Contact

One mailbox, and a person reads it. This page also says plainly what a message can and cannot achieve — because once a transaction is confirmed on a blockchain, a great deal of it is out of everyone’s hands, including ours.

The mailbox

Write to contact@smartpacts.io. It is the only address we publish.

There is no contact form and no chat on this site. That is not an oversight: the site has no backend and collects nothing about you — no analytics, no cookies, no accounts — and a form would need somewhere to send things (see the privacy policy). A mailbox is the whole of it.

Smart Pacts is a small operation. We read every message that arrives. We are not going to quote you a reply time we might not keep, so we will say only the part we can stand behind: nothing goes unread.

Faster than us

Three of these answer most questions before a message would, and they do not depend on us being awake.

• Your own account. Your SPT reads the chain for the account you connect — what you hold on each of the 20 chains, and the votes and award rounds open to you. Your wallet signs; the page never sees a secret key.
• Your tickets, and what became of them. The same page lists every game round in which your account holds tickets and what happened to each one — including, where a round was refunded, whether that refund has reached you yet. You can also look at any account there by pasting it, with no wallet at all. Finished rounds, with the drand beacon that decided each one and the recipe to recompute the winners yourself, are on game results.
• Roulette. The roulette table at play.smartpacts.io is a separate site of ours with its own terms and its own round check, which recomputes any round's number from the public beacon in your browser. Questions about it come to the same mailbox.
• The public record. Every transaction this site builds is signed in your own wallet and lands on a public blockchain, where it stays. Transparency reads the SPT contract live in your own browser — balances, what is locked, what the administrator can and cannot do — and tells you when the network did not answer instead of showing you a zero. The addresses it lists can be looked up in any block explorer.
• The contract decides, not this website. Under its rules, the deployed contract code decides every outcome, and this site holds no key. It builds transactions and reads the chain; it cannot overrule, adjust or re-run anything a contract has already done. The legal notices say the same.

What to write about

• A purchase that looks wrong. You signed and nothing appeared, you were charged and see no ticket, or this site showed you one thing and the chain says another. Include the account you used and the request key of the transaction — your wallet shows it, it is public, and with it we can look up exactly what happened.
• A prize or a refund question. Name the game, the round, and the account that bought the tickets. What we can give you is what the contract recorded and where to see it for yourself.
• Something on this site that is wrong or misleading. A page that gives you the wrong idea about money is a bug, and we would rather hear it from you than not. Tell us which page and what it led you to believe.
• Anything about SPT. The token, the sale, a vote, an award round, or what the contract can and cannot do. We will answer with the function and the published code rather than a summary you have to trust.
• A security problem. There is a private route for this — see below. Please do not put the details in a public issue.

One thing is handled better elsewhere: for the Kadena app for Ledger, the Ledger page links a troubleshooting guide and the app’s own issue tracker, and that is where those reports go.

What we can and cannot do

We cannot:

• Reverse or cancel a payment. Once a transaction is confirmed it is final — for us exactly as much as for you. There is no button on our side, and no contract function that undoes one.
• Recover KDA or tokens sent to the wrong address. Nobody can, including the person who sent them.
• Take back a prize once the draw has paid it. That payment is final, like any other.
• Grant a refund. A game round is refundable only in the one case the contract itself defines — nobody drew it within 90 days after its drand beacon was due — and in that case the ticket price comes back with an equal part of any bonus. The contract has no second case; the only way around its rules is the admin override stated below.
• See, hold or recover a key of yours. This site never holds one.

One power we do hold, and publish:

Until the games contract is frozen, any two of its three admin keys can override its rules in a single transaction — move money out of a game’s pot, or change any record it keeps, including who owns a ticket. The games page states this in full. Freezing the contract would end it permanently; that has not happened.

We can:

• Read the chain alongside you and tell you exactly what the contract did, with the transaction to check it against, so you never have to take it from us.
• Explain in plain words what a contract does and does not do, and point at the code that settles the question.
• Fix this site when it is wrong, and say so when the mistake was ours.
• Act on a security report.

Reporting a security problem

If you have found a vulnerability in a contract or in any of our published code, the private route is a GitHub security advisory on the repository concerned. For the SPT contracts that is github.com/SmartPacts/spt ↗; for the games contract, github.com/SmartPacts/prize-draw ↗, and for the program that settles its draws, github.com/SmartPacts/prize-draw-crank ↗. Where a repository publishes a security policy, it sets out what is in scope and what makes a report useful.

If that route is not open to you, write to contact@smartpacts.io saying only that you have a security report, without the details, and we will take it from there.

Please do not test against mainnet — the contracts are live there and other people’s money is in them. A local development network reproduces everything, and the full test suite runs offline from the repository. There is no bug bounty; we would rather say that plainly than let one be assumed.

What never to send us

Never send a secret key, a recovery phrase or a seed — not to us, not to anyone. We will never ask for one, and anybody who does, however official they look, is not us. Nothing we can help you with needs one: an account address and a request key are already public, and they are enough to look up any transaction.