1FTB
Safety84.4
Oracleless, keyless peer-to-peer design — no oracle to manipulate, no owner key, no liquidation price; the willing lender prices the collateral. On oracle integrity and authority it leads every peer on paper — but unlaunched and unproven: not yet live, $0 at risk, 0 days in production. A design projection; the target is to earn the score, not claim it. confidence: low (unlaunched)
score breakdown
| element | wt | /10 | pts | |
|---|---|---|---|---|
| fund safetyNon-custodial: funds move only on your signed transfer, and the loan book is keyless with proven conservation. The -1: the AMM pool runs under FTB's own pre-launch deploy key — the same key as the rest of the stack, not an outside party — burned on-chain at launch, not a NEO-L1 limit. | 18 | 9 | 16.2 | |
| oracle & price integrityFull marks. There is no oracle: the lender prices the collateral and swaps are caller-min-out protected, so the single most-exploited DeFi surface (price-feed manipulation) does not exist here. | 12 | 10 | 12 | |
| economic-invariant coverageNo LTV, no liquidation price, no bad-debt cascade; supply<=cap, one-claim and conservation are pinned by firing tests. The -1: proven by tests, not yet by formal proof. | 12 | 9 | 10.8 | |
| access-control & authorityLoan book keyless by construction; authority via CheckWitness + GetCallingScriptHash (never tx.sender); mint gated to the migrator. The -1: the rest of the stack still holds pre-launch owner keys pending the renounce (read live above). | 12 | 9 | 10.8 | |
| blast-radius containmentA default is a clean collateral->lender swap, no cross-contract cascade. The -2: the swap crosses into the AMM (FTB's own deployed router/factory/pairs), and the stack still holds its pre-launch keys; both close when every key is burned on-chain at launch. | 10 | 8 | 8 | |
| verification depthThe honest anchor. Reproducible builds, full public source and the field's incident catalog imported as firing tests are real — but there are no formal proofs, no external audit and 0 days in production. #1 on design only; this is the number time must earn down. | 10 | 5 | 5 | |
| feature-surface disciplineOne signing path, a NEO/GAS-only allowlist, no hooks or plugins. The -2: the swap adds the AMM's pair/LP surface — FTB's own deployed contracts, audited-Flamingo source — beyond the minimal core. | 8 | 8 | 6.4 | |
| signing & front-end integrityWYSIWYS review-and-sign, config-pinned recipients, least-privilege scopes (no blanket approvals), a DOM-sink-free CSP-locked client — tighter than Permit2. The -1: integrity rests on reaching the genuine IPFS build (the own-node control + on-chain re-check cover a tampered mirror). | 8 | 9 | 7.2 | |
| upgrade & governance safetyThe loan book is immutable (no upgrade path at all); governance is on-chain and keyless. The -2: pre-launch Update/owner keys on the rest of the stack are still live — the biggest closable gap, tracked on the key panel. | 6 | 8 | 4.8 | |
| residual-risk transparencyResiduals are named in the open: the unlaunched caveat is loud on the card, the key panel reads live, the vuln catalog is public. The -2: full marks want published external review + the renounce transaction ids on record (pending launch). | 4 | 8 | 3.2 |