Who can do what

Every key that can act on the Brot Markets program, what it can do, and the limit written in the program's code. Keys are named by role and address, never by person. Checked against the devnet program on 2026-10-10.

Program: 5Rx8o5c5frxqF17mZwvTFg36ZcW5xU12ePojqDbj9n8o, on Solana devnet.

The keys on devnet

Brot's service holds no key with a power over the program. Its wallet holds SOL only to pay network fees, and it asks the program to read results, as any wallet can.

Every power and its limit

The next version of the program, not deployed

The next version of the program is built but not deployed: 6RQ6BrByCa3YXTYHg4hGZx2tKNAGZUjUd7pPfBHfoEqt. Until it is, the table above is the program that runs, and this page changes when the next one does. Its code splits the creation parameters into sections, each changed by the admin alone, for new campaigns only, within these limits:

The next program reads the schedule and the kinds switched on, the house opener, the credits authority, the voucher authority, the feature switches, the house's share and kinds, the credits' ceilings, the sponsor and seeder limits and the vouchers' validity, and each opening copies the Turbo's two rates into its campaign. The per-kind parameters are not used yet.

Three of its roles act on their own, each a key the admin names, or none; none is named yet:

In the next program a team key opens only house campaigns, free and with no prize, and no longer a paid one, and it cancels any house campaign before its first entry, as the house opener does; the creator share of a house campaign goes to Brot's fee vault with the fee. No team key confirms, voids or contests a campaign it opened: another team key does, or the review window ends. A partner with credits opens a campaign free, one credit each, until its credits expire (2027-03-16 for the first round); a cancel spends the credit. The admin can do what the credits authority does, and on mainnet only the admin's multisig grants credits. There is no limit on how many campaigns are open at once. The admin opens no campaign of any kind and decides no contest on a campaign it opened. Taking a partner's credits back always works, even with credits switched off. One key never holds two powers: the house opener, the credits authority and the voucher authority are three different keys, none of them a team key or the admin, and the admin is never a team key. A team key opens a house campaign only while another team key exists to judge it.

The admin can also do what the voucher authority does. A voucher's SOL becomes an entry like any other: it wins as any entry wins, and when an entry is refunded (a void, a one-sided pot or a late entry), the part of it a voucher paid goes to Brot's fee vault, never to the wallet, so a voucher cannot be turned into cash. Any wallet may also enter as a seeder, US$500 to US$5,000 at the Pyth SOL/USD price and at most the SOL it signs for, only in the first half of a campaign's entry window, with no Turbo; its entry is marked as a seeder's. Every entry records its value in US$ at the SOL/USD price when it lands. A seeder or a sponsor pays in US$ and is refused when that price is old or uncertain; a wallet's own entry and a voucher's take the last price the price account holds then, and none, for the records to fill, when the price is more than an hour old. No key loads a voucher for itself. A wallet may add the Turbo to its own entry or to a voucher's, always from its own SOL and never more than it signs for; the Turbo comes back in full on a refund, a one-sided pot or a late entry, and Brot keeps a share of the losing side's Turbo only. The admin's Turbo switch stops new Turbo, never the Turbo already in.

Any wallet but the admin and a team key, which judge campaigns, may add a prize to an open campaign before its entries close, paid in US$ at the Pyth SOL/USD price and at most the SOL it signs for: a third party US$500 to US$5,000, at most three a campaign and one each; the campaign's creator its own prize, from the campaign's minimum entry to US$1,000,000, outside those three. The prize splits at the campaign's tier: the pot part joins what the winners share, and Brot's part waits in the campaign until it closes, then goes to Brot's fee vault. When the campaign does not split, the pot part goes back to the sponsor; a void, or the house cancelling its own campaign, gives back Brot's part too, which Brot keeps when the creator of a paid campaign cancels. Anyone settles a prize, always to its own sponsor, who gets its rent back. The pause stops new prizes, never their settlement. The program checks who judges only when a prize is added, so the admin names no wallet that holds an open prize to the team or as admin: a rule the admin follows, not one the program can check.

The team panel

The team uses these powers from a private panel that holds no key. Each act is prepared from the chain as it stands, summarized from the exact bytes to be signed and simulated first, then signed by the wallet that holds the power, in the browser of the person who holds it. The panel refuses to prepare an act for a wallet without that power: a team key cannot grant credits or load vouchers, and the only team key cannot open a house campaign.

The panel also keeps three lists outside the program: the partner KOLs who may get credits, the BDs with their payout wallets and the creators they bring, and the sponsors with the BD who brought each. Each change is a message a team wallet signs, kept with who signed it and when; a BD's payout wallet is the one the BD sends, entered by the team, and a BD can never sign a change that names it. Names and contacts are kept beside those lists, not in the signed messages, so they can be erased on request.

The plan for mainnet

The plan, if this ever runs with real money, is that the upgrade authority, the admin and the fee recipient move to a 2-of-3 multisig on hardware devices first, and that an upgrade then waits 24 to 48 hours in public before it takes effect. This page changes with them.

No voids or corrections recorded yet.