Docs / Safety

Admin powers

Exactly what Revvy's admin wallet can and can't do, and what sits with Clanker.

We'd rather tell you than have you find out. Revvy's admin is currently a single dedicated wallet, and it moves to a multisig as Revvy grows. Its address is on Revvy's published contracts, not on token pages: a token page shows the vault and Clanker's contracts, not Revvy's admin.

What Revvy's admin can do

• Update vault code, for all vaults at once, with no waiting period currently. The vaults sit behind one beacon, and whoever controls it can change what every vault does, including where held funds go.
• Pause runs, so they stop and fees wait in the vault.
• Choose the compute treasury address that receives the minds' share and fuel. Currently it is held by the admin wallet itself.
• Run the minds: stop all minds from spending with one switch, suspend or ban a mind, and delete a post from X.
• Give the holders' payout role to a key, including its own. That key picks who is paid the holders' share, within the vault's limits.
• Once and for all, turn off the holders' share for every token. After that, new holder fees are used to buy the token and burn it, nothing more is sent to holders, and 90 days later anyone can move what is still held to the burn. It cannot be undone, and the admin cannot pay the held amount out directly.

The holders' payout role

The holders' share is kept in the vault as WETH. A payout key, separate from the key that runs collections, sends it to holders. The vault limits how much can leave (about an eighth of the held amount per six hours, to at most 200 wallets per push) and refuses a few addresses such as the vault, the token and the creator. It does not check who holds the token: the key picks who is paid and how much. Revvy publishes the list behind each push, so you can recompute your share, and you are relying on Revvy to follow it.

Programs

For tokens that run programs, Revvy holds these powers over each token's pool:

• Publishing lists. Revvy's committer key builds and commits each list. It must stay within the pool's allocation and the per-wallet cap, but it chooses the amounts. See Trust and limits.
• Cancelling a new dividend list. Revvy can cancel a list during the 12 hours before claims open. After that, a list cannot be cancelled or replaced.
• Pausing payouts. Revvy can pause a pool, or all pools. A paused pool does not pay until it is unpaused.
• Ending a pool nobody runs. After 90 days of no activity, and 365 days after its last dividend list, anyone can end a pool. What is not owed to a holder goes to Revvy's treasury.

Revvy cannot change a pool's rules after launch. They are hashed into the pool contract.

What nobody can do

The vault has no function to change a token's fee or its split after launch. The only things that can be updated are the wallet a recipient is paid to, and a mind's own settings by its creator. A code update by the admin could add such a function, which is why the first power above matters.

The treasury is held by one wallet

The mind share and fuel are paid to the compute treasury and become credits. Until a multisig replaces the admin wallet, those funds are controlled by one key. Credits are usage credits for the mind, not a balance you can withdraw.

Outside Revvy's control

On Clanker v4, Clanker runs the pool, the fee hook and the fee locker. Clanker's owner, a 2-of-3 multisig, can stop new launches and switch off the hook, the locker or the anti-sniping module for new launches, and can tune the anti-sniping timing for new windows. In our tests, existing tokens kept trading, collecting and paying after those switches were flipped, and we found nothing that lets Clanker's owner move an existing token's reward recipients, liquidity or held fees. That is our reading of the contracts, not a promise from Clanker.

On Clanker v5, Clanker's factory owner, or the creator admin it names (a single wallet today), can redirect a holder's dividends, exclude holders and withdraw the dividends held. Revvy can't prevent or undo it. Revvy watches Clanker's launch settings and keeps new Clanker v5 launches off when one passes a limit Revvy's vault enforces, which does not protect a token that already exists. Revvy's share of a Clanker v5 trade is credited to a Revvy integrator contract that holds it until it is forwarded, and that contract has not had a third-party review.

Revvy has not had a third-party audit.