attaching any piece at all | aucune piece deposee |
| Deposit a piece a third party can freeze or claw back | un tiers garde un pouvoir sur cette piece |
| Deposit one of the market's own currencies as if it were a piece | cet actif est une monnaie du marche |
The fourth deserves a word, because it protects the buyer and not the market. An asset somebody retains clawback rights over can be taken back from its buyer after the sale. The contract refuses to let it in, at all four deposit doors: listing, auction, offer, and offer acceptance. An independent review found that the offer path had been left out; it was closed, and the refusal was obtained on that exact path.
It leaves by four doors and no others: a sale, a withdrawal by the seller, the reclaiming of an expired listing by anyone at all, and the claiming of a piece the market owes. In the first three, the piece leaves along with the closing of the vault's position, once the vault holds no other copy.
5Buying: what it costs, what succeeds, what fails
The buyer pays the listed price plus the commission, and nothing else. The seller receives their price in full.
The buyer pays the listed price plus the commission, and nothing else. The commission is 2.5 per cent at most, ever, and section 3 continues below with what that ceiling means and how the rate falls beneath it. What follows here is the mechanism, measured to the unit on the test instance, on a listing at 0.5. The rate in force on the instance that was measured was one per cent, which is where the 5,000 in the middle row comes from; the arithmetic of the mechanism is the same at any rate, and the rate itself is read from the contract rather than from this table.
| What was paid | Outcome |
|---|---|
| The price alone, 500,000 | REFUSED, paiement insuffisant |
| Price plus commission, 505,000 | Went through, 508 units of budget out of 700 |
| More than that | Went through, and the surplus was returned |
The commission is added to the price, it is not deducted from it. The seller receives their price in full. That is measured rather than inferred: on a sale of 500 units in a currency, the seller received 500, not 495. The surplus line matters too, and it comes from a defect: the contract used to require enough and keep the rest, so a buyer who rounded up, or whose interface miscalculated the commission, silently left the difference behind. That is not theft, it is worse: a quiet loss on a market whose whole promise is that you get back what you put in.
The fixed opening fee, currently 25,000 microALGO, is paid by the SELLER
when they open their listing, not by the buyer. The operator can adjust
it, under a hard ceiling of 250,000 that is written into the code; the attempt
to exceed it is refused by frais au-dessus du plafond.
THE COMMISSION IS 2.5 PER CENT, AND THAT IS ALSO THE MOST IT CAN EVER BE. The figure is not a default setting that happens to sit at 2.5 today. It is a ceiling written into the contract's code, which cannot be changed after deployment by anyone, including its author and including whoever might own this marketplace in the future. The rate can be lowered. It can never be raised. That is a guarantee you can read on the chain yourself rather than a promise you have to take from us, and it is the reason the number is stated this way round.
Below that ceiling, the rate falls in evenly spaced tranches of what you have staked. Neither the width of a tranche nor the rate at each one is fixed in the code: both are set by the operator, adjustable after the fact, and until they are set no discount applies to anyone at all: the contract starts with tranches switched off, base rate for everyone. Each tranche's own rate is set individually rather than computed from a formula, so an operator can shape the curve, not just its slope. Adjusting any of it can only ever move the rate down from the ceiling: the contract checks the ceiling both when the tranches are set and again when a rate is applied, because a guard placed at one end only is a guard you get around from the other.
The tranches are evenly spaced on purpose, and it is not a matter of taste. An earlier version let the operator place thresholds anywhere, and working out which one a given deposit landed in took a full pass over all of them: measured at 940 units of compute out of the 700 a single ordinary transaction is granted, which refused the purchase outright, not only the discount. Someone holding a stake, even an unmatured one, could no longer buy at all. With even spacing, which tranche a deposit falls in comes from one division rather than a search, and the same call now costs 648 units: comfortably inside the budget of one ordinary transaction, with no second transaction for a wallet to compose on its own.
Two further bounds keep that scale honest, and they exist because a ceiling on the rate alone would not have been enough. A staked deposit only counts once it has matured, seven days by default: otherwise you would stake just before buying and withdraw just after, and the tiers would mean nothing. And the maturation period is itself capped at ninety days, because an operator who set it to five years would put the whole scale out of reach and so remove the discount without touching a single rate. Closing one door and leaving the window open is not a guard.
Both of those were attacked rather than assumed. A counterfeit staking application, declaring a hundred thousand billion tokens held since 2020, is not believed and pays the full rate. A deposit made at the last minute earns nothing. And the eight rules that guard how the tiers are set each refused a call built to break them.
What buying refuses, all obtained:
| What was attempted | What the contract answered |
|---|---|
| Buy your own piece | on n achete pas sa propre piece |
| Pay less than price plus commission | paiement insuffisant |
| Buy a listing whose deadline has passed | annonce expiree |
The first one is not about money. A seller buying their own listing loses only the commission, and in exchange writes a price of their own invention into the piece's history. This market's archive of real prices is its argument; a fabricated one stays in an immutable contract forever, and a single fabricated price makes a whole series doubtful.
One design fact that matters to you as a user: the asset opt-in can travel in the same group as the purchase. That is not a given, other marketplaces prevent it by locking their group size. Here, someone who discovers a piece buys it in one wallet gesture.
And if a purchase fails, it fails entirely. Payment and delivery travel in the same atomic group: nobody pays without receiving. The most common reason a gesture fails on Algorand is not the contract at all, it is that an account has not opted in to the asset it is about to receive, which costs it 0.1 of held balance.
6Auctions, the reserve, and who the guard protects
Once a bidder meets the price the seller asked for, the seller can no longer walk away. That guard protects the bidder, not the market.
An auction has a starting price and, if the seller wants one, a reserve. A reserve of zero means the starting price serves as the reserve: agreeing to open at a hundred is agreeing to sell at a hundred.
Duration: one hour minimum, thirty days maximum. Both bounds refuse, by
duree trop courte and duree trop longue. A bid placed in the last
ten minutes pushes the end back by the same amount, with total extensions
capped at twenty-four hours; without that cap, last-minute bids would postpone
the ending indefinitely.
An outbid bidder is repaid immediately, rather than having their money sit until the close. It is simpler and more honest, and it avoids having to repay a crowd of losers in a single closing transaction, which the size of an atomic group would forbid anyway.
THE GUARD THAT MATTERS MOST HERE PROTECTS THE BIDDER, NOT THE MARKET.
Once a bidder has met the price the seller asked for, the seller can no
longer withdraw the piece: the attempt is refused by reserve atteinte,
vente due. Without it, a seller could let the bidding climb and pull out at
the last moment, which would make taking part worthless. Tested on an auction
actually run, with a bid actually placed.
And the worst case the contract knows about, which is a winner who cannot receive. A winner is not a signer of the closing call, which anyone may make. If they have not opted in to the pieces, the delivery is rejected by the protocol and the close fails. Without a fallback it would fail forever: the seller's pieces and the winner's money would both sit in the vault with no method able to get them out. So the auction settles as though the reserve had not been met: the money goes back to the bidder, the pieces back to the seller, and each recovers their own. The seller loses the sale, which is a pity, and keeps the piece, which they otherwise would not.
Why the requirement is not imposed at bidding time instead, which is the obvious fix. It would prevent nothing: nothing obliges a bidder to stay opted in until the close, so they could opt in to bid and opt out before the end. The fallback is not a second best for want of something better, it is the only protection that holds. That argument came from the adversarial review, and it is better than the one the contract was built on.
The operator cannot help themselves to bids. They can set the share
withheld from a defaulting bidder, but never above twenty per cent, and
the attempt to exceed that engraved ceiling is refused by part retenue trop
elevee, tested to the unit.
7Offers: money before the piece
The one path where money arrives before the goods, which is why it carries the most guards.
An offer is the one path where the money arrives before the goods, which is why it carries the most guards. The offerer puts money in the vault against a piece that is not theirs yet, and nothing guarantees the owner will want to sell.
The seller deposits nothing. The piece only moves at the instant its holder accepts, inside the same atomic group. Someone who will not put their collection into an escrow therefore still has a complete way to sell.
The contract requires the offerer to have opted in to the piece before
offering on it, rather than letting them pay for nothing: acceptez la
piece avant d offrir dessus. And it refuses an offerer who has opted out
since, because otherwise the seller would meet a protocol error naming neither
the offer nor the reason, over something they did not cause and cannot fix.
An offer can carry a deadline. Past it, the offer can no longer be
accepted, offre expiree, and anyone can return it to its author. Before
it, that return is refused by pas encore expiree. The same offer refused
both, before and after: it was time that changed the outcome, not the way
the transaction was built.
When the sale concludes, the piece goes directly from seller to buyer, without passing through the vault. That detail comes from a defect. An earlier version routed it through the vault, which had never opted in to a piece somebody merely made an offer on, so no offer could ever complete on a one-of-one, which is to say on nearly the whole catalogue. It was the feature ranked first in the project's own research, and it was unusable at a hundred per cent. The direct route also avoids tying up another 0.1, and avoids the vault holding, even for an instant, property nobody asked it to keep.
An offer in a currency pays for its own storage. The offerer sends the
necessary ALGO in the same group, failing which depot en ALGO manquant pour
la boite. That closes a defect from the adversarial review: offers in a
currency were being financed out of the vault, and repeated offers would have
drained it.
8Debts: what could not be paid to you comes back to you
An account can stop being able to receive an asset between the moment it is owed something and the moment it is paid. The contract writes down the debt rather than holding or blocking.
The problem debts solve is ordinary and involves no bad actor. An Algorand account must have opted in to an asset to receive it, and it can opt out at any time, including between the moment something is owed to it and the moment it is paid. People opt out to recover the 0.1 each position ties up, usually without thinking about what is still owed to them.
The contract neither blocks nor keeps: it records a debt in that person's name, which they claim once they have opted back in.
Tested to the end, with balances compared before and after:
-
Money comes back to the exact figure. A seller paid in a currency they
had opted out of cannot claim before opting back in,
acceptez cette monnaie avant de reclamer; once they do, they receive their price in full. - A one-of-one piece returns to its owner. A seller who opts out of their own piece while it sits in the vault, then withdraws their listing, gets it back after opting in again.
- The withdrawal itself was not blocked, and that is the point. The contract could have refused it on the grounds that the piece cannot be handed back. That refusal would have sounded prudent, and it would have locked the piece and the listing both, with no way out for anyone. Instead it records a debt and lets the listing close. Refusing cleanly can be worse than deferring.
The operator cannot sweep up what is owed to you for TWO YEARS. The
attempt on a recent debt is refused by cette creance n a pas encore
expire. The delay is not a comfort setting: it is the whole thing that
separates this method from the confiscation the reviews closed elsewhere.
Shortening it would reopen that defect by another door. And an expired debt
that has not yet been swept remains claimable by its owner, because expiry is
a door the operator may open, not a deadline that erases you.
A DEBT OVER A PIECE NEVER EXPIRES, AND THE ASYMMETRY IS DELIBERATE. A reader will find a two-year limit on money, none on pieces, and take it for an oversight. It is a decision, and the reason is not technical: a sum of money is fungible and replaceable; a work is not. It has an author, a history, sometimes a value to its owner that has nothing to do with its price. Recovering three forgotten ALGO after two years and taking somebody's artwork do not read the same way, even though the code makes the same gesture.
And the cost of that decision is accepted with open eyes: a single unclaimed piece makes this market impossible to close, permanently. Its storage keeps the vault's minimum balance above that of a bare account, and closing requires a bare account. That is exactly what the two-year limit prevents on the money side, and it is left open here on purpose. Adding an expiry to make the market closable would be undoing a decision, not fixing an oversight.
One fact that says who these guards really protect. Algorand does not let the creator of an asset close their position in it. A minter can therefore never end up in this situation with their own pieces. The debt mechanism protects resellers, which is to say most of the people on a secondary market, and the ones with the least recourse if a contract decides to keep what is theirs.
9Other currencies: how one enters the market, and how it leaves
The market does not only sell in ALGO, and a currency that cannot be closed would make the market itself unclosable.
The market does not only sell in ALGO. The operator can open other currencies, and a listing can be denominated in one of them.
Opening one takes three things, each with its own refusal, all obtained:
that it be the operator doing it, seul l exploitant; that they have
opted in to it themselves, acceptez cette monnaie avant de l ouvrir,
failing which they could not collect the commissions it earns; and that it be
given a floor price, un plancher est obligatoire.
EACH CURRENCY CARRIES ITS OWN FLOOR, EXPRESSED IN ITS OWN UNITS, and this is the thing to understand before reading any figure in this document. The four currencies open today carry a floor of 100 units, and since they have two decimals, that is 1.00 of their unit, not 100 microALGO. A bound written in microALGO applies to ALGO and to nothing else. That distinction was not obvious in advance: it showed up when a sale in a token was actually run on the test network, and a listing at five units was refused as being below a floor that meant nothing there.
A floor can only go down, refusal un plancher ne peut que baisser.
The operator cannot raise the minimum price of a currency after sellers have
settled into it.
A currency can be closed, and that is what was missing once. An adversarial review established that the market became impossible to close the moment a currency was accepted: the opt-in and its floor storage, 0.1093, had no method that could undo them. There is now a closing method, and the four currencies open on the test instance all close in simulation, 96 units of budget each.
Two refusals guard it, both obtained: acceptez cette monnaie avant de
la fermer, if the operator has opted out and could not receive what is due
to them; and le coffre detient encore cette monnaie, for as long
as the vault still holds units of it.
10The exempt token, and a rule that was removed rather than repaired
The best fact about this contract is a rule that was deleted, because it could be rented for the length of a single transaction.
The market can designate ONE currency that pays no commission. The
designation is the operator's alone, ALGO cannot be the exempt one, refusal
l'ALGO ne peut pas etre exonere, and it can only be done once: le
jeton exonere est deja fixe.
This is the most useful thing in the contract, and it is made of a rule that was deleted.
An earlier version exempted anyone who held a million units of a partner token, which looked like a good way to create durable demand for it. The independent review measured something else: the contract was not reading a holding, it was reading a balance at an instant. It was enough to borrow the tokens inside the same atomic group and give them straight back. A commission of ten for an account holding three thousand tokens; a commission of zero for the same purchase with a hundred thousand tokens borrowed and returned in the same transaction, rounds 66868169 and 66868179. One large holder could have exempted the entire market by lending.
NO VIRTUAL MACHINE INSTRUCTION TELLS YOU HOW LONG AN ACCOUNT HAS HELD AN ASSET. A contract therefore cannot measure a holding, and any rule that depends on one is defeatable inside a single group. That was not a guard to strengthen, it was a rule not to write, and it was removed rather than patched.
What replaced it is not defeatable the same way: the exemption is on the currency you pay in, not on what you hold. Paying in a currency means actually parting with it, and you cannot borrow an expense.
And atomicity, here, worked against the contract instead of for it. Everywhere else it guarantees a buyer will not pay without receiving; there it guaranteed the lender would get their tokens back, which is exactly what made the instant loan free and safe. The same mechanism protects or betrays you depending on what you ask it to guarantee.
11Handover, suspension, closing, immutability
The four things an operator can do to the market itself, and the exact shape of what they cannot.
Handing over the operator role, and the warning the contract cannot give
The role is handed over in TWO steps: the operator proposes, the recipient accepts. A role sent in one gesture to a mistyped address would never come back. Proposing the null address cancels a proposal in flight, on purpose by the same gesture.
Three refusals guard it, all obtained: proposing is the operator's
alone; accepting when nothing has been proposed gives aucun transfert de
role en cours; and accepting a role proposed to somebody else gives ce
role n a pas ete propose a ce compte. The first of those is not decorative:
without it, anyone at all could take the role whenever no proposal was in
flight, since the null address is the value at rest.
BUT THERE IS A WARNING THE CONTRACT CANNOT GIVE, AND SAYING SO IS BETTER THAN LETTING YOU ASSUME A GUARD EXISTS. A new operator must have opted in to every open currency, or every sale denominated in the ones they have not will fail, because the contract cannot pay them their commission.
The contract keeps no index of open currencies: it counts them, it cannot enumerate them. No guard is therefore possible at handover time, and it falls to the interface to check and to announce it. Saying where a guard is impossible is worth more than letting you believe there is one.
Suspension, and what it is really for
The operator can close off NEW deposits without touching anything already deposited. It is the only way to stop the bleeding if a defect were found after opening, and it is built so that nobody becomes a prisoner of their own property: withdrawals, claims, auction closings and reclaiming of expired listings all stay open, permanently and by design.
Tested by actually suspending a twin instance: listing was refused there by
nouveaux depots suspendus, then the suspension was lifted and the state
checked again. Never testing it would have meant discovering on the day of an
incident that it does not work. The method moves no funds at all.
Bidding counts as a deposit, and that had been missed. A bid puts money in, so a suspended market was still taking deposits through its auctions until the guard was added there too. It is the kind of gap that only shows up when you ask which doors let value in, rather than which methods look dangerous.
Closing and immutability, in their exact form
This is the section a suspicious reader will check first, and it is the one most often said badly. Both halves are true, and they do not say the same thing.
THE CODE CANNOT BE CHANGED, INCLUDING BY ITS CREATOR. A real attempt to replace the program was presented to the test instance, signed by the account with the best chance of getting through, its creator, with a valid replacement program. The approval program rejects it. An immutability nobody has ever tried to violate is a claim, not a guard.
THE MARKET CAN BE CLOSED, BUT ONLY WHEN IT NO LONGER HOLDS ANYTHING.
Writing "this contract refuses to be deleted" would be false, and verifiable
as false in a few minutes: the closing method is in the public interface and
nobody hid it. Closing is the operator's alone, and it is guarded. As long as
the vault holds property, it is refused by le coffre garde encore quelque
chose, and the condition is not declarative: the contract reads the
minimum balance the protocol imposes on the vault. One open listing, one
unreturned piece, one pending offer, each shows up in that figure and each
blocks the close.
The whole sequence was run on a twin instance that really did disappear from the chain: closing refuses while anything remains; a piece held by a debt leaves when its owner claims it; a currency the operator opted out of only closes after opting back in; a currency the vault still held units of closes once everything else is gone; then the deletion goes through, the application becomes unfindable, and its balance returns to its operator.
And what was verified was the ABSENCE, not the success. A successful transaction receipt tells you a transaction went through. It never tells you the object is no longer there.
This is not a weakness dressed up as a feature. Total immutability would mean a dead contract could hold property forever, which is precisely the problem this project measured elsewhere, in the pieces still stuck in the escrow of a marketplace that shut down. What is true here is narrower and better: the market cannot be closed while it is holding anyone's property.
12What the contract cannot do, even if its author wanted it to
Not promises. Impossibilities, written into code that rejects its own replacement.
- Change its own rules. The program rejects its own replacement.
- Take a deposited piece. No path sends a piece out of the vault to anyone other than its depositor, its buyer, or its claimant.
- Withhold more than twenty per cent of a bid, an engraved ceiling.
- Charge a fixed fee above 250,000 microALGO, an engraved ceiling.
- Sweep a debt before two years.
- Raise the floor price of a currency once sellers are in it.
- Exempt ALGO from commission, or change the exempt token once set.
- Disappear carrying what was entrusted to it.
- Stop anyone from reclaiming an expired listing. Anyone may do it, and the property goes back to its seller, because the destination is written in the listing rather than chosen by the caller. The worst a stranger can do is return somebody's property to them at their own expense.
That last one is worth a sentence of its own. Nothing on Algorand triggers itself; something must call. This marketplace makes those calls as a courtesy, and the point of leaving them open to anyone is that if this marketplace disappears, nobody is left a prisoner.
13The numbers, for anyone who wants to know what a gesture will cost
What a gesture costs, what comes back, and the compute budget that explains every bound above.
What a listing asks of the seller, one piece in ALGO, in microALGO:
| Item | Amount | Returned? |
|---|---|---|
| Storage for the listing | 36,500 plus 3,200 per piece | yes |
| Opt-in reserve for the asset, held by the vault | 100,000 per new asset | yes |
| Provision against a piece debt | 22,100 per piece | yes |
| Provisioned exit fees | 4,000 | whatever is not spent |
| The market's fixed fee | 25,000 | no |
| Total paid | 190,800 | of which 155,800 returned |
What opening a listing costs, and what comes back
Measured end to end on a test-network instance running this contract: a seller opens a listing and withdraws it immediately. They pay 190,800 and get back 155,800. Opening then withdrawing a listing therefore costs 35,000 microALGO, being the market's fixed fee and 10,000 of network fees, plus the fees of the transactions themselves. Everything else comes back.
Why the seller provisions the exit fees at all. The transactions the vault emits to return a piece or pay a seller cost network fees. While those were charged at zero, they fell on whoever happened to call the method, so the vault could emit nothing without a third party agreeing to pay for it. The rule underneath is that neither the market nor its operator fronts the cost of a gesture somebody else asked for, and what is not consumed comes back with the rest.
The bounds and the ceilings:
| Floor price in ALGO | 10,000 microALGO, that is 0.01 |
| Floor price in another currency | whatever the operator set for it, in ITS units |
| Ceiling price, and ceiling bid | 1,000,000,000,000 |
| Auction floor | 130,000, adjustable |
| Commission | 2.5 per cent at most, ever, an engraved ceiling; paid on top by the buyer |
| Pieces per listing in ALGO | 3 |
| Pieces per listing in a currency | 2 |
| Pieces per auction in ALGO | 2 |
| Pieces per auction in a currency | 1 |
| Auction duration | 1 hour to 30 days |
| Extension per late bid | 10 minutes, 24 hours in total |
| Delay before a debt expires | 2 years |
| Share withheld from a defaulting bidder | 10 per cent, engraved ceiling of 20 |
The compute budget, which explains every bound above. Algorand grants 700 units to an application transaction. Measured on the test instance:
| Gesture | Budget used |
|---|---|
| List 1 piece | 460 |
| List 2 pieces | 571 |
| List 3 pieces | 682 |
| List 4 pieces | REFUSED, lot trop grand |
| Buy | 508 |
| Open an auction | 523 |
| Close an auction | 326 |
The 700-unit wall, and why a listing holds three pieces
At three pieces there are eighteen units of margin left. The limit of three is not a cautious setting, it is the wall. Each further piece costs about 111 units, because the contract walks the transaction group.
The ceiling bid counts UNITS of a currency, not value. A currency with a very large supply reaches it without any real fortune behind it, and a currency with many decimals reaches large unit counts quickly. Worth knowing before opening one.
14The theme of twenty-five
Decided · four of six constants already carry it
Every charge on this platform is a twenty-five. Learn the number once and the whole fee schedule follows.
Partout où on a des frais, on dirait que ça devient ma règle. Soit zéro point zéro vingt-cinq à chaque fois qu'on fait une action, vingt-cinq ALGO pour l'outil de récupération. Donc on est dans le thème du vingt-cinq. Je trouve que c'est juste, personnellement. Dogebarb, 11 September 2026
Wherever we have a fee, it seems to become my rule. Either nought point nought two five each time an action is taken, or twenty-five ALGO for the recovery tool. So we are in the theme of twenty-five. I think that is fair, personally.
One number, nine places
A fee schedule that has to be looked up one line at a time is a schedule nobody checks. Here a reader learns twenty-five once and can predict every other charge, which means a wrong number stands out instead of blending in. That is the practical value of the pattern, beyond the aesthetic one its author gives for it.
15The commission, and the ceiling written into the code
Ceiling engraved in the successor · scale measured on the test network
2.5 per cent is not a starting price that happens to sit there today. It is the most anyone can ever be charged, and the rate can only go down from it.
The commission is added to the price, it is not deducted from it. The seller receives their price in full. That is measured rather than inferred: on a sale of 500 units in a currency, the seller received 500, not 495. The buyer pays the listed price plus the commission, and nothing else, and anything paid above that comes back.
The figure is a ceiling written into the contract's code, which cannot be changed after deployment by anyone, including its author and including whoever might own this marketplace in the future. The rate can be lowered. It can never be raised. That is a guarantee you read on the chain rather than a promise you take from us, which is why the number is stated this way round.
The contract checks that ceiling at both ends. Once when the scale is set, and again when a rate is applied to a sale. A guard placed at one end only is a guard you get around from the other.
No ASA Compass contract has ever taken a commission from a real sale. The contract described in Part II runs on the test network and charges one per cent there; the successor carries the 2.5 per cent ceiling and is not engraved anywhere. Both statements are true at once, and a document that gave only the second would be describing a marketplace that does not exist yet.
16The scale: ten tranches of twenty-five million
Decided 11 September 2026 · written, not engraved
Locking XDB lowers the commission a quarter point at a time, and reaches zero exactly at the tenth tranche the contract allows.
Commission against XDB locked and matured
Locking, not holding, and the reason is a defect we found in our own code
A balance can be borrowed for the length of a single transaction. Algorand groups transactions atomically, so a wallet can be handed millions of tokens, buy something, and hand them straight back, all in one go, keeping nothing. We measured it against our own contract before anyone else could: the same purchase cost full commission with 3,792 units held, and zero commission with 100,000 units borrowed and returned inside the same group, at rounds 66868169 and 66868179.
No instruction on Algorand can say how long an account has held an asset. A contract therefore cannot measure holding at all, and any rule that depends on it is defeated inside the same group. That was not a guard to strengthen; it was a rule that should not have been written, and it was removed rather than patched.
Holding can be rented for the length of one atomic group. Locking can be measured, because the contract writes the date down itself. Maturing is what makes locking mean anything: without a waiting period, the defect comes straight back with one more transaction, since you would deposit just before buying and withdraw just after.
So the rule closes at both ends: adding to a lock resets its clock, taking some out does not touch it. Seven days by default, and the waiting period is itself capped at ninety days, because an operator who set it to five years would put the whole scale out of reach and remove every discount without touching a single rate. Closing one door and leaving the window open is not a guard.
Never write "locked" on its own. Write "locked and matured." A reader who believes an instant lock is enough is holding exactly the defect, in its third form.
Both of those were attacked rather than assumed. A counterfeit staking application, declaring a hundred thousand billion tokens held since 2020, is not believed and pays the full rate. A deposit made at the last minute earns nothing. And the eight rules that guard how the tiers are set each refused a call built to break them.
The staking contract exists and is deployed on the test network, application 770940665, and the market contract already knows how to read it. What it deliberately does not hold is the scale itself: it records how much and since when, and nothing else, so that changing a tranche never means redeploying it or re-locking anybody.
17A royalty for every creator, not a selection
Decided 11 September 2026 · no contract carries a line of it yet
2.5 per cent to the creator on every resale that goes through this market, offered to all 4,076 creators in the catalogue rather than to a chosen few.
C'est un autre nouveau service qui est incroyable. Je trouve qu'on offre ce qui est du jamais vu : la capacité — on va donner la chance à TOUS les créateurs, pas des sélectionnés, à tous les créateurs DEPUIS LE DÉBUT — de recevoir une commission sur les transactions de leur collection, de leur pièce. Pour tout le monde, tout le monde. Dogebarb, 11 September 2026
It is another new service, and it is incredible. I think we are offering something never seen before: the ability — we are going to give the chance to EVERY creator, not a selected few, to every creator SINCE THE BEGINNING — to receive a commission on transactions of their collection, of their piece. For everyone, everyone.
The mechanism, in its final form:
| Where the collection was minted | What the creator receives | Condition |
|---|---|---|
| Here, on ASA Compass | 2.5 per cent on every resale | None. The royalty follows the collection |
| Anywhere else, before this site existed | 2.5 per cent on every resale | The creator wallet locks 25 million XDB |
This project has no reliable way of knowing who created an old collection. A creator commonly used several wallets, which is an established fact here rather than a guess. Requiring them to show up in order to be paid turns a guess into a voluntary step, and it is the only mechanism available that does not ask anyone to sign anything to prove who they are.
That last point is deliberate and it is a safety decision. Asking a collector to sign a message to prove ownership trains them in the exact gesture phishing exploits. This platform does not do it anywhere, and not here either.
Why 2.5 per cent rather than 5, and the argument is its author's
Deux point cinq pour cent sur un marché où il y a beaucoup d'activité, c'est mieux que cinq pour cent sur un marché où il n'y en a pas beaucoup. Et pour un utilisateur, payer cinq pour cent, je trouve que c'est beaucoup, parce que c'est pour toujours, à chaque fois qu'un actif est échangé. Je trouve qu'exiger cinq pour cent, c'est un peu greedy. Dogebarb, 11 September 2026
Two point five per cent on a market with plenty of activity is better than five per cent on a market without much. And for a user, paying five per cent is a lot, I think, because it is forever, every time an asset changes hands. Asking five per cent is a bit greedy, I think.
Royalties on Algorand NFT sales, 2021 to 2026
4,076 distinct creators are named in the published catalogue, counted on the creator field of its 4,091 entries. That is the scale of what « everyone » means here: four thousand people to whom a royalty opens on pieces minted four or five years ago, on a market whose original platforms are dead.
Every address named anywhere in that file comes to 42,023, which would be a correct count of the wrong population: it mixes buyers and sellers in with creators. And nobody has checked how many of the 4,076 still collect a royalty somewhere else. That is unmeasured, and it is said here rather than assumed either way.
The buyer's XDB lowers our commission, never the royalty
An earlier shape had the creator's royalty falling with the buyer's staked XDB. Cutting our own commission is giving up our revenue; cutting the royalty is giving away a third party's money, and that third party agreed to nothing. The rule that came out of it, in its author's words: tu as raison sur l'aspect de redirection du créateur vers un objet de spéculation — you are right about redirecting the creator towards an object of speculation. The creator always receives their full percentage.
When a creator has not turned their royalty on, does the buyer pay less, or does the platform keep the 2.5 per cent? The honest answer is that it does not charge it at all, since otherwise the platform collects money meant for someone else. That has not been confirmed by the platform's owner, and this document says so rather than picking the answer that reads better.
18XDB: what it is, and what it opens
Token measured on chain 11 September 2026 · two of its uses exist today
Full disclosure first: XDB was created by the people who run ASA Compass. Nothing on this site requires it.
XDB, also called Dogebarb, is an Algorand asset with two decimals, asset ID 1290751153. It is the currency of this marketplace alongside ALGO. It was created by the people who run ASA Compass, and accepting it here is how they give it a use instead of a promise. Every listing, every sale and every offer works in ALGO. Anyone can read the link between the token and this project off the chain in a few minutes; it is far better that you read it here first.
The token is inert, and that is its most important property
| Power | Held by | Which means |
|---|---|---|
| freeze | the zero address | nobody can freeze a balance |
| clawback | the zero address | nobody can take tokens back |
| manager | the zero address | nobody can reconfigure the asset |
| reserve | the zero address | nobody can issue any more |
The supply of 200 billion is therefore final. No dilution is possible and no balance can be seized, which is what makes the token usable as collateral inside a contract: a clawback-able token would not be.
Algorand's zero address is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY5HFKQ
— fifty-eight characters, and it does not end in A. Testing
whether the field is merely present always returns true, and leads
straight to the conclusion that the token is freezable and clawback-able,
which is the exact opposite of the truth. This project got it wrong
three times in one day before measuring it properly, which is why the
warning is here rather than in a footnote.
Three different things are called a reserve, and they are not the same size
Say which one you mean, every time. The asset's reserve field is an address, and it is the zero address. The exchange pool is what actually sets the price. The supply is everything that exists. Burning nine billion XDB would be 4.5 per cent of the supply and 65.7 per cent of the exchange pool: the same measurement changes its conclusion depending on which denominator goes unsaid.
Where the 200 billion XDB are, across 1,161 holders
The liquidity is locked, and the lock is cryptographic
95.44 per cent of the pool shares sit in two accounts that have no
private key. They are the accounts of applications 2842666357 and
2313510156, which was verified by deriving each address from its
application ID: both match to the character. An application account
cannot sign, so the shares cannot leave except through the program
itself. Both applications carry the same 2,160-byte program, fingerprint
2dd88f58567442f6: they are liquidity locks.
The unlock date cannot be read. The applications' state carries timestamps, but they are dates of past events — the lock being placed in March 2025, a withdrawal of an unrelated token in February 2026 — and every one of them is in the past. Reading the expiry would take disassembling the program, and nobody has. The lock is real today and has never released a share. Until when, we do not know, and this document will not guess.
What locking XDB opens
One lock, three doors. That was decided on 11 September 2026, in three words: un seul verrouillage, trois portes. A visitor learns one number and understands the whole system.
One lock of 25 million, three doors
The thresholds do not exclude anyone by wealth. They oblige a person to show up, which is their actual function: this project cannot otherwise tell which of a creator's wallets is theirs.
This document deliberately gives no conversion of those thresholds into ALGO or dollars. A token price moves fast, and a converted figure in a document that outlives the week is wrong before it is read. The threshold is 25 million XDB; that sentence stays true.
There is a shorter page about all of this, written for someone who wants to understand what the token is for rather than check how it behaves: what XDB does here. It says the same things in fewer words. This section is the one that names the measurements.
The marketplace accepts several currencies, each with its own floor in its own units, and XDB is one of them: that is built and measured, in section 9. Everything else on this page is decided and not engraved — the tranches, the royalty, the lock that opens three doors. And no service of this platform is paid for in XDB today. The contract makes it possible; nobody is charged in it.
19Two units in twenty-five go back to the pool
Decided 11 September 2026 · no contract carries it yet
Eight per cent of everything the platform collects is paid into the XDB-ALGO exchange pool, in ALGO, and the shares it receives are put somewhere nobody can withdraw them from.
Si on a le thème du vingt-cinq sur tout ce qui est commission, tout ce qui est charge, tout l'argent qu'on reçoit — si sur vingt-cinq on gardait toujours DEUX UNITÉS. Dogebarb, 11 September 2026
If we have the theme of twenty-five across everything that is a commission, everything that is a charge, all the money we receive — what if out of twenty-five we always kept TWO UNITS.
| What the platform collects | Of which, to the pool |
|---|---|
| The 2.5 per cent commission | 0.2 per cent of sale volume |
| The recovery tool, at 25 | 2 |
| The fixed listing fee, at 0.025 | 0.002 |
| Any future charge, whatever its shape | 8 per cent |
| The creator's 2.5 per cent royalty | Nothing. It is untouched |
The exclusion of the royalty is its author's own, unprompted: ça, c'est juste sur NOTRE charge à nous, pas sur celle des créateurs. Les créateurs gardent leur deux point cinq. — that is only on OUR own charge, not the creators'. The creators keep their two point five. It is the second application of a rule stated earlier in a different context: you do not dispose of a third party's money.
Paid in ALGO, and nothing is burned
The original shape had one unit staying in ALGO and one unit buying XDB, with both then paid into the pool. That step turns out to do nothing, and the reason is simple enough to check by inspection: the only place to buy that XDB is the pool itself. The token leaves one side and comes back the other. Measured against the real reserves, the two routes end at the same numbers, to the token.
So the decision, in its author's words: on verse en ALGO et on ne brûle rien — we pay in ALGO and we burn nothing. What rises is the quantity of ALGO facing the same quantity of XDB. The effect on price is real; it simply comes through the other side of the balance.
Burning XDB pushes the price harder. It also empties the pool of XDB, so each subsequent purchase costs more, and the mechanism closes on the very people it was meant to attract. Compared over ten years at the 2025 rate of activity: paying ALGO multiplies the price roughly sevenfold while leaving the pool's depth intact; burning takes two thirds of it away. Paying ALGO takes nobody's place in the queue to cross a threshold. Burning removes two thirds of the places.
The mechanism makes the pool's depth proportional to the market's own activity. The more that sells, the deeper the pool, so the better it absorbs the very purchases that activity causes. That property is self-regulating and holds at any volume, independently of the fact that at today's volumes the mechanism collects almost nothing.
Shares received for paying into a pool are new and free. They do not join the existing locks on their own. Without one more step the platform would simply be accumulating liquidity it could withdraw, which is the exact difference between locked and ours. The decision is a lock of the project's own, audited and with its source published, and the reason is that a contract holding other people's liquidity has to be checkable by somebody else.
Those shares cannot be burned. Algorand's zero address holds no assets and has never opted in, so a transfer to it fails. That differs from other chains where a zero address accepts anything, and it is the sort of detail that gets discovered at the wrong moment.
And there is a legal question, which is serious and is not a technical one. A platform that takes a commission and spends part of it buying its own token, whose creator holds 9.22 billion of it, is close to the structure a regulator examines when deciding whether a token is a security. This is not a claim that it is one. It is that the mechanism moves the token towards that description, where its current use — a friction that obliges someone to show up — moves it away. It belongs with a lawyer, not with the people who wrote the contract.
20Everything that is charged stays adjustable
Permanent rule · the contract already applies it, and applies it the right way
The value can be set. The ceiling is engraved. That pair is what makes a contract worth trusting.
Ce qui est certain, c'est que toutes les charges, tous les frais, ça doit être changeable. Il faut que ce soit inscrit dans le contrat intelligent. Parce que si le prix du XDB devient trop grand et que toutes les charges deviennent trop grandes aussi — comme la quantité nécessaire à verrouiller pour débloquer certaines choses — la tokenomique ne fonctionnera plus. Il faut qu'on ait la possibilité de changer avec le temps. Absolument tout ce qui nécessite un paiement, XDB ou ALGO, il faut que ce soit modifiable. Dogebarb, 11 September 2026
What is certain is that every charge, every fee, has to be changeable. It has to be written into the smart contract. Because if the price of XDB gets too big and all the charges get too big with it — like the amount you have to lock to unlock certain things — the tokenomics will stop working. We have to be able to change with time. Absolutely everything that requires a payment, XDB or ALGO, has to be modifiable.
| What can be set | What bounds it, permanently |
|---|---|
| The commission scale | 2.5 per cent, engraved ceiling |
| The maturation period | 90 days, engraved ceiling |
| The share withheld from a defaulting bidder | 20 per cent, engraved ceiling |
| The fixed listing fee | 0.25, engraved ceiling |
| The price bounds | An engraved maximum |
That is what makes the contract checkable once and for all: you can satisfy yourself that the commission will never exceed 2.5 per cent, even if whoever operates this marketplace changes their mind, and even if it is somebody else by then.
A price ceiling protects by forbidding an increase. The operator can only go down. An access threshold has to protect in the same direction, which means forbidding it from being raised beyond a bound: if the token appreciates, the operator will want to lower the threshold, and nothing should stand in the way of that. The engraved part is that it can never be arbitrarily raised. Same protection, opposite arithmetic, and getting it backwards would build the barrier the rule exists to prevent.
The commission-exempt token is designated once and never changes. That is deliberate. If it could change, the exemption could be taken away from people who acquired the token in order to have it. Some things have to stay immutable precisely so they can be believed, and making that field adjustable in the name of the rule above would destroy the promise the rule is there to serve.
21What is not done yet
Publishing these makes the rest of this document stronger, not weaker.
- Nothing in Part III is engraved in any contract. The royalty, the tranches of twenty-five million, the lock that opens three doors and the eight per cent returning to the pool were all decided on 11 September 2026. The word "royalty" does not appear once in any of the three contract files. That part is entirely new code, not a setting, and this document says so rather than describing it in the present tense alongside rules that have refused real transactions.
- One question about the royalty is open and its answer is not ours to assume. When a creator has not turned theirs on, does the buyer pay less, or does the platform keep the 2.5 per cent? The honest answer is that it should not be charged at all, and it has not been confirmed.
- The lock that will hold the platform's own pool shares does not exist yet. It is decided that it will be the project's own contract, audited and with its source published, which is different from every other file in this project and deliberately so: a contract that holds other people's liquidity has to be checkable by somebody who is not us.
- All of this is on the test network. The program engraved on MainNet will have to be measured in its turn and its fingerprint compared. Until that is done and published, this document describes the test network and says so.
- The contract described here is not the one that will go into production. The successor is written and not engraved anywhere, and it carries the staking-linked commission scale: the rate falls in tiers below 2.5 per cent as the engraved ceiling, described in section 1 and section 3. The refusals recorded throughout this document were obtained on the contract in service, not on the successor, and everything here will be re-measured against whichever program is finally engraved on MainNet, its rule count included.
- Multi-copy listings are engraved nowhere. The mechanism is written, it compiles, and it has been tested on disposable instances. Until it is engraved, a listing holds three pieces at most.
-
Two rules out of eighty-two were never made to refuse, because they
are out of reach.
commission superieure au montantwould need a price of zero, which both entry doors refuse;cette piece n est plus au coffrewould need a clawback-able piece to have entered the vault, which both deposit doors refuse. They stay in as defence in depth, and their unreachability rests on refusals obtained upstream, not on an argument about the code. - A listing holds at most three pieces, with eighteen units of budget left at three. That is a limit rather than a defect, but it leaves no room: any guard added to that path would bring it down to two.
- One correction is read rather than measured. The fix preventing one seller from recovering a reserve another seller paid was verified by reading the code. Proving it would take two sellers of the same multi-edition asset and a withdrawal by the first before the second. That has not been done, and it is recorded here as read rather than observed.
- One limit is proven on a copy and can never be proven here. Sending the vault exactly the floor amount of a currency used to stop that currency closing, and the market with it, for about a dollar. The remedy is in place and tested, but the bench that tests it destroys by construction the instance it measures: it has run on six disposable instances and can never run on the test one. A debt that cannot be repaid is not a debt, it is a limit, and it belongs here rather than on a list of things to do.
- A per-buyer purchase limit, when it exists, will count what the buyer HOLDS. That penalises someone who received copies as a gift or bought them elsewhere, and it is a deliberate choice. It also means that, on a chain where an account is free, any per-account limit is a speed bump and not a barrier. Saying so is not an argument against it: it is what lets you pay the right price for it instead of buying an expensive guarantee you will not get.
- The site and the contract have to move together. The multi-copy mechanism changes two method selectors, and a selector that matches no method is rejected by the virtual machine rather than by the contract, so listing and buying would both stop at once with a message that has nothing to do with what the user was trying to do. When the contract cannot speak, the protocol speaks in its place, and it speaks badly.
22How to check any of this yourself
The benches are in the repository, they submit nothing, and a rule counts only if it actually refused.
The benches are in the repository, one chapter per family of rules. A full replay runs with one command and submits nothing: it simulates against the test instance, costs no ALGO and changes nothing. A rule is counted only if it actually refused a transaction built on purpose to break it, and if the refusal message, read back from the contract's own published interface, matches the expected one exactly.
Three methodological precautions are what give those figures their value, and a careful reader will want to know them.
Every chapter also builds a gesture that MUST succeed. Without it, you cannot tell a contract that guards from a bench that does not know how to compose a valid call. A bench that only ever collects refusals proves nothing.
A case that could not be built is declared as such, with its reason, and counted neither as proven nor as absent. A silent failure makes an untested path indistinguishable from a covered one.
A refusal from the protocol is not a refusal from the contract. Insufficient balance, an asset not opted in, a missing reference: those arrive before the contract runs, and counting them against it would invent defects that do not exist. The bench names them explicitly rather than guessing.
Seven security reviews were carried out, on six versions of the contract, and the versions they examined are archived so each review can be replayed against the exact object it looked at. The last two worked blind, without knowing of each other, and they have not a single finding in common. Zero out of five. That does not mean the reviews were poor. It means the coverage of any single review is far narrower than it looks, and this project measured that instead of assuming it. It is the reason there were seven and not one.
23Who wrote this
There is no authority here for you to defer to, so nothing in this document asks you to.
The contract, the guards and the bench that made them refuse were written and run by Claude, an AI agent, under the direction of this project's author. That is stated plainly rather than shown as a badge, because a badge would suggest a company examined and endorsed this marketplace, and none did.
Which is exactly why this document is built the way it is. There is no authority here for you to defer to, so nothing in it asks you to. The instance is named, its fingerprint is published, the bench can be replayed by anyone and submits nothing, and every mechanism is described by what it actually refused rather than by what it is meant to prevent. Check the parts you care about; none of it depends on trusting who wrote it.