Security
How BetMesh protects your funds
Security Architecture
BetMeshPoolV7 was built with zero external dependencies — no OpenZeppelin, no third-party contracts. All code is original, auditable and minimalist.
Auditable Contract
Anti Rug Pull
The creator CANNOT: change the result, withdraw funds, cancel the pool or alter rules after creation. The contract guarantees the creator never has access to staked funds.
createPool() + Resolved state— Contract functionOracle Delay + Refund
The oracle has 12h to resolve after the event. If it does not, anyone can trigger refund(), returning 100% of the funds to bettors (zero fee).
triggerRefund() + claimRefund()— Contract functionECDSA (EIP-712)
Sports results are signed with ECDSA using Typed Data (EIP-712). The signature includes a domain separator with chainId and contract address, preventing replay across chains.
resolvePoolFromMatchData()— Contract functionReplay Protection
Incremental nonces for admin functions. Only the oracle can resolve (onlyOracle). Double claim blocked by boolean flag. Anti-sybil: 1 bet per address per pool.
nonces mapping + claimed bool— Contract functionImmutable Fees
Platform fee is 5% (500 bps). Creator chooses between 0% and 10% (0 to 1000 bps, options 350/700/1000). Both defined as immutable constants in the contract. Paid automatically at pool resolution.
PLATFORM_FEE_BPS = 500, MAX_CREATOR_FEE = 1000— Contract functionCEI Pattern
Checks-Effects-Interactions: state is updated BEFORE any external transfer, preventing reentrancy attacks.
entregue em bet(), claim(), refund()— Contract functionNon-Reentrancy
Mutex that blocks recursive calls. If an external call tries to reenter the contract, it is rejected.
nonReentrant modifier— Contract functionCircuit Breaker
Admin can pause the contract in emergencies. When paused, only emergencyRefund() works. Protects against discovered attacks or bugs.
pause() + emergencyRefund()— Contract functionChain Security
The contract is deployable on any EVM chain (Polygon, Arbitrum, Optimism, Base, ...). The EIP-712 domain separator includes chainId, preventing cross-chain replay.
EIP-712 domain separator— Contract function