Safety
The most useful thing to know about Ripstr's safety model is what the administrator cannot do. There is no instruction anywhere in the protocol that lets an admin withdraw, move, or seize a depositor's NFT or backing, and none that can redirect credited earnings or refunds. That is not a policy — the instructions do not exist.
What the admin cannot touch
- Escrowed NFTs. Only the depositor who paired an NFT with backing can withdraw it.
- Backing. Same. It is the depositor's capital, held in isolation, settleable only for its own position.
- Credited earnings and refunds. Once credited, a balance belongs to its owner and only its owner can pull it.
What the admin can do
- Turn acquisitions on and off.
- Halt deposits in an emergency.
- Move the pool into withdraw-only mode.
- Change configuration parameters within their allowed ranges (see Parameters).
- Curate the collection whitelist, directly or through a whitelist manager.
Lifecycle states
Loading phase. A pool deploys with acquisitions off so positions can be stocked before anyone can pull. This is the default for every new pool, including pools you create yourself.
Emergency halt. Acquisitions and new deposits can be stopped. Requests already issued still process or expire normally; then positions exit through the normal withdrawal path. Staged positions cannot be cancelled mid-halt, but they become activatable once the queue idles and are withdrawable from there.
Withdraw-only mode. The wind-down state: deposits and acquisitions are off permanently, while withdrawals, settlements and credit pulls stay live. This is also what gates rewards migration and lets purchasers recover an unspent $RIP buy allowance as SOL.
Structural guarantees
Pull payments everywhere. Refunds and earnings become credits you claim, not transfers pushed at you. A recipient who cannot receive — a contract that reverts, an account that does not exist — can never stall the ordered queue for everyone else. Strict transfers are used only where the recipient is the one signing.
Claim-based NFT delivery. Any delivery to a third party records an entitlement that the entitled party claims themselves. A broken or hostile collection cannot wedge a settlement.
Effects before interactions. State is written before any external call, everywhere. The selectable pool only mutates when every earlier request is terminal, so no re-entrant path can observe or exploit a half-applied state.
Solvency by construction. Fee credits round up on join and down on claim, so the total credited is always at most the total collected. Backing is isolated per position and never pooled.