> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pollyprize.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# How PollyPrize is Secured

> Understanding the security and transparency measures in place.

import { Card, CardGroup } from '@mintlify/components';

Trust and security are paramount in the Web3 space. PollyPrize is designed with transparency and fairness at its core.

<CardGroup cols={2}>
  <Card title="Smart Contract Based" icon="file-contract">
    The entire raffle logic – including ticket sales, fee collection, burning, PP tracking, VIP status, gating, and winner selection triggers – is handled by the **PollyPrize smart contract** deployed publicly on the Abstract blockchain.

    * **Transparency:** Anyone can view the contract's code and transaction history on Abscan.
    * **Immutability (Mostly):** While the contract uses a UUPS proxy for *upgradability* (allowing the team to fix bugs or add features securely), the core rules of a specific raffle (like pricing, prize, caps set at creation) are generally immutable once deployed. Changes to mutable parts (like end dates or listing status) require authorized admin actions, which are also visible on-chain.
  </Card>

  <Card title="Verifiable Randomness" icon="dice-three">
    Winner selection isn't done off-chain behind closed doors. PollyPrize uses **Pyth Entropy**, a decentralized oracle network, to provide cryptographically secure and verifiable random numbers directly on the blockchain.

    * **Fairness:** Eliminates the possibility of the organizers manipulating the outcome.
    * **Auditability:** The request for randomness and the delivery of the random number by Pyth are public on-chain events.
      Read more about <u>[Randomness & Fairness](/mechanics/randomness)</u>.
  </Card>

  <Card title="Token Approvals & User Control" icon="hand-holding-dollar">
    When paying with ERC20 tokens, the contract uses the standard `approve` and `transferFrom` pattern.

    * **Your Control:** The contract cannot take tokens from your wallet without your explicit permission granted via an `approve` transaction.
    * **Transparency:** You confirm all transactions, including approvals and purchases, directly in your own wallet.
      Learn more about <u>[Approving Tokens](/entering/approving-tokens)</u>.
  </Card>

  <Card title="Audits & Best Practices" icon="shield-check">
    * **Audits:** The PollyPrize smart contract has been audited by <u>[Sub7](https://sub7.tech)</u>.
    * **Standard Libraries:** The contract leverages battle-tested, community-audited libraries from OpenZeppelin for core functionalities like access control, pausing, reentrancy guards, and upgradeability.
    * **Role-Based Access:** Administrative functions (like creating raffles, managing VIPs, withdrawing fees) are restricted to specific roles managed through secure multi-signature wallets or planned DAO governance, minimizing single points of failure.
  </Card>
</CardGroup>

While we strive for the highest security standards, participating in any smart contract interaction involves inherent risks associated with blockchain technology and wallet security. Please ensure you understand these risks and follow best practices for securing your wallet.