Scorecard
We Ran Our Own Checklist on the Project We Advocate
Published
The Verifier’s Checklist is ten questions anyone can run on any blockchain project. POTS is the first project we scored — and we advocate for POTS, which is exactly why it had to go first. A standard that cannot produce an uncomfortable finding about the project we promote is not a standard. Here is the full run: what verified cleanly, what did not, and what POTS said when we told them first.
Where we stand, so you can weigh what follows
TOBB WORLD publishes independent education about the POTS ecosystem. We are advocates. Our site carries a referral link to the POTS DApp. We are not on the POTS team, we hold no role in the project, and POTS has never paid us. We also participate in the protocol ourselves: we hold a position in it, which means we have a financial interest in POTS doing well. That is one more reason the criteria were published before the conclusions. When our findings qualified for POTS’s published $1,000,000 bug bounty, we declined it in writing, in advance — an evaluation of POTS is worth nothing to readers if POTS pays for it.
Everything below is a measurement you can repeat. Each finding carries its check. Where we could not verify something, we say so with the same prominence — that list is near the end, and it is not empty.
How this was done, and when POTS knew
- The checklist itself is published at tobb.world/check — ten questions, Q0–Q9, each with steps, what a bad answer looks like, and roughly how long it takes.
- We scored POTS against its official surfaces:
docs.pots.money, the published ScaleBit audit report, the CertiK Skynet page, the DApp, and the chain itself — never against screenshots or third-party pages. - We sent every finding to POTS privately on 15 September 2026, to the responsible-disclosure address listed in their own security documentation, proposing publication on 6 October. The only reply came from customer service; the exchange is recorded below.
- On-chain values were read on three independent public BSC nodes (Binance, defibit, ninicoin) with positive and negative controls, so a zero in this piece is a measurement, not a failed call. Last full re-verification: 6 October 2026, BSC blocks 126,066,208–126,066,215.
First, what verified cleanly — because most of it did
Most projects fail these checks. POTS passes them, and several passes are unusually strong.
The audit is real, published, and unusually well-scoped (Q1, Q2, Q3). The ScaleBit report linked from POTS’s security docs is a full 21-page report, not a badge: it names the auditors, dates the work (16–23 March 2026), links the source repository and two commit hashes, and lists the SHA-1 hash of every file reviewed. The issue table is published too: 7 issues, 0 critical, 2 medium, 4 minor, 6 fixed — and one finding left Partially Fixed, which matters later. Publishing at that resolution puts POTS ahead of most of the field on its own.
The 25-of-50 treasury multisig is real — and demonstrably used (Q4, Q8). getThreshold() returns 25 and getOwners() returns 50 on the published Safe. Better: when POTS announced a liquidity addition and LP burn on 10 September with four transaction hashes, we followed the money end to end. Every hash verified. The 1,230,549 USDT leg left the Safe itself — the multisig doesn’t just exist, it moves real money. The announced amounts reconciled to within 8,094 USDT, and that residual isn’t missing either: it sits in the executor address. (Q8 exists because publishing hashes is not the same as the hashes agreeing. Here they agree.)
The IBS token is genuinely renounced (Q6). owner() returns the zero address.
The LP burn is exactly as described. Across the two burn addresses, 99.9999% of IBS/USDT LP supply is unrecoverable. The documentation’s claim that the base reserve cannot be moved is supported by the chain.
The full contract list is published at docs.pots.money/resources/contract-address — good practice, and the thing that made the deeper checks below possible. It is also what the deeper checks turn against.
That is a stronger evidence base than most projects can show. Now the rest.
What the checklist caught
Six core contracts are upgradeable, and the upgrade keys are single wallets
Six of the published core contracts — bonding, automated bond interaction, staking, reward minting, the emission mechanism, and the stability module — are EIP-1967 upgradeable proxies: both the implementation slot and the admin slot are non-zero. Following each proxy’s admin to its owner:
- one externally owned account — a single private key — owns the ProxyAdmin behind five of the six;
- a second single key owns the sixth;
- neither is the published 25-of-50 Safe. Separately, the POTS token itself has a live
owner(), also a single key.
Anyone can reproduce this in about two minutes: read the two EIP-1967 storage slots on any proxy, call owner() on the admin, then eth_getCode on that owner — zero bytes of code means a private key, not a contract. We ran it on three independent nodes with a positive control.
We want to be fair about what this means. Upgradeable proxies are normal and frequently the responsible choice — they are how a team ships a fix before users are harmed. Our finding is not that POTS is upgradeable. It is that the documentation describes something stronger:
“No single point of failure. Distributed architecture ensures that no single actor can compromise the protocol.”
— docs.pots.money/pots-core/security
“POTS is not governed by a team. It is governed by its community — through a transparent, on-chain process that ensures no single actor can unilaterally direct the protocol’s future.”
— docs.pots.money/building-pots/governance
“Passed proposals enter a 48-hour timelock before execution.”
— docs.pots.money/building-pots/governance
For these six contracts, none of that currently holds: their logic can be replaced by one key, with no timelock and no multisig. POTS’s own auditor raised the same concern one layer up — TSY-7, Centralization, status Partially Fixed — and the team’s written response there is the honest version of the position: multisig and timelock “will be introduced once the protocol reaches stability.” A stated trajectory. Our objection is not that an early protocol is centralized — early protocols are. It is that the documentation describes the destination in the present tense.
What would fix it: move the two ProxyAdmin owners — and the POTS token owner — to the 25-of-50 Safe, or behind the 48-hour timelock the governance page describes. That is a real key-management change, not a page edit, and if POTS does it we will report it prominently: a project that moved its upgrade keys to a multisig after an outside review is a better story than one that never had the problem.
“All audit reports are publicly available” is not yet true
The security page says: “POTS has been audited by leading blockchain security firms. All audit reports are publicly available.” Checked at source, CertiK’s Skynet page for Pots Money shows the CertiK engagement as “audit is in progress · Remediating Findings 99%” — and no CertiK report is published; the one available report is ScaleBit’s.
This actually reflects well on POTS — a CertiK engagement genuinely is underway and nearly complete. The defect is one sentence. “CertiK audit in progress; report not yet published” would be accurate today. Relatedly, the ScaleBit report’s scope is four token files. “POTS has been audited” reads as the whole system; the report covers the token contracts.
Two rows on the official contract list open a different address than they display
On docs.pots.money/resources/contract-address, the Worldpool Treasury PBM row and the RBS Executor row each display one address while their “View” buttons open a different one. The other fourteen rows match. A reader cannot tell which of the two addresses to trust — and this is the page the whole verification culture of the project depends on.
Four addresses published as “contracts” are wallets
All four addresses in those two rows return zero bytes of code: they are externally owned accounts. That matters because the documentation describes the RBS layer as an automated stabilization reserve executing “via smart contract logic — not human discretion.” If RBS execution runs from a wallet, it depends on whoever holds that key. Either relabel the rows or describe the operator model — both are honest.
The governance timelock is stated two ways
The same governance page is headed “Timelock Delay (24 Hours)” and then says “Passed proposals enter a 48-hour timelock before execution.” Small, but on the page that defines how protocol change is governed, worth settling on one number.
The app’s official Discord link is dead
The DApp links a Discord invite that Discord reports as expired; the documentation links a different, working invite. A dead official link is exactly the gap an unofficial server fills — and unofficial servers are where newcomers get hurt.
The Q0 story: the first question exists for a reason
While scoring POTS we found a professional-looking site presenting itself as the POTS security page — polished, detailed, and carrying stronger security claims than POTS’s own documentation makes: “contract logic is immutable,” “no admin keys,” “ownership renounced.” POTS support confirmed to us directly that the site is not theirs. Its sign-up flow redirects into the real POTS app with a referral wallet attached — someone is paid for every user who arrives believing they read an official security page.
We are deliberately not naming the site, its operator, or the referral wallet.
That is why Q0 — is this the project’s actual site? — is the first question on the checklist, and why the answer has to come from the project’s own documentation outward, never from a search result inward. We have reported the site’s details to POTS.
One claim we do not repeat
POTS-adjacent marketing states a dollar floor for the IBS token as an enforced outcome. Our claims register prohibits repeating any promised price, yield, return, or floor outcome — from any source, including a project’s own page. The treasury mechanism is describable and we describe it in our course; the outcome sentence is not ours to restate. So this scorecard records it as: a claim the project makes that we neither verify nor repeat.
What we could not verify
Recorded with the same prominence as the findings, because a checklist that hides its own gaps is a marketing device.
- Whether the audited commits match the deployed bytecode. The ScaleBit report gives commit hashes; we have not compiled and compared. This is the single highest-value check we have not run.
- The burn percentages POTS’s marketing cites for token supply (as opposed to the LP burn, which we did recompute). We have not independently recomputed them.
- Whether CertiK’s report is final. Skynet’s page says both: a summary line reading “Final Report Delivered on 5/2/2026”, and a tracker showing the audit in progress with findings remediation at 99%. No CertiK report is published either way.
- What kind of key holds the upgrade rights — hot wallet, hardware wallet, custody service, or something else. We know only that it is a single key, not a contract.
POTS’s response
We sent these findings to POTS’s responsible-disclosure address — contact@pots.money, the address listed under Responsible Disclosure in their security documentation — on 15 September 2026, with a courtesy note on 25 September and a follow-up on 1 October. The only responses came from customer support on 28 September: first asking whether we were seeking a partnership and whether our account had a problem, and then, when we pointed to the email by date and subject, telling us — their words — that “we don’t use email for this,” and offering instead that we send our concerns as a document attachment in the support chat, or share them with a community leader. We declined both: a support chat is not a confidential channel, and a community structure is not a security team. We asked for a security or engineering contact and gave them ours.
As of 6 October 2026, no technical response has reached us. So this section records two things: our findings drew no substantive reply, and the disclosure channel POTS’s documentation advertises is, according to POTS’s own support, not in use. The offer stands: if POTS’s team responds after publication, we will add their response to this page, unedited, and say so prominently.
Verdict
POTS passes the checks that most projects fail — a published, commit-scoped audit; a real 25-of-50 treasury multisig that demonstrably moves real money; a genuinely renounced IBS token; effectively the entire LP supply provably burned; a full published contract list. On this evidence it sits far above the median of what this checklist finds elsewhere.
It fails Q7 — the documentation does not agree with the chain — and Finding 1 is the serious one. Upgrade rights held by single keys, under documentation promising that no single actor can act unilaterally, is not a wording quibble. It is the gap between what a reader believes they are trusting and what they are actually trusting. Findings 2–6 are documentation fixes. Finding 1 is a key-management decision — and it is also the cheapest strong announcement available to POTS.
We advocate for POTS. That sentence is only worth something if this page exists.
Run the checklist yourself — on POTS, or on any project. You keep your own record; we never see it.
Educational material — not financial advice. Drafted with AI assistance and human-edited. Every factual claim is checked against a sourced claims register before publication. On-chain values last verified 6 October 2026 · BSC block 126,066,208; corrections are published on this page.