Who holds which keys

Every key this product operates with, what it can do, and what it cannot. Values not yet configured say so explicitly — this page never shows a number that has not been set.

Program

The on-chain program holding all entry funds. Prize and refund payments are made by the program itself; its instruction set contains no other way for money to leave.

5aawXayPYgEqrnHi6pGiYRpuHNuwauj8GqftRjkeXH17

Upgrade authority

The only key that can change the program code. Before mainnet it moves to the multisig, so an upgrade requires the stated number of signatures; on devnet today it is a single operator key while the rehearsal runs.

GXKXLYHBWBAhp7LWNMEZbsuwGb3WHeoDBsmhfndwagXY (single operator key on devnet; moves to the multisig before mainnet)

Signatures required

1 of 1

Upgrade timelock

not yet set

Key inventory

Key	Held by	Can	Cannot
Admin (multisig)	9EEWtzyu72a3DKJVUkCaeYX4HuBKD59xXCcENnDVe34Z (Squads vault of multisig 9EL1m9wvqGSznHJ8zkS5YaXQnG4gq4aNYsbGnP1TmFyN)	Open or close tiers, set ceilings, switches and pool timings, rotate the service signers and the keeper, pause new entries, and record that a review upheld a flag.	Move money. No admin instruction transfers a lamport — an upheld flag leaves the prize in the pool’s own vault for the next eligible player; pausing never blocks settlement or refunds.
Entry signer	9XhwKrXjKwFdYJatxYMZYyfB6nFLbmdFNSuM5JTyy8TP (Turnkey, non-exportable)	Sign entry packets — the per-entry approval that a wallet passed the entry checks.	Move money or touch pools. A stolen entry signer could admit entrants, never pay itself.
Settlement signer	EaDfwMWwW712L4YgdhBgEqbzzpdVP17e5mvY9LPwjrSD (also the keeper on devnet)	Reveal pool secrets after seal, commit results, run the prize payments the program validates, and pay a forfeited prize onward to the next eligible player against the committed results.	Choose amounts or recipients, or enter a pool. The program checks every payout list against the prize pool and the recorded entries, and every onward payment against the committed results; a wrong list is rejected on-chain.
Pool sealing keys (one per pool)	Key custody service (export-locked until seal)	Decrypt the pool’s sealed battles — only exported once the pool is sealed or past its deadline.	Be read early. The export rule is enforced by custody; the reveal publishes the key for everyone.
Prize treasury	Held by the program itself (a derived account — no private key exists)	Hold pass-sale revenue, fund each pool’s fixed prize pool before entries open, and pay refunds. The one exit is a multisig-approved withdrawal, and the program blocks any withdrawal that would dip below the published floor: the minimum balance, one further prize pool per idle tier, and every entry payment that could still be refunded.	Pay anyone directly, skim an open pool, or touch the refundable entry payments — the floor is enforced by the program, not by policy.
Publishing wallet	HG56vMbHkPHybYVLtvJqhusZfVmtbPfaZmHCYMQAw7uL	Pay to publish each pool’s reveal bundle to permanent storage.	Alter results. The published bundle is checkable against the on-chain commitment by anyone.
Operator decision key	Held by Blotto Cup	Sign review decisions on flagged entries; every decision is recorded in a public, signed log.	Pay itself. A review decision can only release a held prize to its entrant or record that the flag was upheld — an upheld prize is paid to the next eligible player, never to us.

Configuration last updated 2026-09-08.