How Pebble protects the system

Security

EFFECTIVE · JULY 22, 2026 · DRAFT

1. Revenue verification, not self-reporting

Builders never type their own numbers. Revenue is read through a read-only, restricted payment-processor key that can see transactions but cannot move money, issue refunds, or change anything. Each month's figure is signed by Pebble's attestation service using EIP-712, and the listing's smart contract verifies that signature on-chain before any distribution is computed. A figure that wasn't signed by the attestor is rejected by the contract itself.

2. The escrow bond

Before a Builder can raise a single dollar, the listing contract requires an escrow bond — typically three months of expected distributions — locked on-chain. If a distribution is missed past its grace period, anyone (not just Pebble) can trigger the bond to pay Backers, and the listing is publicly and permanently flagged. Enforcement is a property of the contract, not a policy we apply at discretion.

3. On-chain settlement

Every raise, bond, distribution, and claim is a transaction on Robinhood Chain that anyone can inspect. There is no internal ledger to trust: the public record is the record. Backer claims use pull-payments with reentrancy protection, and cap accounting is enforced in contract code — when Backers have received their cap, the agreement terminates itself.

4. Contract assurance — the honest status

The Pebble contracts are covered by an automated test suite exercising the full lifecycle: raise, over-fill protection, bond enforcement, signature verification, tampered-figure rejection, pro-rata payout math, missed-payout bond coverage, cap termination, and failed-raise refunds. They are not yet independently audited. A professional audit is a hard requirement before mainnet funds, and this page will link the report when it exists — until then, treat the system as testnet-grade.

5. Key management

The attestation key exists only inside the signing service and is never present in the web application, the contracts repository, or any Builder-facing surface. Processor credentials are stored encrypted, scoped read-only, and revocable by the Builder at any time from their processor dashboard. Pebble never holds Backer private keys — your wallet is yours, which also means its security is yours.

6. Reporting a vulnerability

If you find a security issue in the contracts, the attestation service, or the site, contact us privately via direct message to @OnPebble before any public disclosure. Good-faith research conducted without harming users or funds will not be met with legal threats, and meaningful findings will be credited. A formal bug-bounty program is planned alongside the audit.