OXYGENOXYGEN — Trust Boundary
What’s enforced, what’s trusted
We plant with our own contractor rather than through a charity partner, so the line between what a contract guarantees and what you take on our word is the most important thing on this site. Blurring it would be the easiest way to mislead you, so here it is drawn plainly.
Enforced by the contract
Checkable without asking us.
- The reserve share of every plot and tree payment leaves in the same transaction that receives it. It cannot be skipped or deferred.
- That share can be adjusted, but never below half — the floor is in the contract, not in a policy.
- Tier assignment comes from a block hash that did not exist when the mint was submitted. Nobody can choose or re-roll it.
- One plot per wallet, and its tier only ever goes up. There is no downgrade function to call by accident.
- Planting beyond a plot's slots reverts. So does minting past the collection cap.
- A planted tree is held by the garden contract, so it cannot be sold while it is counted in the ledger.
Requires trusting us
No code can prove these.
- That the funds sitting in the Reserve are actually converted and paid to a planting contractor, rather than held indefinitely.
- That the photos, GPS logs and invoices we publish are genuine. There is no independent charity partner vouching for them.
- That the relationship with a contractor and access to land continue to exist — no on-chain guarantee covers that.
- That the daily planting commitment is kept day after day, and that a day marked queued is genuinely waiting on weather rather than on us.
- That the tree price we publish is the right one. The contract checks it is fresh and has not jumped, not that it is correct.
Also worth stating plainly. Withdrawal from the Reserve currently needs one key, not a multisig — moving it behind a Safe is planned, and until it happens this column is where that fact belongs. Royalties on resale are optional for the seller on most marketplaces. The tier draw is a block hash, not a verifiable random function, because this chain has no VRF.
System status
The parts that have to be running for the rest to work. A stale price halts minting by design — better than minting against a number nobody is maintaining.
Indexer…
Price feed…
Last price write—
Reserve balance…
A healthy price feed can go a long time without writing: it only publishes on a 5% move or on its heartbeat, so the check time above is the liveness signal, not the write time.