cuckoo

Trust

Verification

What we ran, what it printed, and how to rerun it.

Everything here is reproducible from the repository. Nothing was deployed and no transaction was sent to the real chain.

1. Against the real chain

node scripts/real-chain-check.mjs injects Cuckoo's code by state override and runs eth_call against Robinhood Chain: a real buy on a live Pons curve, then the traps. Recorded run:

chain 4663, block 85989216, client nitro/v3.12.1-rc.2
block.number seen by Solidity : 26,170,542   ArbSys : 85,989,226   eth_blockNumber : 85,989,216
the chain advanced 10 blocks in 1,380 ms
live Pons curve 0x91DfC35724914aA3C8c229dDf35F66d3539dc385

NOMINAL  egg inside its window, real buy on a live curve ........... ok
         the contract reads the real L2 block, not the Ethereum one  ok
WINDOW   a window that has not opened ......................... TooEarly
         a window that is over ................................ TooLate
ORDER    recipient swapped by the keeper ...................... BadSignature
         reward raised after signing .......................... BadSignature
         signed by somebody else .............................. BadSignature
MONEY    egg already carried or cancelled ..................... Used
         no escrow behind the egg ............................. Insufficient

2. Contract tests

forge test: 15 tests, including two property tests (reward shape, conservation of money). They cover the window, replay, tampering, wrong signer, failed calls, cancel and withdraw, a keeper that tries to hatch twice from its payment callback, and plain ETH being refused.

3. Differential test

node scripts/differential.mjs builds random eggs (random windows, rewards, values, targets that revert, tampering, wrong signers, replays, cancels), lands them at random blocks on a local node, and compares the JavaScript engine with the real contract: verdict, error name and arguments, reward paid, escrow, and the buy's effect. Recorded: 800 random eggs, 800 identical.

4. Keeper and CLI, end to end

node scripts/keeper-e2e.mjs: deploy and deposit by the CLI, eggs signed by the CLI, a fast keeper lands on the first block of its window and earns the full reward, a slow keeper one block later earns less, two keepers race for one egg (one wins, the other is refused), a keeper that sends three blocks early loses its attempt and the owner loses nothing, then cancel and withdraw.

5. The code to trust

Runtime bytecode hash (keccak-256), 3068 bytes: 0x73a6ae6ebfa86212c7d8d9ddc18b3f670b7c932d44d371620d1a4f344956855b

Compile with solc 0.8.26, optimizer 500 runs, via_ir, EVM cancun, and hash the deployed bytecode.

6. Not measured yet

Where transactions actually land when a sender aims at a block on Robinhood Chain. cuckoo measure does it, with a funded key and a private RPC. We will publish the histogram here when it is run.

← Limits and risksFAQ →