Who can do what
Every key that can act on the Brot Markets program, what it can do, and the limit written in the program's code. Keys are named by role and address, never by person. Checked against the devnet program on 2026-10-10.
Program: 5Rx8o5c5frxqF17mZwvTFg36ZcW5xU12ePojqDbj9n8o, on Solana devnet.
The keys on devnet
| Role | Address | Held by |
|---|---|---|
| Upgrade authority | 6N7rUnJ88yyBiZmGEn3DjyyX9AEtmwzXNGUsps2A4wcq | A co-founder's devnet key |
| Admin | 6N7rUnJ88yyBiZmGEn3DjyyX9AEtmwzXNGUsps2A4wcq | The same key |
| Fee recipient | 6N7rUnJ88yyBiZmGEn3DjyyX9AEtmwzXNGUsps2A4wcq | The same key |
| Team key | 3EgrFsDDBks8zG31rquNvtP1BR91BVArypwtiBg6XwMz | A co-founder's team key; one team key is set today |
Brot's service holds no key with a power over the program. Its wallet holds SOL only to pay network fees, and it asks the program to read results, as any wallet can.
Every power and its limit
| Power | Who | Limit in the program's code |
|---|---|---|
| Replace the program | The upgrade authority | On devnet, at any time and with no waiting period. A replaced program could do what this table rules out. |
| Open a campaign, paying | Any wallet | At least US$500 in SOL at the Pyth SOL/USD price the transaction reads, less its confidence band, 90% of it the prize and 10% Brot's opening fee; the kinds this build opens (four today: price, burn, locked liquidity and stake pool; validator stake waits for its first devnet proof); an account the program's reader accepts; 3 to 90 days; the fees copied from the config when it opens, never above the ceilings below. Refused once the cap on open campaigns is reached. |
| Open a campaign without paying | One team key | No prize and no creator share. It does not count against the cap on open campaigns. Used for the team and launch partners: a team rule, not a limit in the code. |
| Confirm a result in review | One team key | Only while the campaign is in review, inside its 6-hour window. It never changes a YES or a NO. |
| Record the cause of an automatic void | One team key | Only on a campaign the program already voided by itself (a missed reading, an unreadable account, a stale price feed), inside its 6-hour window; never on a YES or a NO. It ends the review and sets the cause, which decides whether the 10% opening fee goes back to whoever opened or stays with Brot. The program stores the cause and the hash of the team's note; publishing each one in the public record is a team rule. |
| Open a contest | One team key | Only while the campaign is in review, inside its 6-hour window, after every entry is tallied. It pauses the payout: anyone runs the reading again; a different reading goes to the admin at once, and the same one pays as recorded only after a 24-hour wait, during which a team key can send the contest to the admin. The payout is due at most 78 hours after the result was read. A team key can so hold a payout up to 72 hours; a price campaign's reading changes with each price update. |
| Decide a contest at its second stage | The admin | Only once the contest reached its second stage (a second reading that came out different, or a team key sending it on during the 24-hour wait), before stage 2's deadline, 48 hours after that (after stage 1's end at the latest): confirm the result as recorded, or void the campaign with a cause the team may record and the hash of a published note. It never turns a result into another YES or NO, but with a team key's contest it can void a correct one. Without a decision, the recorded result stands. |
| Pause new entries and openings | One team key | Never results, reviews, payouts or refunds. |
| Resume after a pause | The admin | Only the admin: a team key can pause but not resume. |
| Change the creation parameters | The admin | New campaigns only, within ceilings written in the code: Brot's fee at most 10% of the losing side, the creator share at most 1%, the one-sided fee at most 1%, an opening price of US$1 to US$5,000 with at least 90% as prize, a minimum entry of 0.001 to 1 SOL, at most 10,000 open campaigns. An open campaign's fees never change. A low cap stops paid openings while free team openings go on. |
| Change the team keys, the fee recipient or the admin | The admin | A new admin takes over in two steps. |
| Resolve, settle and pay | Any wallet | Chooses no result, amount or destination: the result comes from the account read, and every amount and destination from the program. On a price campaign that ends YES, the proof the resolver posts sets which entries count as late (made at or after the proof's time), and those come back whole. |
| Move Brot's fees | Any wallet | Only to the fee recipient. |
| Move or take a baker's entry | Nobody | No instruction does it, and there is no emergency withdrawal. The upgrade authority could still replace the program (first row). |
The plan for mainnet
The plan, if this ever runs with real money, is that the upgrade authority, the admin and the fee recipient move to a 2-of-3 multisig on hardware devices first, and that an upgrade then waits 24 to 48 hours in public before it takes effect. This page changes with them.
Check the keys yourself
Read now from the chain, through this site's RPC: the program's upgrade authority and its config's keys.
Reading the chain…
Public record
Every void the team records, with its reason and the team's own words, and every correction to one. The program voids a campaign by itself when it cannot read the result: a missed reading, an unreadable account or a stale price feed. Inside the 6-hour review, a team key can then record the cause, which decides who keeps the 10% opening fee. A team key can never void or change a YES or a NO.
Each record's SHA-256 is of exactly its file's bytes, and a void's is stored in the campaign on-chain, so anyone can check that the text was not changed. Records are never edited: a correction is a new record.
Voids the program records by itself show their reason on the campaign's page.
No voids or corrections recorded yet.