OPNet · Bitcoin L1 · VibeCoding Week 2

Real Yield on
Bitcoin L1

On-chain vesting with cliff + linear release, plus proportional revenue sharing. Protocol fees flow directly to vested holders — no bridges, no L2, no wrapping.

View on GitHub
OPNet Testnet — LIVE
🔒 Reentrancy-safe
⚡ O(1) distribution
₿ Bitcoin L1
✓ 0 Critical findings
📋 opt1sqpl…hym6 ↗
🔒
Total Locked
💰
Revenue Distributed
Block Height
O(1)
Distribution Complexity

From deploy to yield in 5 steps

VestingVault combines battle-tested vesting mechanics with Synthetix-style reward distribution — entirely on Bitcoin L1.

01
⚙️

Deploy & Initialize

Deploy the WASM contract with no constructor args. Then call initialize(vestingToken, revenueToken) once as owner to configure token addresses. One-time, owner-only, replay-protected.

02
🔒

Lock Tokens

Owner adds a vesting schedule per beneficiary: amount, cliff (blocks), and linear duration. Tokens are pulled via transferFrom and locked in the vault.

03
💰

Deposit Revenue

Any address deposits revenue tokens (protocol fees, trading fees, etc.). The global rewardPerToken accumulator updates in O(1) — no iteration over beneficiaries.

04

Cliff Passes

Once the cliff block passes, tokens start vesting linearly. releasableAmount = vested − already released. Checked per-block with no rounding attacks.

05
🎯

Claim Everything

Beneficiary calls release() for vested tokens and claimRevenue() for their proportional share of all deposited revenue. State clears correctly.

Built for correctness

Every design decision in VestingVault prioritizes safety, gas-efficiency, and mathematical correctness.

Block-Based Vesting

Cliff + linear release computed purely from block numbers — no timestamps, no oracle dependency. Deterministic and manipulation-resistant on Bitcoin L1.

Blockchain.block.numberU256
📊

Synthetix Accumulator

Revenue distributed via rewardPerToken global accumulator. Each deposit is O(1). Claims computed instantly from stored debt snapshots — no loops.

rewardPerToken += (amount × 1e18) / totalLocked
🛡️

Persistent Reentrancy Guard

The lock flag is a StoredBoolean in blockchain storage — not in-memory. Survives per-call class re-instantiation unique to OPNet's execution model.

StoredBoolean(_locked, false)
🔢

SafeMath Everywhere

All 19 arithmetic operations use SafeMath.add/sub/mul/div. Zero floating point. Rounding truncates toward zero, favoring the protocol.

SafeMath.mul(amount, PRECISION)

CEI Pattern

State is always written before external Blockchain.call(). Checks → Effects → Interactions enforced in all 4 state-changing methods. Audited line-by-line.

updateReward() → state → callTransfer()
🔑

Correct Sender Check

Uses Blockchain.tx.sender (direct caller), never tx.origin. Prevents delegation attacks. Owner restricted to addVesting() only.

Blockchain.tx.sender === _owner

Revenue distribution — verified

Example: Alice 70% locked, Bob 30% locked. Two deposits of 1 000 and 700 revenue tokens.

Alice & Bob — end-state snapshot
Participant Locked Share Deposit 1 (1 000) Deposit 2 (700) Total earned
🟠 Alice 7 000 70% 700 400 (4000 locked) 1 100 ✓
🔵 Bob 3 000 30% 300 600 (3000 locked) 600 ✓
Σ Total 10 000 100% 1 000 700 1 700 ✓
Initial Deposit
rewardPerToken += 1000 × 10¹⁸ / 10000 = 10¹⁷

Global accumulator updated in O(1). No loops over beneficiaries.

Claim (Alice — 7 000 locked)
earned = 7000 × 10¹⁷ / 10¹⁸ = 700

Bob earns 300. Total = 1 000. No dust left.

After partial release (Alice releases 3 000)
stored pending = 700 (captured first) lockedBalance = 7000 − 3000 = 4000 rewardDebt = currentRpt

Next deposit of 700 tokens:

rewardPerToken += 700 × 10¹⁸ / 7000 = 10¹⁷ Alice new earn = 4000 × 10¹⁷ / 10¹⁸ = 400 Alice total = 700 + 400 = 1100 ✓ Bob total = 3000 × 2×10¹⁷ / 10¹⁸ = 600 ✓ Grand total = 1700 = deposited ✓

Result: 1100 + 600 = 1700 — perfectly balanced, no dust.

Interact with the vault

Connect your OP Wallet to release vested tokens, claim revenue, or deposit protocol fees.

Contract Configuration
Vault Contract Address Vault
Revenue Token Address Revenue
Vesting Token Address Vesting
Your Wallet Auto-filled
🔓

Connect your OP Wallet

View your vesting schedule, pending revenue, and interact with the vault directly from your browser.

AI-assisted audit — 0 critical findings

All 29 critical vulnerability patterns and 20 OPNet-specific attack surfaces checked.

0
Critical
0
High
0
Medium
0
Low (fixed)
3
Info
SafeMath — all 19 arithmetic ops
Reentrancy — StoredBoolean in persistent storage
CEI — state before every external call
tx.sender — never tx.origin
No loops — O(1) distribution
No floats — pure integer arithmetic
Block height — no timestamp oracle
BytesWriter — sizes match writes
increaseAllowance — ATK-05 mitigated in frontend
AddressMemoryMap — no built-in Map