# Contract function coverage audit

Independent read-only audit, 2026-09-15T06:26:52.964Z. Live snapshot: Cronos chain 25, block **94009503**. No transactions submitted and no website files changed by this audit.

## Verdict

The main staking flows are implemented, but “all contract functions are added” would be false. Complete user functionality is not equivalent to exposing every selector. The right target is a documented allowlist with each absent function deliberately classified.

The runtime and selector record is in the [contract manifest](/contract-manifest.json). CHZ has 125 loupe-routed selectors across 28 facets; FEED has 80 across 25. Seven standard loupe/metadata signatures were resolved by standard interface selector matching when the explorer returned empty ABIs, explicitly annotated in the evidence. **Two FEED selectors remain unresolved:** 0xc22cbb5d and 0x5ea2c91b, routed to the token itself. Therefore this is a complete inventory of the loupe-returned selectors at this block, not a proof of every runtime dispatch path or the complete semantics of every function. Proxy-level multicall is separately present in the saved deployment ABI and is not an ordinary UI action.

## Confirmed findings and gaps

1. All three staking addresses have the exact 45-byte minimal-proxy runtime targeting 0x1fc79e01fe724ef4a1f8995f1299b90565a6ad39. Each ticketToken matches its collection. Owner remains A796, configuration lock is zero, withdrawal power is not revoked, recipient is A796, and withdrawal mode/recipient are not locked. The owner can still remove reward funding; a claimable number is not reserved cash.
2. User stake/unstake use array overloads; claims explicitly specify FEED and the connected beneficiary. The site checks pool runtime, ownership/custody, network and simulation. Alternative native-currency claims must remain excluded.
3. Pool admin exposes six settings; setEmissionTimeUnit and setTotalTickets are intentionally absent, as are withdrawal and irreversible lock/ownership operations. Adding these without historical-position simulation would make the site more dangerous, not more complete.
4. FEED has a live diamondCut selector. Existing mint checks verify selected facet addresses and nonempty code, not every installed facet and every runtime hash. Current shop runtime is immutable but its payment-token dependency is not. Add a machine-readable expected selector/code-hash manifest and clear changed-module state.
5. CHZ has no diamondCut selector in the current loupe response. Do not automatically claim CHZ is freely upgradeable just because it uses facets. This audit does not prove immutability: proxy source and other privileged paths need review first. CHZ exposes burn/burnBatch, roles, max-supply changes/freezes, royalties and metadata locks that are not UI-enabled. Public tier configuration is now exposed for reviewed price/date updates.
6. CHZ public mint supports reviewed zero-root tiers 2 (CRO) and 4 (FEED), with direct selector-storage and module-runtime pins, live timing, eligibility, remaining allocation, supply, balance, exact allowance, simulation, stale-price and receipt checks. Owner mintByOwner is separate. Price/date updates preserve other tier fields; they require owner simulation, review and receipt readback. Other tiers remain unsupported. The CRODEX reference is manual and is not an oracle.
7. OG Founder public mint and a subset of enumerable collection admin operations are implemented. Saved ABIs have 52 functions each. Whitelist administration, reveal, alternate URI settings, withdrawals and ownership transfer are not in UI. Posterz is intentionally secondary-market only; legacy/postcard public mints are excluded.
8. No standard FEED burn(uint256) or burnFrom(address,uint256) is in the enumerated routes. setBurnablePausedUntil does not establish that burning is installed. Do not add burn buttons or describe treasury transfers as burns.
9. The fixed shop has 8 function entries (six generated/read functions plus purchase and setPaused). User purchase, ownedMask, prices and pause administration are covered. It does not mint tokens, burn payments, refund, transfer entitlements, change prices or add items. Future catalogue/utility requires a new companion implementation preserving old purchases.
10. Legacy LP booster 0x5d173cd1faf703269e3c7483625be7955e315bd1 now has a narrowly validated recovery path: exact historical withdrawBoosters(true) calldata with 1 CRO returned Founder #74, #629 and #432 on an isolated current-state fork. Recovery must require the tested ended-period, zero-LP and zero-reward state, current custody and runtime pin. Full source/ABI and the boolean semantics for other states remain unverified. See booster-recovery-audit.md. No EGGS contract is verified.

## Impact on existing enabled actions

No target-address or pool-routing mismatch was found in the live reads. The unresolved FEED routes are not called by currently enabled owner mint, transfer, approval or shop purchase paths. They do not by themselves establish a defect in those enabled paths. This coverage review did not execute mainnet writes and cannot substitute for fork simulation of every administrative path.

Founder direct runtime at block 94,010,140 is 22,280 bytes, hash `0xdc8b5df4cfe911ddb1bae332d701108f47c1118a3025295c62cf5d8cc6588dd3`. Its EIP-1967 implementation and beacon slots are zero and its runtime is not a minimal proxy. This is useful for a fail-closed runtime pin; source compilation parity and the absence of every possible custom delegation mechanism were not established.

## Reproducible release manifest

`dist/contract-manifest.json` contains addresses, hashes, clone targets, pinned facet selector sets, function classifications and explicit unknowns. `node scripts/verify-contract-manifest.mjs --output=outputs/contract-manifest-release-check.json` compares a fresh pinned block without transactions or baseline mutation. Exit 0 means runtime/selector match, 1 means detected change, 2 means incomplete verification. It is change detection, not proof of safe economic settings or arbitrary function semantics. The public RPC pruned the earlier block before a later runtime read; selector snapshot and runtime snapshot are therefore explicitly recorded separately.

Secondary signature research gives [setInventoryAddress(address)](https://www.4byte.directory/api/v1/signatures/?hex_signature=0xc22cbb5d) and [mintByTier(uint256,uint256,uint256,bytes32[])](https://www.4byte.directory/api/v1/signatures/?hex_signature=0x5ea2c91b) for the two FEED self-routed selectors. Selector hashes can collide; these are clues, not authority or behavior verification. Both remain unresolved in the release manifest.

## Recommended acceptance gate

- Generate the selector-to-UI allowlist from these pinned artifacts and rerun at every release; compare chain ID, target, runtime hash, proxy target, facet selector address and code hash.
- For every enabled write, require authority checks, exact destination/value review, static simulation, gas estimate, account/network recheck, receipt success and fresh post-state readback.
- Fork-test each enabled administrative path with current state and unauthorized callers. Existing mocks or passing generic tests alone cannot prove on-chain semantics.
- Show a read-only Advanced contract coverage page linking exclusions and explorer sources. Do not expose arbitrary ABI-call widgets.
- Restrict LP recovery to the historical calldata and the current-state assumptions independently validated by the fork; all other LP functions remain unsupported pending source/ABI recovery. Resolve the two FEED self-routed selectors before claiming full contract coverage.

## Sources and limits

Primary source links: [staking implementation](https://explorer.cronos.com/address/0x1fc79e01fe724ef4a1f8995f1299b90565a6ad39), [FEED](https://explorer.cronos.com/address/0xfed7e7612253386ae899ed7effce2a520d9c689e), [CHZ](https://explorer.cronos.com/address/0x6980fa4b4069f7cc5788d761500e6af2c1a69964), [Founder](https://explorer.cronos.com/address/0x86bd74db7e8559f41d13e3f627951b38e8ed7062), [Posterz](https://explorer.cronos.com/address/0x7e24f993ef87b32f28d5c51f6ed3a997506b78c6). Browser search could not open explorer pages; direct HTTPS explorer responses and public RPC supplied the live evidence. Existing collection/implementation ABIs were inspected from project artifacts; they were not recompiled against deployment bytecode in this subtask. Cached facet ABIs were matched only to selectors installed in the current loupe snapshot. A function's presence does not establish its caller authority or safe configuration.

The tables below classify full signatures. Read/helper used is source-reference evidence, not a claim that every value has a visible control. Privileged actions marked not enabled are intentional exclusions pending separate review, not recommendations to turn on all controls.

## Staking (76 functions/selectors)

| Function | Coverage |
|---|---|
| `claim(uint256)` | Alternate overload deliberately unused |
| `claim(uint256[])` | Alternate overload deliberately unused |
| `claim(uint256,address)` | Alternate overload deliberately unused |
| `claim(uint256[],address,address)` | Implemented action / reviewed admin control |
| `claimLockedUntil()` | Read/helper used in site modules (not necessarily displayed) |
| `emissionAmountUntil(uint64)` | Additional getter; no dedicated UI |
| `emissionEnd()` | Read/helper used in site modules (not necessarily displayed) |
| `emissionRate()` | Read/helper used in site modules (not necessarily displayed) |
| `emissionStart()` | Read/helper used in site modules (not necessarily displayed) |
| `emissionTimeUnit()` | Read/helper used in site modules (not necessarily displayed) |
| `entitlements(uint256,address)` | Read/helper used in site modules (not necessarily displayed) |
| `hasERC721CustodialStakingExtension()` | Additional getter; no dedicated UI |
| `hasERC721EmissionReleaseExtension()` | Additional getter; no dedicated UI |
| `hasERC721EqualSplitExtension()` | Additional getter; no dedicated UI |
| `hasERC721LockableClaimExtension()` | Additional getter; no dedicated UI |
| `hasERC721StakingExtension()` | Additional getter; no dedicated UI |
| `initialize((address,uint64,uint64,uint64,uint256,uint64,uint64,uint64,uint256,uint64),address)` | Infrastructure/facet/deployment entry; not a user control |
| `lastStakingTime(uint256)` | Additional getter; no dedicated UI |
| `lockUntil(uint64)` | Not enabled; separate privileged/destructive operation review required |
| `lockWithdrawMode()` | Not enabled; separate privileged/destructive operation review required |
| `lockWithdrawRecipient()` | Not enabled; separate privileged/destructive operation review required |
| `lockedUntilTimestamp()` | Read/helper used in site modules (not necessarily displayed) |
| `maxStakingTotalDurations()` | Read/helper used in site modules (not necessarily displayed) |
| `minStakingDuration()` | Read/helper used in site modules (not necessarily displayed) |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `onERC721Received(address,address,uint256,bytes)` | Infrastructure/facet/deployment entry; not a user control |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `rateByToken(uint256[])` | Additional getter; no dedicated UI |
| `releasedAmountUntil(uint64)` | Additional getter; no dedicated UI |
| `renounceOwnership()` | Not enabled; separate privileged/destructive operation review required |
| `revokeWithdrawPower()` | Not enabled; separate privileged/destructive operation review required |
| `rewardAmountByToken(uint256[])` | Additional getter; no dedicated UI |
| `rewardAmountByToken(uint256)` | Additional getter; no dedicated UI |
| `savedStakedDurations(uint256)` | Additional getter; no dedicated UI |
| `setClaimLockedUntil(uint64)` | Implemented action / reviewed admin control |
| `setEmissionEnd(uint64)` | Implemented action / reviewed admin control |
| `setEmissionRate(uint256)` | Implemented action / reviewed admin control |
| `setEmissionStart(uint64)` | Implemented action / reviewed admin control |
| `setEmissionTimeUnit(uint64)` | Not enabled; separate privileged/destructive operation review required |
| `setMaxStakingTotalDurations(uint64)` | Implemented action / reviewed admin control |
| `setMinStakingDuration(uint64)` | Implemented action / reviewed admin control |
| `setTotalTickets(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawMode(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawRecipient(address)` | Not enabled; separate privileged/destructive operation review required |
| `stake(uint256[])` | Implemented action / reviewed admin control |
| `stake(uint256)` | Alternate overload deliberately unused |
| `stakers(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `streamClaimableAmount(uint256[],address)` | Read/helper used in site modules (not necessarily displayed) |
| `streamClaimableAmount(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `streamClaimableAmount(uint256,address)` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed(uint256[],address)` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed()` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed(uint256[])` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed(uint256,address)` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed(address)` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalClaimed(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `streamTotalSupply()` | Additional getter; no dedicated UI |
| `streamTotalSupply(address)` | Additional getter; no dedicated UI |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `ticketToken()` | Read/helper used in site modules (not necessarily displayed) |
| `tokensInCustody(address,uint256,uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalStakedDuration(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalStakedDuration(uint256[])` | Read/helper used in site modules (not necessarily displayed) |
| `totalTickets()` | Read/helper used in site modules (not necessarily displayed) |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `unlockingTime(uint256[])` | Read/helper used in site modules (not necessarily displayed) |
| `unlockingTime(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `unstake(uint256)` | Alternate overload deliberately unused |
| `unstake(uint256[])` | Implemented action / reviewed admin control |
| `version()` | Additional getter; no dedicated UI |
| `withdraw(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `withdrawMode()` | Additional getter; no dedicated UI |
| `withdrawModeLocked()` | Additional getter; no dedicated UI |
| `withdrawPowerRevoked()` | Additional getter; no dedicated UI |
| `withdrawRecipient()` | Additional getter; no dedicated UI |
| `withdrawRecipientLocked()` | Additional getter; no dedicated UI |

## Founder (52 functions/selectors)

| Function | Coverage |
|---|---|
| `_tokenIdCounter()` | Additional getter; no dedicated UI |
| `addWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `airdropMint(address,uint256)` | Implemented action / reviewed admin control |
| `approve(address,uint256)` | Implemented action / reviewed admin control |
| `availableTokenCount()` | Additional getter; no dedicated UI |
| `balanceOf(address)` | Read/helper used in site modules (not necessarily displayed) |
| `baseExtension()` | Additional getter; no dedicated UI |
| `baseURI()` | Additional getter; no dedicated UI |
| `getApproved(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `isApprovedForAll(address,address)` | Read/helper used in site modules (not necessarily displayed) |
| `isDiscount(address)` | Additional getter; no dedicated UI |
| `isWhiteList(address)` | Additional getter; no dedicated UI |
| `maxAvailableSupply()` | Additional getter; no dedicated UI |
| `maxSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `memberPrice()` | Additional getter; no dedicated UI |
| `memberships()` | Additional getter; no dedicated UI |
| `memberships1()` | Additional getter; no dedicated UI |
| `mint(uint256)` | Implemented action / reviewed admin control |
| `mintCost(address)` | Read/helper used in site modules (not necessarily displayed) |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `normalPrice()` | Additional getter; no dedicated UI |
| `notRevealedUri()` | Additional getter; no dedicated UI |
| `numReserved()` | Additional getter; no dedicated UI |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `ownerOf(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `pause(bool)` | Implemented action / reviewed admin control |
| `paused()` | Read/helper used in site modules (not necessarily displayed) |
| `removeWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `renounceOwnership()` | Not enabled; separate privileged/destructive operation review required |
| `reveal()` | Not enabled; separate privileged/destructive operation review required |
| `revealed()` | Additional getter; no dedicated UI |
| `safeTransferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `safeTransferFrom(address,address,uint256,bytes)` | Wallet/marketplace operation; no site control |
| `setApprovalForAll(address,bool)` | Wallet/marketplace operation; no site control |
| `setBaseExtension(string)` | Not enabled; separate privileged/destructive operation review required |
| `setBaseURI(string)` | Implemented action / reviewed admin control |
| `setNotRevealedURI(string)` | Not enabled; separate privileged/destructive operation review required |
| `setmemberPrice(uint256)` | Implemented action / reviewed admin control |
| `setnormalPrice(uint256)` | Implemented action / reviewed admin control |
| `setwhitelistPrice(uint256)` | Implemented action / reviewed admin control |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `symbol()` | Read/helper used in site modules (not necessarily displayed) |
| `tokenByIndex(uint256)` | Additional getter; no dedicated UI |
| `tokenCount()` | Additional getter; no dedicated UI |
| `tokenOfOwnerByIndex(address,uint256)` | Additional getter; no dedicated UI |
| `tokenURI(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `transferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `walletOfOwner(address)` | Read/helper used in site modules (not necessarily displayed) |
| `whitelistPrice()` | Additional getter; no dedicated UI |
| `withdraw()` | Not enabled; separate privileged/destructive operation review required |

## Posterz (52 functions/selectors)

| Function | Coverage |
|---|---|
| `_tokenIdCounter()` | Additional getter; no dedicated UI |
| `addWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `airdropMint(address,uint256)` | Implemented action / reviewed admin control |
| `approve(address,uint256)` | Implemented action / reviewed admin control |
| `availableTokenCount()` | Additional getter; no dedicated UI |
| `balanceOf(address)` | Read/helper used in site modules (not necessarily displayed) |
| `baseExtension()` | Additional getter; no dedicated UI |
| `baseURI()` | Additional getter; no dedicated UI |
| `getApproved(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `isApprovedForAll(address,address)` | Read/helper used in site modules (not necessarily displayed) |
| `isDiscount(address)` | Additional getter; no dedicated UI |
| `isWhiteList(address)` | Additional getter; no dedicated UI |
| `maxAvailableSupply()` | Additional getter; no dedicated UI |
| `maxSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `memberPrice()` | Additional getter; no dedicated UI |
| `memberships()` | Additional getter; no dedicated UI |
| `memberships1()` | Additional getter; no dedicated UI |
| `mint(uint256)` | Excluded: sold out; secondary-market link |
| `mintCost(address)` | Read/helper used in site modules (not necessarily displayed) |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `normalPrice()` | Additional getter; no dedicated UI |
| `notRevealedUri()` | Additional getter; no dedicated UI |
| `numReserved()` | Additional getter; no dedicated UI |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `ownerOf(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `pause(bool)` | Implemented action / reviewed admin control |
| `paused()` | Read/helper used in site modules (not necessarily displayed) |
| `removeWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `renounceOwnership()` | Not enabled; separate privileged/destructive operation review required |
| `reveal()` | Not enabled; separate privileged/destructive operation review required |
| `revealed()` | Additional getter; no dedicated UI |
| `safeTransferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `safeTransferFrom(address,address,uint256,bytes)` | Wallet/marketplace operation; no site control |
| `setApprovalForAll(address,bool)` | Wallet/marketplace operation; no site control |
| `setBaseExtension(string)` | Not enabled; separate privileged/destructive operation review required |
| `setBaseURI(string)` | Implemented action / reviewed admin control |
| `setNotRevealedURI(string)` | Not enabled; separate privileged/destructive operation review required |
| `setmemberPrice(uint256)` | Implemented action / reviewed admin control |
| `setnormalPrice(uint256)` | Implemented action / reviewed admin control |
| `setwhitelistPrice(uint256)` | Implemented action / reviewed admin control |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `symbol()` | Read/helper used in site modules (not necessarily displayed) |
| `tokenByIndex(uint256)` | Additional getter; no dedicated UI |
| `tokenCount()` | Additional getter; no dedicated UI |
| `tokenOfOwnerByIndex(address,uint256)` | Additional getter; no dedicated UI |
| `tokenURI(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `transferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `walletOfOwner(address)` | Read/helper used in site modules (not necessarily displayed) |
| `whitelistPrice()` | Additional getter; no dedicated UI |
| `withdraw()` | Not enabled; separate privileged/destructive operation review required |

## Legacy collections (52 functions/selectors)

| Function | Coverage |
|---|---|
| `_tokenIdCounter()` | Additional getter; no dedicated UI |
| `addWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `airdropMint(address[],uint256[])` | Implemented action / reviewed admin control |
| `approve(address,uint256)` | Implemented action / reviewed admin control |
| `availableTokenCount()` | Additional getter; no dedicated UI |
| `balanceOf(address)` | Read/helper used in site modules (not necessarily displayed) |
| `baseExtension()` | Additional getter; no dedicated UI |
| `baseURI()` | Additional getter; no dedicated UI |
| `getApproved(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `isApprovedForAll(address,address)` | Read/helper used in site modules (not necessarily displayed) |
| `isDiscount(address)` | Additional getter; no dedicated UI |
| `isWhiteList(address)` | Additional getter; no dedicated UI |
| `maxAvailableSupply()` | Additional getter; no dedicated UI |
| `maxSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `memberPrice()` | Additional getter; no dedicated UI |
| `memberships()` | Additional getter; no dedicated UI |
| `memberships1()` | Additional getter; no dedicated UI |
| `mint(uint256)` | Excluded from mint page |
| `mintCost(address)` | Read/helper used in site modules (not necessarily displayed) |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `normalPrice()` | Additional getter; no dedicated UI |
| `notRevealedUri()` | Additional getter; no dedicated UI |
| `numReserved()` | Additional getter; no dedicated UI |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `ownerOf(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `pause(bool)` | Implemented action / reviewed admin control |
| `paused()` | Read/helper used in site modules (not necessarily displayed) |
| `removeWhiteList(address[])` | Not enabled; separate privileged/destructive operation review required |
| `renounceOwnership()` | Not enabled; separate privileged/destructive operation review required |
| `reveal()` | Not enabled; separate privileged/destructive operation review required |
| `revealed()` | Additional getter; no dedicated UI |
| `safeTransferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `safeTransferFrom(address,address,uint256,bytes)` | Wallet/marketplace operation; no site control |
| `setApprovalForAll(address,bool)` | Wallet/marketplace operation; no site control |
| `setBaseExtension(string)` | Not enabled; separate privileged/destructive operation review required |
| `setBaseURI(string)` | Implemented action / reviewed admin control |
| `setNotRevealedURI(string)` | Not enabled; separate privileged/destructive operation review required |
| `setmemberPrice(uint256)` | Implemented action / reviewed admin control |
| `setnormalPrice(uint256)` | Implemented action / reviewed admin control |
| `setwhitelistPrice(uint256)` | Implemented action / reviewed admin control |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `symbol()` | Read/helper used in site modules (not necessarily displayed) |
| `tokenByIndex(uint256)` | Additional getter; no dedicated UI |
| `tokenCount()` | Additional getter; no dedicated UI |
| `tokenOfOwnerByIndex(address,uint256)` | Additional getter; no dedicated UI |
| `tokenURI(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `transferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `walletOfOwner(address)` | Read/helper used in site modules (not necessarily displayed) |
| `whitelistPrice()` | Additional getter; no dedicated UI |
| `withdraw()` | Not enabled; separate privileged/destructive operation review required |

## CHZ (125 functions/selectors)

| Function | Coverage |
|---|---|
| `licenseVersionLocked()` | Additional getter; no dedicated UI |
| `lockLicenseVersion()` | Not enabled; separate privileged/destructive operation review required |
| `setLicenseVersion(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `facets()` | Additional getter; no dedicated UI |
| `facetFunctionSelectors(address)` | Additional getter; no dedicated UI |
| `facetAddresses()` | Additional getter; no dedicated UI |
| `facetAddress(bytes4)` | Read/helper used in site modules (not necessarily displayed) |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `setERC165(bytes4[],bytes4[])` | Not enabled; separate privileged/destructive operation review required |
| `grantAdminRole(address)` | Not enabled; separate privileged/destructive operation review required |
| `getRoleAdmin(bytes32)` | Additional getter; no dedicated UI |
| `grantRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `hasRole(bytes32,address)` | Additional getter; no dedicated UI |
| `renounceRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `revokeRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `approve(address,uint256)` | Implemented action / reviewed admin control |
| `balanceOf(address)` | Read/helper used in site modules (not necessarily displayed) |
| `burn(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `burnBatch(uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `burnBatchByFacet(uint256[])` | Infrastructure/facet/deployment entry; not a user control |
| `burnByFacet(uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `getApproved(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `isApprovedForAll(address,address)` | Read/helper used in site modules (not necessarily displayed) |
| `lockByFacet(uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `lockByFacet(uint256[])` | Infrastructure/facet/deployment entry; not a user control |
| `locked(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `locked(uint256[])` | Read/helper used in site modules (not necessarily displayed) |
| `maxSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `mintByFacet(address,uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `mintByFacet(address[],uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `mintByFacet(address[],uint256[])` | Infrastructure/facet/deployment entry; not a user control |
| `ownerOf(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `safeTransferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `safeTransferFrom(address,address,uint256,bytes)` | Wallet/marketplace operation; no site control |
| `setApprovalForAll(address,bool)` | Wallet/marketplace operation; no site control |
| `totalSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `transferFrom(address,address,uint256)` | Wallet/marketplace operation; no site control |
| `unlockByFacet(uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `unlockByFacet(uint256[])` | Infrastructure/facet/deployment entry; not a user control |
| `setBurnablePausedUntil(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `freezeMaxSupply()` | Not enabled; separate privileged/destructive operation review required |
| `maxSupplyFrozen()` | Additional getter; no dedicated UI |
| `setMaxSupply(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByOwner(address,uint256)` | Implemented action / reviewed admin control |
| `mintByOwner(address,uint256,string[])` | Not enabled; separate privileged/destructive operation review required |
| `mintByOwner(address[],string[])` | Not enabled; separate privileged/destructive operation review required |
| `mintByOwner(address[],uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByOwner(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `MINTER_ROLE()` | Additional getter; no dedicated UI |
| `mintByRole(address,uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByRole(address,uint256,string[])` | Not enabled; separate privileged/destructive operation review required |
| `mintByRole(address[],string[])` | Not enabled; separate privileged/destructive operation review required |
| `mintByRole(address[],uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByRole(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `isTrustedForwarder(address)` | Additional getter; no dedicated UI |
| `trustedForwarder()` | Additional getter; no dedicated UI |
| `setTrustedForwarder(address)` | Not enabled; separate privileged/destructive operation review required |
| `nameAndSymbolLocked()` | Additional getter; no dedicated UI |
| `lockNameAndSymbol()` | Not enabled; separate privileged/destructive operation review required |
| `setName(string)` | Not enabled; separate privileged/destructive operation review required |
| `setSymbol(string)` | Not enabled; separate privileged/destructive operation review required |
| `baseURI()` | Additional getter; no dedicated UI |
| `baseURILocked()` | Additional getter; no dedicated UI |
| `fallbackURI()` | Additional getter; no dedicated UI |
| `fallbackURILocked()` | Additional getter; no dedicated UI |
| `lastUnlockedTokenId()` | Additional getter; no dedicated UI |
| `uriSuffix()` | Additional getter; no dedicated UI |
| `uriSuffixLocked()` | Additional getter; no dedicated UI |
| `lockBaseURI()` | Not enabled; separate privileged/destructive operation review required |
| `lockFallbackURI()` | Not enabled; separate privileged/destructive operation review required |
| `lockURISuffix()` | Not enabled; separate privileged/destructive operation review required |
| `lockURIUntil(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `setBaseURI(string)` | Not enabled for CHZ; requires separate facet review |
| `setFallbackURI(string)` | Not enabled; separate privileged/destructive operation review required |
| `setURI(uint256,string)` | Not enabled; separate privileged/destructive operation review required |
| `setURIBatch(uint256[],string[])` | Not enabled; separate privileged/destructive operation review required |
| `setURISuffix(string)` | Not enabled; separate privileged/destructive operation review required |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `symbol()` | Read/helper used in site modules (not necessarily displayed) |
| `tokenURI(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `configureTiering(uint256,(uint256,uint256,address,uint256,uint256,bytes32,uint256,uint256))` | Not enabled; separate privileged/destructive operation review required |
| `configureTiering(uint256[],(uint256,uint256,address,uint256,uint256,bytes32,uint256,uint256)[])` | Owner reviewed public price/date update; other fields preserved |
| `DEFAULT_ADMIN_ROLE()` | Additional getter; no dedicated UI |
| `MERCHANT_ROLE()` | Additional getter; no dedicated UI |
| `eligibleForTier(uint256,address,uint256,bytes32[])` | Wallet eligibility gate for reviewed public mints |
| `mintByTier(uint256,uint256,uint256,bytes32[])` | Reviewed public tiers 2 and 4; simulated and tested on an isolated fork |
| `mintByTierByRole(address,uint256,uint256,uint256,bytes32[])` | Not enabled; separate privileged/destructive operation review required |
| `onTierAllowlist(uint256,address,uint256,bytes32[])` | Additional getter; no dedicated UI |
| `remainingForTier(uint256)` | Remaining tier allocation checked before payments |
| `reservedMints()` | Additional getter; no dedicated UI |
| `tierMints(uint256)` | Additional getter; no dedicated UI |
| `tiers(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalReserved()` | Additional getter; no dedicated UI |
| `walletMintedByTier(uint256,address)` | Additional getter; no dedicated UI |
| `withdraw(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `withdrawMode()` | Additional getter; no dedicated UI |
| `withdrawModeLocked()` | Additional getter; no dedicated UI |
| `withdrawPowerRevoked()` | Additional getter; no dedicated UI |
| `withdrawRecipient()` | Additional getter; no dedicated UI |
| `withdrawRecipientLocked()` | Additional getter; no dedicated UI |
| `lockWithdrawMode()` | Not enabled; separate privileged/destructive operation review required |
| `lockWithdrawRecipient()` | Not enabled; separate privileged/destructive operation review required |
| `revokeWithdrawPower()` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawMode(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawRecipient(address)` | Not enabled; separate privileged/destructive operation review required |
| `defaultRoyalty()` | Additional getter; no dedicated UI |
| `getFeeBps(uint256)` | Additional getter; no dedicated UI |
| `getFeeRecipients(uint256)` | Additional getter; no dedicated UI |
| `getFees(uint256)` | Additional getter; no dedicated UI |
| `getRaribleV2Royalties(uint256)` | Additional getter; no dedicated UI |
| `getTokenRoyaltiesCount()` | Additional getter; no dedicated UI |
| `getTokenRoyaltyByIndex(uint256)` | Additional getter; no dedicated UI |
| `royaltyInfo(uint256,uint256)` | Additional getter; no dedicated UI |
| `setDefaultRoyalty((address,uint16))` | Not enabled; separate privileged/destructive operation review required |
| `setTokenRoyalties((uint256,address,uint16)[])` | Not enabled; separate privileged/destructive operation review required |
| `hasRoyaltyEnforcement()` | Additional getter; no dedicated UI |
| `registerRoyaltyEnforcement(address,bool)` | Not enabled; separate privileged/destructive operation review required |
| `toggleRoyaltyEnforcement(bool)` | Not enabled; separate privileged/destructive operation review required |
| `customLicenseName()` | Additional getter; no dedicated UI |
| `customLicenseURI()` | Additional getter; no dedicated UI |
| `getLicenseName()` | Additional getter; no dedicated UI |
| `getLicenseURI()` | Additional getter; no dedicated UI |
| `licenseVersion()` | Additional getter; no dedicated UI |

## FEED (80 functions/selectors)

| Function | Coverage |
|---|---|
| `diamondCut((address,uint8,bytes4[])[],address,bytes)` | Not enabled; separate privileged/destructive operation review required |
| `facets()` | Additional getter; no dedicated UI |
| `facetFunctionSelectors(address)` | Additional getter; no dedicated UI |
| `facetAddresses()` | Additional getter; no dedicated UI |
| `facetAddress(bytes4)` | Read/helper used in site modules (not necessarily displayed) |
| `supportsInterface(bytes4)` | Additional getter; no dedicated UI |
| `owner()` | Read/helper used in site modules (not necessarily displayed) |
| `transferOwnership(address)` | Not enabled; separate privileged/destructive operation review required |
| `setERC165(bytes4[],bytes4[])` | Not enabled; separate privileged/destructive operation review required |
| `grantAdminRole(address)` | Not enabled; separate privileged/destructive operation review required |
| `getRoleAdmin(bytes32)` | Additional getter; no dedicated UI |
| `grantRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `hasRole(bytes32,address)` | Additional getter; no dedicated UI |
| `renounceRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `revokeRole(bytes32,address)` | Not enabled; separate privileged/destructive operation review required |
| `allowance(address,address)` | Read/helper used in site modules (not necessarily displayed) |
| `approve(address,uint256)` | Implemented action / reviewed admin control |
| `balanceOf(address)` | Read/helper used in site modules (not necessarily displayed) |
| `maxSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `mintByFacet(address,uint256)` | Infrastructure/facet/deployment entry; not a user control |
| `mintByFacet(address[],uint256[])` | Infrastructure/facet/deployment entry; not a user control |
| `totalSupply()` | Read/helper used in site modules (not necessarily displayed) |
| `transfer(address,uint256)` | Implemented action / reviewed admin control |
| `transferFrom(address,address,uint256)` | Called by shop contract after exact approval |
| `setBurnablePausedUntil(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `freezeMaxSupply()` | Not enabled; separate privileged/destructive operation review required |
| `maxSupplyFrozen()` | Additional getter; no dedicated UI |
| `setMaxSupply(uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByOwner(address,uint256)` | Implemented action / reviewed admin control |
| `mintByOwner(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `MINTER_ROLE()` | Additional getter; no dedicated UI |
| `mintByRole(address,uint256)` | Not enabled; separate privileged/destructive operation review required |
| `mintByRole(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `isTrustedForwarder(address)` | Additional getter; no dedicated UI |
| `trustedForwarder()` | Additional getter; no dedicated UI |
| `setTrustedForwarder(address)` | Not enabled; separate privileged/destructive operation review required |
| `lockNameAndSymbol()` | Not enabled; separate privileged/destructive operation review required |
| `setName(string)` | Not enabled; separate privileged/destructive operation review required |
| `setSymbol(string)` | Not enabled; separate privileged/destructive operation review required |
| `decimals()` | Read/helper used in site modules (not necessarily displayed) |
| `decimalsLocked()` | Additional getter; no dedicated UI |
| `lockDecimals()` | Not enabled; separate privileged/destructive operation review required |
| `setDecimals(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `configureTiering(uint256,(uint256,uint256,address,uint256,uint256,bytes32,uint256,uint256))` | Not enabled; separate privileged/destructive operation review required |
| `configureTiering(uint256[],(uint256,uint256,address,uint256,uint256,bytes32,uint256,uint256)[])` | Not enabled; separate privileged/destructive operation review required |
| `DEFAULT_ADMIN_ROLE()` | Additional getter; no dedicated UI |
| `MERCHANT_ROLE()` | Additional getter; no dedicated UI |
| `eligibleForTier(uint256,address,uint256,bytes32[])` | Additional getter; no dedicated UI |
| `walletMintedByTier(uint256,address)` | Additional getter; no dedicated UI |
| `mintByTierByRole(address,uint256,uint256,uint256,bytes32[])` | Not enabled; separate privileged/destructive operation review required |
| `onTierAllowlist(uint256,address,uint256,bytes32[])` | Additional getter; no dedicated UI |
| `remainingForTier(uint256)` | Additional getter; no dedicated UI |
| `reservedMints()` | Additional getter; no dedicated UI |
| `tierMints(uint256)` | Additional getter; no dedicated UI |
| `tiers(uint256)` | Read/helper used in site modules (not necessarily displayed) |
| `totalReserved()` | Additional getter; no dedicated UI |
| `withdraw(address[],uint256[])` | Not enabled; separate privileged/destructive operation review required |
| `withdrawMode()` | Additional getter; no dedicated UI |
| `withdrawModeLocked()` | Additional getter; no dedicated UI |
| `withdrawPowerRevoked()` | Additional getter; no dedicated UI |
| `withdrawRecipient()` | Additional getter; no dedicated UI |
| `withdrawRecipientLocked()` | Additional getter; no dedicated UI |
| `lockWithdrawMode()` | Not enabled; separate privileged/destructive operation review required |
| `lockWithdrawRecipient()` | Not enabled; separate privileged/destructive operation review required |
| `revokeWithdrawPower()` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawMode(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `setWithdrawRecipient(address)` | Not enabled; separate privileged/destructive operation review required |
| `customLicenseName()` | Additional getter; no dedicated UI |
| `customLicenseURI()` | Additional getter; no dedicated UI |
| `getLicenseName()` | Additional getter; no dedicated UI |
| `getLicenseURI()` | Additional getter; no dedicated UI |
| `licenseVersion()` | Additional getter; no dedicated UI |
| `licenseVersionLocked()` | Additional getter; no dedicated UI |
| `lockLicenseVersion()` | Not enabled; separate privileged/destructive operation review required |
| `setLicenseVersion(uint8)` | Not enabled; separate privileged/destructive operation review required |
| `0xc22cbb5d` | Unresolved — no action enabled |
| `0x5ea2c91b` | Unresolved — no action enabled |
| `name()` | Read/helper used in site modules (not necessarily displayed) |
| `nameAndSymbolLocked()` | Additional getter; no dedicated UI |
| `symbol()` | Read/helper used in site modules (not necessarily displayed) |

## Shop (8 functions/selectors)

| Function | Coverage |
|---|---|
| `FEED()` | Additional getter; no dedicated UI |
| `OWNER()` | Additional getter; no dedicated UI |
| `TREASURY()` | Additional getter; no dedicated UI |
| `ownedMask(address)` | Read/helper used in site modules (not necessarily displayed) |
| `paused()` | Read/helper used in site modules (not necessarily displayed) |
| `price(uint8)` | Read/helper used in site modules (not necessarily displayed) |
| `purchase(uint8,uint256,uint256)` | Implemented action / reviewed admin control |
| `setPaused(bool)` | Implemented action / reviewed admin control |

## Additional fork verification

Disposable Anvil forks exercised all six enabled pool setters on CHZ and Founder in the initial run; that combined run then encountered upstream state fetch failures and is marked incomplete. Fresh short forks passed all six setters on Posterz (block 94,012,566) and Founder (block 94,012,652), checking owner writes, encoded unauthorized reverts, and getter readback. The fresh Founder fork also approved/staked/unstaked Founder #745, checked both custody transitions, rejected unauthorized stake/unstake, and claimed 1,400 historical FEED with exact balance delta and unauthorized-claim rejection. No mainnet transactions were sent. These are sample-operation tests, not approval to change arbitrary reward settings.

The blocker for the specific legacy booster recovery changed after additional evidence: block 94,013,089 fork tests returned all three wallet boosters with exact historical calldata and proved the 1 CRO minimum fee boundary. Fee stays in the pool, and overpayment is not refunded. The broader legacy LP source/ABI remains unverified.

## Public mint validation update · 15 September 2026

An isolated Cronos fork at block 94,038,188 exercised the current site functions: reopen both tiers for 30 days, then mint one NFT for 99 CRO and one for 29,000 FEED. Both ownerOf results, exact payment deltas and allowance consumption to zero passed. Limits, currency, root, reservations and allocations were preserved. Supply moved from 1271 to 1273 on the fork only. No mainnet transactions were sent; the live sale remained closed at the audit.