Trust & safety
Security & community rules
How voting, submissions, wallets, and payouts are protected.
Your wallet, your keys
- We will never ask for your seed phrase or private key. No legitimate part of this site or team ever will.
- Voting never moves your money. You sign a message to prove you control the wallet. No transfer, and your weight is your snapshot $TREE balance. Read every signature before you approve it.
- Verify the treasury address on the Treasury page against the contract before sending anything.
- Beware impersonators. We never DM first, never run “support” inboxes, and never do surprise airdrops that need a “connect to claim”.
How votes stay honest
- A vote is a message signed by your wallet, bound to one entry. The server checks the signature, that voting is open, and your locked snapshot balance before counting it.
- Each wallet votes once per contest. A database uniqueness constraint makes repeat or replayed votes impossible.
- Voting power is your $TREE balance at the snapshot, frozen for the round. All tallies are public.
Anti-abuse
- Submissions are protected by Google reCAPTCHA and a bot honeypot.
- Submissions and votes are rate-limited per IP.
- Submitters can request profile verification through Twitter/X or Instagram. Approved profiles show a checkmark next to the artist name.
- Inputs are validated and length-capped; wallet addresses are checked; media links are restricted to YouTube, SoundCloud, and Spotify.
How your data is stored
- Data lives in Supabase (Postgres) with row-level security enabled and no public policies. Only our server, holding a secret key, can read or write. The browser never holds a privileged key.
- The app sets strict HTTP security headers (Content-Security-Policy, HSTS, nosniff, frame protections) on every response.
Contest rules
- One entry = one YouTube, SoundCloud, or Spotify link per contest week.
- Submit only work you created or have the rights to. No copyrighted material you don't own, no hate, harassment, or illegal content.
- No vote manipulation via stolen funds or fraudulent transactions. Entries that break the rules can be removed.
- The winning entry's payout wallet receives the grant when voting closes.
Report a vulnerability
- Found a security issue? Please disclose it responsibly and privately before making it public, and give us a reasonable window to fix it. Don't exploit it, exfiltrate data, or disrupt other users.
Disclaimer. This is a community tribute project. It is not affiliated with, endorsed by, or representing Oliver Tree, his estate, or his foundation. Nothing here is financial advice. Grants are community-funded from creator fees and distributed by community vote.