Contract controls what the owner can and cannot do
Nothing is deployed. This page is written now, before there is an address to point at, so that the list of powers cannot quietly grow between the promise and the deployment. Once ZomiBond is live the panel below reads the real thing over RPC and compares it with what is stated here.
chain
not deployed
Deployment
read over RPCAddressnot set
Deploy transactionnot set
Blocknot set
Ownernot set
Authorized signernot set
Runtime bytecodenot read
Pausednot read
Mint pricenot read
Reservenot read
Proceedsnot read
The site configuration carries no collection address, so nothing was fetched. scripts/go-live.py writes one only after it has checked the code and the symbol at that address over RPC.
What the owner can do
five powersPauseStop minting and claiming. Transfers of an already minted Zomi are not affected.pause, unpause
SignerReplace the address whose EIP-712 signature authorizes a mint. A wrong signer stops mints; it cannot mint anything by itself.setSigner
PriceChange what a mint costs. It cannot be applied retroactively and it cannot touch a token already minted.setMintPrice
ProceedsWithdraw the mint proceeds to an address. Proceeds and reserve are separate balances and this function can only reach the first.withdraw
OwnershipHand ownership to another address in two steps: the new owner has to accept before anything changes.transferOwnership
What the owner cannot do
seven of themReserveTouch the bond reserve. Withdraw reaches proceeds only, and the two are tracked as separate balances.by construction
CouponsStop, redirect or claw back a coupon. A claim pays the token holder and nobody else.by construction
TermChange the term or the weight of a minted Zomi. There is no function that writes either one after mint.immutable
SupplyMint past 10,000. The cap is a constant, not a setting.constant
Your ZomiMove or burn a token you hold. There is no admin transfer and no burn.by construction
RenounceAbandon ownership into the void. Renouncing is disabled, so the contract can never be left with a pause it cannot undo.disabled
MetadataRewrite the art. The uris are bound into the signature that authorized the mint and the engine is deterministic, so the picture can be recomputed from the id by anyone.bound at mint
Residual risks
stated, not solvedSettlerThe shielded ZEC route is honoured off chain. Until that rail exists, setting a route stores a preference and trusts whoever settles it. Coupons pay in ETH on chain in the meantime.trust
PrecisionThe accrual index is fixed point, so a claim can round down by a few wei. It is built to round down rather than up: the sum of every claim cannot exceed what was funded.rounding
Signer keyThe key that authorizes mints is held off chain. If it leaks, mints can be authorized until the owner replaces it. It cannot reach the reserve or anyone's tokens.operational
HookThe one percent that feeds the reserve depends on a Uniswap V4 hook that is not deployed on this chain. Until it is, the reserve only grows from direct funding.not built
ReviewThe contract has an internal review and a test suite, and no external audit. That is a statement of what has been done, not a claim that it is enough.internal only
The tests, the deployment steps and the full internal review live beside the source in the repository, under contracts/.