> SELF-TEST
  MINT AUTHORITY........NONE
  PAUSE FUNCTION........ABSENT
  BENEFICIARY...........IMMUTABLE

The token that can onlygive.

3% of every swap immutable vault 7-day canonical bridge nft.stjude.eth
No owner. No pause. No exceptions.

trace the journey ↓read the bytecode

this is your wei.
scroll to send it home.

PRE-LAUNCH
STATUS: PRE-LAUNCH — MONITOR ARMEDNO SIMULATED DATA ON THIS SITEFEE 3% · HARD CAP 5% · CONSTANTMINT AUTHORITY: NONEPAUSE FUNCTION: ABSENTBENEFICIARY: IMMUTABLEWITHDRAW(): PUBLICFINALIZE(): PUBLIC

the path of every wei · verified end to end

Trust you can trace with your finger.

The asset that leaves the trades and the asset St. Jude receives is the same ETH. No swaps in between, no custodians, no multisigs. Follow the line — it is the only route the money can physically take.

01

A swap happens

SWAP 1.000 ETH ⇄ $STJUDE
├─ 97% continues to the trader
└─ 3% forks left — your wei

The split is not a policy. It is a math operation in the pool’s swap function — 3% of the ETH leg, a constant with a compiled-in 5% hard cap. Wallet transfers cost 0%.

02

The knot nobody can untie

inside the loop:
no owner() · no pause() · no rug()

Fees accumulate in StJudeVault. The line ties itself into a closed loop here on purpose: there is no function that sends this ETH to an arbitrary address. The only exits are the bridge — and a 0.25% reward to whoever pushes the button.

03

Anyone presses the button

Above 0.1 ETH, withdraw() is open to any address on earth. Permissionless. You could be the one who sends it.

04

Seven days, on purpose

The canonical Arbitrum bridge cannot be rushed, spoofed or rerouted — by us or anyone. We refuse fast bridges: they add a trusted middleman to save a week.

7 days: long enough for anyone on earth to audit every exit.

day
1
— OF 7 —
05

Bedrock: Ethereum mainnet

The wei lands on L1 inside StJudePayout — a contract with one send function and one immutable constant. During the wait and after it, these funds physically cannot go anywhere except the beneficiary. No other destination exists in the bytecode.

06

The line becomes a heartbeat

finalize() — public, like everything here — forwards the entire balance to nft.stjude.eth, the donation address St. Jude publishes itself. Every swap donates — always to St. Jude.

the monitor · reads chain events only

Nothing here can lie.

Every number is the sum of Bridged events on L2 and Donated events on L1. Until the contracts are live the counters honestly read zero — this site never shows a simulated figure.

syncing…ETH/USD —
TOTAL DELIVERED
0.000 ETH≈ —
Σ Donated · Ethereum L1
ON THE BRIDGE
0.000 ETHnothing in transit
Σ Bridged − Σ Donated · 7-day crossing
IN THE VAULT
0.0000 ETH
0% to public withdraw()
withdraw() arms at 0.1 ETH
hard-coded beneficiary · immutable constant
nft.stjude.ethetherscan ↗published at stjude.org ↗
donation ledgerl2 withdraw · l1 donate · amount · date
NO ENTRIES YET.
THE FIRST withdraw() WILL PRINT HERE THE MOMENT IT LANDS ON-CHAIN.
this ledger reads events only — it cannot show anything that didn’t happen.

trust the bytecode, not the team

The dead switches.

MINT — this function does not existPAUSE — this function does not existRUG — this function does not exist

Most projects promise they won’t. This one can’t— the dangerous functions don’t exist in the compiled bytecode. Don’t take our word for it. Try to rug it yourself:

the revert wall — attacks welcome

$ — pick an attack above. every one of them dies the same way.

anyone can call withdraw() and earn 0.25% for gas
anyone can call finalize() after the bridge
anyone can verify every constant in the bytecode

six contracts, one direction

The machinery.

Each contract does one job. Addresses are published and verified on deployment; the vault and payout go through an external audit first — the bridge is the main risk surface and is treated that way.

StJudeTokenL2ERC-20 with fixed supply. No mint function, no owner. The token itself holds zero privileged logic.pending deployment
StJudeFeeHookL2Takes the 3% fee in ETH on the ETH leg of every swap. Rate is a deploy-time constant with a 5% hard cap.pending deployment
StJudeVaultL2Accumulates ETH. withdraw() pushes it into the canonical bridge via ArbSys. Destination changes only through governance.pending deployment
StJudePayoutL1finalize() claims the bridged ETH and forwards it to the immutable BENEFICIARY in a single transaction. No other destination exists in the bytecode.pending deployment
StJudeGovernorL2Proposals and voting for beneficiary changes. 7-day vote, 10% supply quorum, proof link required.pending deployment
StJudeTimelockL2Enforces a 14-day delay on any destination switch. Execution is public — no owner needed.pending deployment

the only mutable thing — slowly, loudly, publicly

The failsafe takes 21+ days.

If St. Jude ever rotates its published address — or asks us to stop — governance is the only way to react. Four stations, no shortcuts.

1
with proof

Proposal

A new beneficiary needs a proof link showing the organization itself published that address. No proof, no proposal.

2
7 days

Vote

Token holders vote in the open. Quorum: 10% of total supply. A quiet change is arithmetically impossible.

3
14 days

Timelock

The passed proposal waits 14 more days in public view — time for anyone on earth to inspect the new payout contract.

4
public

Execution

execute() is permissionless. The vault's bridge destination switches. No owner key exists at any step of this path.

the hard questions, answered bluntly

Ask like an auditor.

No. Independent community project — not affiliated with, endorsed by, or operated by St. Jude Children’s Research Hospital or ALSAC. St. Jude publicly asks to be notified at cryptocurrency@stjude.org when its published address is set as a smart contract beneficiary; that notification is sent before deployment and the correspondence is kept. If the organization objects, the beneficiary changes through governance — or we don’t deploy at all. Reach the team: stjudetoken@gmail.com.