There are 999^unverified birds. A minted bird is asleep, and a sleeping bird is a picture: it holds nothing and earns nothing. Waking one burns 50,000^unverified $MORO, permanently, and from then on it earns tokenized stock into a store inside the token called its Nest.

The stock comes from trading fees on the $MORO/NVDA pair. Every hour, whatever arrived is divided: 85% across awake birds by weight, 15% to the treasury. Nobody has to be watching for this to be correct — the hours are settled by anyone calling poke(), and a bird is credited for the hours it was awake at the weight it held during them, whenever that settlement happens.

A bird that is not fed loses weight over time, and one that is sold falls asleep. Neither takes anything away from what it has already earned.

$MORO exists to be destroyed. It is spent to wake a bird and spent again to feed one, and in both cases it is burned rather than collected — no address receives it, including ours. Waking costs 50,000^unverified and one feed costs 10,000^unverified.

The entire supply was minted once, at deployment, to the treasury, which seeds the trading pair. There is no mint function and no owner who could add one.

The Nest is tokenized stock held inside the NFT, not a claim you redeem against us. It travels with the token: sell the bird and the buyer gets the hoard. We tested this on a real chain — a bird holding 141.67 NVDA was transferred and the balance did not move.

Withdrawal is free. Not free as a policy we are promising to keep — there is no fee variable anywhere in the distributor, so there is no number for a future admin to change and no admin to change it. A withdrawal on testnet paid out the balance exactly, to the wei.

Hours are settled by poke(), which anyone may call, takes no argument and pays its caller nothing. At most 720^unverified hours close per call, so a long-neglected accumulator catches up over several calls rather than exceeding the block limit and wedging permanently.

A bird holds full weight for the first 28^unverified days after its last feed. After that it steps down: to until day 42^unverified, then to until day 56^unverified, after which it is dormant and earns nothing until fed again.

The steps happen on a schedule with no transaction behind them. The contract does not discover a bird has decayed when someone touches it — the drops are written into the accumulator as dated changes at the moment the bird is fed, so an unattended bird is valued correctly for every hour whether or not anyone was watching. We tested this on a real chain by waking a bird during an unsettled backlog: it was credited nothing for the hour it had slept through.

The first 24^unverified birds ever woken are the Tiding, and they never decay at all. A Tiding bird keeps the mark permanently, including through a sale — the flag is claimed on a token’s first waking, so re-waking after a sale cannot take a further slot.

Feeding past the wake threshold raises a bird’s weight permanently. The ladder is cumulative — the totals below are lifetime $MORO burned by that bird, not per-feed costs.

8^unverified birds out of the full 999^unverified are Gilded. Each token maps to an art index through a permutation that is a bijection, so precisely the eight tokens landing below the threshold are Gilded — across the whole collection there is no draw that could produce seven or nine.

Which eight depends on a seed committed on chain before the first sale and published after the last. Until the reveal nobody can know, including us; after it, anyone can derive the set and check it against isGilded(tokenId).

A bird’s owner can withdraw its Nest themselves with withdraw, which requires them to send a transaction and therefore to hold gas. Somebody holding a bird and no ETH would otherwise be unable to reach their own stock, so there is a second path: withdrawFor(tokenId, to, deadline, signature). The owner signs; anyone at all may submit it and pay the gas.

The relay is trusted with nothing. That is worth being exact about, because “relay” usually implies a component you have to trust. There is nothing here it could betray. A relay — ours, a compromised one, or a hostile stranger — can do exactly three things: submit a signature it was given, submit it late, or not submit it at all.

It cannot redirect the funds: the recipient is inside what the owner signed, so submitting with a different destination produces a different digest, which recovers a different address, which is not the owner. It cannot claim twice: each token carries a counter that is spent when a signature is used. It cannot use a signature after the bird is sold, because ownership is read when the transaction executes and never taken from the signature — a seller’s old signature recovers to the seller, who no longer owns it. And it cannot hold a signature indefinitely, because the owner signs a deadline.

There is no trusted forwarder, and that is deliberate. A forwarder would be an address that gets believed about who it is acting for, which then becomes an address that must never be compromised. Here nothing is believed. The signature is the only authority in the system.

The art is not stored on chain, so “the collection is what we say it is” would otherwise be a matter of trust. It is not. Every bird is a pure function of the revealed seed, so the whole collection can be regenerated from scratch and compared against a checksum published after the reveal.

The manifest hashes every token’s traits and all four of its state images, then hashes that list into a single root. Reproduce it with:

MORO_SEED=$(cast call <MORO> 'seed()(bytes32)') \
  node art/engine/cli.ts manifest

The seed comes off the chain, not from us. If the root you get differs from the published one, the published collection is not the one the seed produces, and you should say so loudly.

Published root (Robinhood Chain (4663)): 6f552fff1c926a08ed6af67f6ee00b8a01261fa5fe55eea20b7fdac712343d75
Gilded: 188, 231, 267, 329, 466, 472, 562, 1363

The Gilded set is derived the same way. Anyone can compute it from the seed and check each one against isGilded(tokenId) on chain. We check this ourselves before publishing, because we have already shipped a mismatch once in development: a hard-coded list of eight, written before any seed existed, disagreed with the chain the moment a real seed was revealed.

The metadata is served from an endpoint we control, which means we could change what it serves. We are not claiming otherwise. tokenURI points at https://feedmoro.fun/api/metadata/, that domain is ours, and the string is immutable in the contract — so it will always point there and we will always be the ones answering.

We considered IPFS and chose not to pretend. A content hash cannot be baked in at deploy, because the art depends on a seed that is only revealed after the mint closes — which is after the contract exists. IPNS would let the pointer move, but the pointer still has to be repointed by whoever holds the key, so it is not less mutable than a domain, only less legible. An endpoint we control is the honest version of the same trust assumption, and it is faster and easier to debug.

What is not a matter of trust is the art. Every image is a pure function of the revealed seed, and the checksum of the whole collection is published. If this endpoint ever served an image that did not match, it would be provable in minutes by anyone:

git clone <repo> && cd moro && pnpm install

# the seed comes off the chain, not from us
MORO_SEED=$(cast call <MORO> 'seed()(bytes32)' --rpc-url <rpc>) \
  node art/engine/cli.ts manifest

# compare the printed root against the published one

That regenerates all 999 birds from scratch and hashes every image. A matching root means the collection you can see is the collection the seed produces. A differing root means it is not, and you should say so loudly.

After the reveal the rendered collection is also pinned to IPFS and its CID published, so anyone can mirror it or serve it themselves. That is the real answer to “what if their endpoint goes down” — not a promise that it will not, but a copy you can host without us.

Published root (Robinhood Chain (4663)): 6f552fff1c926a08ed6af67f6ee00b8a01261fa5fe55eea20b7fdac712343d75

Measured on Robinhood Chain testnet from transaction receipts, not estimated. Gas prices move, so the gas figure is the durable one; the cost column is what that gas came to at 0.01 gwei.

Waking a bird costs more when it also has to settle a backlog of unsettled hours — the measured 223,894 is a wake that closed one elapsed hour on its way through. Minting several birds in one transaction is much cheaper per bird than minting them one at a time.

Our three contracts have no owner, no pause and no upgrade path. The asset they hold does.

A Nest holds NVDA, the tokenized NVIDIA stock issued by Robinhood at 0xd0601ce157db5bdc3162bbac2a2c8af5320d9eec. That address is a beacon proxy. It holds no logic of its own — it reads an implementation address from a beacon at 0xe10b6f6b275de231345c20d14ab812db62151b00 and forwards every call to it. Today that implementation is 0xb35490d6f9163DE4F80d88dc75c3516eb64C5aE2. Whoever controls the beacon can replace it, for every holder at once, without asking anyone.

The token also has a pause switch. paused() returns false right now, so it is not paused. If it were ever paused, withdrawals from every Nest would revert until it was unpaused, because withdrawing is a transfer of that token and a paused token refuses transfers. Your balance would not be lost and nothing would be taken — the withdrawal simply would not go through until the issuer allowed transfers again.

We cannot prevent this, work around it, or fix it for you, and neither can anyone else holding MORO. It is not a flaw in what we built; it is what it means to hold an asset somebody else issues. Every address above is on chain and you can check all of it yourself — paused() on the token, and implementation() on the beacon.

The same is true of the stock exposure itself. What the token is worth, whether it keeps tracking NVIDIA, and under what terms it can be redeemed are all decided by its issuer under agreements we are not party to.

The contracts have not been audited. If you are reading this before that changes, nothing below has been reviewed by anyone outside the people who wrote it.

What that does and does not mean. The contracts are covered by 82 tests, including property tests that compare the accumulator against an independent reference implementation, and the full lifecycle has been run on a real chain. That is evidence, and it is not the same thing as an audit. Tests demonstrate the behaviour we thought to check for. An audit is someone whose job is to think of what we did not.

Our own testing has already found one real bug of exactly this kind — a bird woken during a long backlog of unsettled hours was credited for hours it had slept through, at one point receiving half the entire holder pool. It was found by writing a test specifically to attack that path, which is precisely the sort of thing that is easy to not think of. We do not assume it was the last one.

What reduces the damage if something is wrong: there is no owner, no pause, no upgrade path and no rescue function, so a bug cannot be exploited by us and cannot be patched by us either. Nobody can drain the contracts through a privileged function, because there is no privileged function. That is a deliberate trade — it removes the insider risk and accepts that a mistake is permanent.

Other things not covered by any review: the front end you are reading, the indexer behind its lists, the relay, and the art pipeline. And the asset inside every Nest is a proxy its issuer can upgrade and pause — see section 11, which is a separate risk from this one and does not go away if an audit comes back clean.

Buying an NFT here can lose you everything you spend. "border-t-[3px] border-ink">