Reviewed, then reviewed again.

Every finding had to survive a skeptic.

• Scoped reviewersIndependent reviewers, one per attack surface: access control, token handling, pricing, counting, governance, economic attacks, and the automation and website.
• Adversarial verificationA separate reviewer tried to refute every finding. Anything rated high had to be proven with a working exploit test against the real program and real pool data.
• Regression checksEach round re-checked every earlier finding against the code, not against the fix notes.
• Completeness criticA final reviewer each round looked for anything the others missed.
• Live rehearsalThe whole launch was run on a fork of mainnet: opting in, dividend sweeps, the daily count, the 30% switch, real buys against the $PENIS pool, pausing and settings changes.

The original review, of commit 3bfce2c:

The October reviews of the 24-hour hold, reward cap and wallet recovery found no way to take funds either. Everything they did find was fixed before it was merged.

What the current contract enforces.

• No discretionary withdrawalsThe current program cannot pay treasury $PENIS or locked liquidity to an operator. It can use $PENIS for the configured permanent liquidity deposits after the goal.
• Landlords keep what they holdCollections cannot reduce PUMP below the recorded starting balance and are limited by an allowance calculated from posted reward totals. The approval covers only that PUMP account.
• Held before it’s usedEvery collection waits at least 24 hours in a separate account and needs a second reviewer’s approval. Until it’s released, it can only go to the vault or back to its landlord, who can take it back at any time.
• Leaving never depends on usRevoking works from any wallet, without this site.
• Changes are slow and publicParameter and collection-operator changes wait 72 hours and stay within hard limits written into the code.
• An incident stays stoppedA guardian can pause collection, release and buybacks. Restart requires the admin; holder exits and refunds remain available. Receipt expiry is never extended by a pause.
• Token checksCollecting and buying stop on unsupported transfer hooks, fees above the allowed limits, or when an account is frozen.
• Fair pricesBuys are priced against the pool’s own recent average and sized to its depth, so a trade placed just before a buy can’t push far against the endowment.

• Spotting rewardsPUMP from rewards and PUMP bought look the same on-chain, so the collector and reviewer check stonk.fun’s payout records and each wallet’s history. They use separate keys but share code and data sources, so mistakes can affect both. The contract limits collection using trusted posted reward totals, holds it for at least 24 hours, and lets the landlord reclaim before release. These controls reduce risk; after release, this contract has no refund path for that contribution.
• An unlimited approvalJoining approves the endowment on your PUMP account for an unlimited amount, which keeps counting simple. What it can actually collect is set by the contract’s cap and baseline, not by the approval. Your $PENIS and other tokens aren’t included.
• The refresherAn automation key checks landlords before each daily count and posts stonk.fun’s reward total, which sets the cap. It can’t move funds, the contract bounds what any post can credit, and it can resign at any time.
• Counting is publicEach landlord’s counted $PENIS is on-chain and shown on the site, so any attempt to game the count is costly and visible.
• Outside token settingsPUMP and $PENIS each have a setting controlled by a third party. Unsupported hooks or fees above the allowed limits stop buying and collecting. A PUMP transfer hook could also delay returning a held collection until it’s switched off.

The review covered commit 3bfce2c of the open-source contract; the October reviews covered the changes since. The deployed program will be a verifiable build of the code on GitHub, so anyone can confirm what is running. While upgrade authority exists, it can change the code and its protections. Removing it is a separate decision after testing and review. Admin authority is separate: production thresholds and the reward allowance remain fixed, while bounded parameter changes, operator replacement and emergency restart remain possible. Admin renunciation is unavailable while contribution collection is live.