These contracts hold real value on Algorand MainNet. Security reports are taken seriously and disclosure is appreciated.

Please do not open a public issue for an exploitable vulnerability. Instead, email testedprofit@gmail.com with:

• the contract and App ID affected,
• a description of the issue and its impact,
• a proof-of-concept or reproduction steps if possible.

You'll get an acknowledgement, and a fix or mitigation plan once the report is confirmed. Non-sensitive issues (typos, doc errors, gas/opcode-budget suggestions) are fine to open as normal GitHub issues.

• Bounded admin. No contract grants the admin authority over user principal or the prize pool. AlgoPool v2 locks all draw rules once any entry exists.
• Trustless randomness. Winner selection uses the Algorand block VRF seed (Block.blk_seed), committed before entries close.
• Transaction hygiene. close_remainder_to / asset_close_to / rekey_to are pinned to zero on all user deposits; inner-transaction fees are set to zero and fee-pooled by the outer transaction.
• Non-upgradeable. Deployed contracts are not upgradeable; any change ships as a new App ID and a frontend migration.

In scope: the contracts in this repository (launchpad, algo_pool_v2, profit_lock) and their deployment/operational scripts. Out of scope: third-party dependencies (Algorand node APIs, Tinyman, Vestige, Pera Wallet) and the frontend.