Trust model

What is enforced on-chain

The audited reward program must enforce all of the following:

• The reward mint cannot change after launch.
• The creator recipient cannot change after launch.
• The creator/holder split cannot change after launch.
• The vault authority is a program-derived address with no private key.
• There is no privileged withdrawal path of any kind.
• There is no generic sweep instruction.
• Destinations cannot be substituted during fee claims.
• Stock cannot be purchased into an unverified token account.
• No claim may exceed cumulative allocation minus the amount already claimed.
• Distributions cannot be replayed.
• Claims never expire.
• Pausing cannot redirect assets.
• No key exists that could seize holder allocations.
• All amounts use checked integer arithmetic.
• Every external program and mint is allowlisted.
• Upgrade authority and root authority are separate multisigs.
• Existing vault assets cannot be silently substituted when an asset is disabled.

What is trusted off-chain

• The indexer. It replays finalized transactions to compute balance-seconds. A defect or a dishonest operator could compute the wrong allocation. Proof Tape publishes the dataset so the computation can be checked and disputed.
• The root publisher. A multisig publishes each Merkle root. It can publish a wrong root, but it cannot exceed the vault's assets, cannot redirect them and cannot take a holder's already-claimable balance.
• The keeper. It triggers fee claims, conversions and deliveries. It cannot choose destinations. A compromised keeper cannot steal — at worst it can waste its own transaction fees or stop cranking.
• The upgrade authority. An upgradeable program can be changed. Review the published policy and multisig before depositing value.
• The issuer and its custodians. The instruments are third-party liabilities that depend on off-chain custody arrangements entirely outside NVIDIA-PAD's control.
• The compliance provider. Eligibility attestations come from a regulated external provider. NVIDIA-PAD fails closed when no current attestation exists.

Key custody

NVIDIA-PAD holds no privileged vault key, no root authority key, no upgrade authority key and no treasury key in application secrets. Reward funds are never held in a database. A server-operated keeper, if used, may only hold a constrained transaction-fee wallet.

Where this application is today

There is no deployed NVIDIA-PAD reward program. Every reward write is disabled and every reward surface fails closed. The specification the external program must satisfy is published in the repository as docs/NVIDIA-PAD_REWARD_PROGRAM_SPEC.md, and the readiness checklist is visible on the protocol status page.