Docs · how raffles work · FAQ

Permissionless raffles, baked into bytecode.

No admin. No extend. No cancel. The contract is the time-lock and the contract is the escrow. Once you create a raffle, neither you nor we can pull the prize back before the timer ends.

How a raffle works

Five on-chain stages. The keeper handles the boring middle so users only need to show up to buy and claim.

  1. Step 1

    Create

    Creator picks a prize (NFT or any TIP-20 token), a ticket price (in pathUSD), ticket supply, and an end timestamp. The contract pulls the prize into escrow and emits a RaffleCreated event. Listing is free.

  2. Step 2

    Buy tickets

    Anyone holding pathUSD can buy any number of tickets up to the supply. Tickets are weighted: buying more tickets raises your chance of winning, proportional to total tickets sold. The contract tracks each buyer's wallet + ticket count and salts a per-raffle entropy accumulator at every buy (this is what makes the eventual draw MEV-resistant).

  3. Step 3

    Draw

    The timer ends. The protocol picks a winner. The raffle page tells everyone where they stand: if you didn't win you'll see it in red, if you did win you'll see it in green with a Claim button waiting for you.

  4. Step 4

    Claim

    Winner clicks Claim, prize lands in their wallet. Creator clicks Claim, 95% of the pool lands in theirs. The remaining 5% settles to the protocol treasury. Everything happens directly from the smart contract: no middleman holds your prize, no support ticket required.

Creating raffles

The full create flow takes 1–3 wallet signatures depending on what's already approved.

What can I raffle?

NFT raffles (any ERC-721) or token raffles (any conformant TIP-20 as the prize: pathUSD, alphaUSD, your project's token, whatever you like). Whitelist raffles were removed in v2. Too easy for bad actors to spin up fake spots and walk away with the pool. NFT and token raffles both have skin in the game by design: the prize is escrowed in the contract the moment you sign create.

What do buyers pay in?

pathUSD only. Every raffle on the protocol uses pathUSD as the ticket currency, so buyers can always show up with one stablecoin and participate in any live raffle. The buy-in is locked at the contract level, not just in the UI: any other token is rejected at create.

What prize tokens work for token raffles?

Any conformant TIP-20. Two caveats: fee-on-transfer tokens (that skim a cut on every send) and rebasing tokens (whose balances change over time without a transfer) will revert at payout. The contract's egress balance-delta check catches them. If you pick a broken token, the pool sits in escrow. Pick a token whose transfer moves exactly the amount you specify.

What's the listing fee?

Free. Creating a raffle costs nothing beyond gas. The protocol only takes a 5% cut from the buy-in pool when winners are drawn.

What if my raffle doesn't sell?

If the timer ends with 0 tickets sold, only you (the creator) can hit "Reclaim prize" to pull your NFT or token pot back to your wallet. Nobody else can refund it for you. The burden of an unsold listing is yours.

How is the winner picked?

See Security → Provably-fair randomness below. Short version: 4 entropy sources mixed together, no single party can bias the outcome.

Security

The raffle contract has no admin, no upgrade path, and no cancel function. What that means in practice:

No admin override

There is no owner role. No setOwner, no pause, no cancelRaffle, no extendDeadline. The functions literally don't exist in the bytecode. Once you create a raffle, the only states it can move through are: CREATED → AWAITING_RANDOMNESS → RESOLVED → CLAIMED (or REFUNDED if 0 tickets sold). The MUNKS team cannot reach into a live raffle to change anything.

On-chain escrow

Your prize moves into the raffle contract's escrow at create time. For NFTs we verify ownerOf changed before accepting the create. For token pots we verify the contract's balance increased by exactly the prize amount (this rejects fee-on-transfer and rebasing tokens at create, before they can cause downstream accounting bugs). The prize cannot leave the contract until the winner claims it, the creator reclaims it on a 0-ticket refund, or anyone pushes it to the winner after the 7-day grace period.

Provably-fair randomness

The winner is picked by hashing four independent entropy sources together:
  1. blockhash(resolveBlock + 5): a future block, unknowable at resolve time
  2. blockhash(resolveBlock + 10): a second future block, separated to require multiple proposer slots to bias
  3. block.prevrandao at finalize-time: the entire validator set's RANDAO mix
  4. Per-buy entropy accumulator: XOR of every buyer's address, ticket count, and the block they bought in. A would-be biaser must predict every honest buyer's tx to control this input

To bias the outcome, a validator would need to control both future blocks and the finalize block and predict every ticket buy in advance. The combined probability is exponentially small. Click "Provably fair" on any raffle page to see the live inputs and verify the winner deterministically by hashing them yourself.

Egress balance-delta checks

Every outbound TIP-20 transfer (winner payout, creator payout, treasury claim) runs a balance-delta check on the recipient. We verify they received exactly the displayed amount. If a creator picks a fee-on-transfer or rebasing token where the recipient gets less than nominal, the tx reverts and the funds stay in escrow. This is a footgun for the creator, but it never silently short-changes a winner.

Independent audit

The contract was independently audited prior to mainnet deploy. Critical findings (creator-locked payout, egress fee-on-transfer skim) are fixed. The current deployed bytecode is source-verified on Tempo's verifier. Anyone can compare the deployed runtime bytecode against the git source. View on Tempo Explorer

FAQ

The questions everyone asks before they buy their first ticket.

Is this safe?▾
The contract is permissionless, source-verified, and has no admin keys. The MUNKS team cannot drain the contract, change a raffle's outcome, or pull a prize back. Both creator-side risks (fee-on-transfer tokens, lost private keys) and buyer-side risks (you bought a ticket and lost) are surfaced clearly. There is no hidden rugpull surface. Just regular smart-contract risk, which is non-zero. Don't put in more than you can lose.
Can the team rig the draw?▾
No. Even if the team controlled a validator slot, the winner is derived from two separate future blockhashes plus prevrandao plus per-buyer entropy. To bias the outcome, the team would need to be the proposer of two specific blocks, plus the proposer of the finalize block, plus predict every honest buyer's transaction. The combined probability rounds to zero.
What happens if no one buys a ticket?▾
The creator can hit "Reclaim prize" after the timer ends to pull their NFT or token-pot prize back. Listing is free, so nothing else needs to settle.
What happens if I win but don't claim?▾
You have a 7-day grace period after finalize() to claim your prize directly. After that grace period expires, anyone can call claimForWinner() to push the prize to your wallet on your behalf. Either way, the prize ends up with you. The contract just stops holding it indefinitely.
Can I get my money back if I bought a ticket?▾
No. Once a ticket is bought, the buy-in is in escrow until the raffle resolves and pays out. There is no buyer refund. That's the whole point of the time-lock. (If a raffle ends with 0 tickets sold, the situation doesn't apply because you wouldn't have a ticket.)
What's the protocol fee on the pool?▾
5%. The other 95% goes to the creator. Both are paid out from the buy-in token pool when claims are pushed.
Who picks the winner, you or the chain?▾
The chain. The winner is a deterministic function of public inputs (two future blockhashes, prevrandao, the entropy accumulator). Anyone can verify the winner by recomputing keccak256(seed1, seed2, prevrandao, entropy) % ticketsSold and walking the participant list. There is no off-chain oracle.
What if my wallet doesn't show the right token balance?▾
That's almost always wallet-level cache lag, not the contract. Hard-refresh the page; if it persists, check the contract directly on Tempo Explorer (link in the footer). The contract is the source of truth.
Can I edit my raffle after creating it?▾
No. End timestamp, ticket price, ticket supply, prize, and buy-in token are locked at creation. Cancel and extend functions don't exist in the bytecode.
What chain is this on?▾
Tempo. Mainnet (chain id 4217) and Moderato testnet (chain id 42431). Same contract, same rules.
What about gas fees?▾
Tempo gas is paid in native USD. Each tx (create, buy, claim) typically costs less than a cent. Creators pay gas for create + claim. Buyers pay gas for buy + claim.

Still got questions?

Read the contract source on the Tempo Explorer, or just create a raffle and watch every step land on-chain.

Create a raffle →View contract source