sepolia dogfood ledger

Every transaction that exercises a contract surface on Base Sepolia. Each entry says what moved and what it proved or clarified about the architecture. Resets on every redeploy.

livechain 84532 · Base Sepolia

Architecture v2 deployed + full dogfood ledger green on Base Sepolia 2026-05-23. 27 broadcasts across 5 flows exercise both custom contracts AND all 3 vetted primitives. Adversarial revert paths covered by the test suite.

redeploy workflow

If any custom contract is redeployed for ANY reason, the ledger resets to step 1. We do not ship partial coverage. Sepolia ledger reflects the most recent contiguous run only.

1.Custom contracts deploy
Mock USDC + Mock KEYNOTE + LecternBoostEscrow + LecternStakingVault addresses
```
forge script script/Deploy.s.sol --rpc-url base_sepolia --broadcast --verify
```
2.Dogfood 1 — StakingVault
Tier 0→1→2→3 transitions + adversarial revert paths
```
forge script script/Dogfood1_Staking.s.sol --rpc-url base_sepolia --broadcast
```

3.Dogfood 2 — BoostEscrow

boost → settle → claim + adversarial revert paths

forge script script/Dogfood2_BoostEscrow.s.sol --rpc-url base_sepolia --broadcast

4.Dogfood 3 — Sablier LockupLinear
Founder stream with 1h cliff + cancel + post-cliff withdraw
```
forge script script/Dogfood3_SablierStream.s.sol --rpc-url base_sepolia --broadcast
```
5.Dogfood 4 — Sablier MerkleInstant
Per-epoch Merkle campaign creation + claim + hasExpired check
```
forge script script/Dogfood4_MerkleInstant.s.sol --rpc-url base_sepolia --broadcast
```

6.Dogfood 5 — 0xSplits PushSplit

Split creation + USDC + KEYNOTE distribute

forge script script/Dogfood5_PushSplit.s.sol --rpc-url base_sepolia --broadcast

7.Ledger refresh
Updated /keynote/sepolia content with every tx hash + what-moved + what-proved
```
./script/build-dogfood-ledger.sh > lib/keynote-sepolia-ledger.json
```

If step 1 re-runs (deploy addresses change), steps 2–7 all re-run. The previous ledger entries are archived at /keynote/sepolia/archive/<date> but the live ledger only ever reflects one contiguous run.

dogfood flows (6)

each flow is a single foundry script. ledger entries appear as transactions broadcast on sepolia.

StakingVault tier transitions

green

script: Dogfood1_Staking.s.sol

exercises: LecternStakingVault (custom)

0xcdede2564b573037dcd2ad3a1219bafd2e2875ac8c9faf8c86590ae147a13aa8block #41,874,782
what moved
Max-approve KEYNOTE to StakingVault
what it proved
Standard ERC20 allowance pattern; max-approve avoids per-stake re-approval
0x5a24ad2f09032bbfc2d804dfaefc50db16ca6f9568e0dd48f202ac83f596e11fblock #41,874,782
what moved
Stake 25M KEYNOTE → tier 1 (15% Pro USDC discount)
what it proved
First-time stake initializes stakeStartTime; tier threshold uses >= so exact 25M = tier 1
0x292c89050f7ef3e36f2c545c6c815532cab6b6f80270b9cb792ffcce452aa266block #41,874,782
what moved
Stake +25M → total 50M; tier 2 (25%)
what it proved
Tier is recomputed per-call from stakeOf; no snapshot, no race
0xeedb5259f63558160e284152ee3e8afb2bd5443b4e8d04ff9e32b3da1c2a3b0cblock #41,874,782
what moved
Stake +50M → total 100M; tier 3 (40%, max)
what it proved
Max discount tier; stakeStartTime preserved across additions
0x0da9cf73e020851d91e05e3c718f9c26fd068fcc6270f204e0f32342fd61e524block #41,874,782
what moved
Unstake 50M → back to 50M staked; tier 2
what it proved
Partial unstake demotes tier instantly; no lockup, no penalty; stakeStartTime preserved
0x8c66c5419280ad20b653caa600bbfedb3cfb16c11625625b3e3eee461df8ba08block #41,874,782
what moved
Unstake remaining 50M → tier 0; stakeStartTime cleared
what it proved
Full unstake resets duration clock so future stake re-starts time tracking
0x356f26b5b0e1a3b36ac7b76440c107e04fdf5b7d86f1d84f487e6fab3257b3b3block #41,874,782
what moved
Stake 24,999,999 ether → tier 0 (one wei below threshold)
what it proved
Tier boundary is exclusive of sub-threshold values; >= 25M required for tier 1
0x64666d02910b2f1d60d17741401acca2fd9bcfc3b6719aab56549b10b9de9596block #41,874,782
what moved
Stake +1 ether → exactly 25M; tier 1
what it proved
Tier threshold inclusive at the exact value (>= comparison); crossing the boundary unlocks the tier
0xcef8cffe5a89cda9c9d7da4ff16808954e3b1791db6cbf6c1c0c39d663282ce5block #41,874,782
what moved
Cleanup: full unstake → tier 0
what it proved
Script is idempotent across re-runs; no residual stake leak

BoostEscrow boost → settle → claim

green

script: Dogfood2_BoostEscrow.s.sol

exercises: LecternBoostEscrow (custom)

0xc5654153767cbe1b5c6367f000063d2d0042a4b53b2a659e9cf4d5af68a58fdablock #41,874,788
what moved
Max-approve KEYNOTE to BoostEscrow
what it proved
Standard ERC20 allowance pattern; allowance set once for whole script
0xedbcdfc44ed7c613f6e4e893377815305386049b4089f99b17730f7aa61d769cblock #41,874,788
what moved
Boost cast A with 10k KEYNOTE; castBoostTotal[A] = 10k
what it proved
Per-cast totals back the curated-feed ranking; boostedBy[A][booster] tracks personal contribution
0x8928e36fd0fcaba5161d035745a03b4e5a989df34cc9998a03477ec96af6a323block #41,874,788
what moved
Boost cast B with 5k KEYNOTE; castBoostTotal[B] = 5k
what it proved
Boosts are per-cast keyed; B total independent of A
0xf09205a193a70149886f20e4c7242679df809be18bea64db260beb5b79e99cb5block #41,874,788
what moved
Re-boost cast A with +2k; castBoostTotal[A] = 12k
what it proved
Same booster can re-boost; totals accumulate per (cast, user)
0x635856b028a56c95b8de24262363ce9bac1208f4d3bf5b99c28edad19aab6755block #41,874,788
what moved
Admin settles epoch with Merkle root (deployer=8k, dummy=2k)
what it proved
Per-epoch root + totalDistributed bound how much can be claimed; settledAt starts the 12-week claim window
0x408b2e737736e549e1b81f2b9eab4a07b80592eb46ecd38df020d8221e9e28adblock #41,874,788
what moved
+8k KEYNOTE to deployer via Merkle proof
what it proved
Anyone-can-submit claim; recipient parameter routes funds (not msg.sender), so frontrun cannot divert

Sablier LockupLinear (evaluated as FounderPay candidate, then superseded by OZ VestingWallet)

green

script: Dogfood3_SablierStream.s.sol

exercises: SablierLockup (vetted; not used in current architecture — see /keynote#mainnet)

0x5535848f441e232059fb4bd986ec38c19ade5266e4da5c9160d113a9cd9c7587block #41,874,795
what moved
Max-approve USDC to SablierLockup
what it proved
Sablier pulls tokens via safeTransferFrom on create; standard pattern
0x4799b01e0a762c74f0750e86d05966d7f277009e964d1d885d916934707f4765block #41,874,795
what moved
1000 USDC → Sablier escrow; streamId minted, founder gets NFT
what it proved
Cliff-and-linear stream created (10min cliff / 20min total — dogfood-compressed from mainnet 60d cliff); founder cannot withdraw pre-cliff; sender can cancel
0x80c9f4ac66e7cf7a5d9e9f1676537213f11b96f8b21d51dcfd8705d08da782a2block #41,874,795
what moved
1000 USDC refunded to sender (cancel pre-cliff)
what it proved
FounderPay pre-cliff reroute analog: OperationsTreasury can cancel the founder stream during 60-day cliff and reroute refund to EngagementBudget
0x2bfd9fde483f0fb60de2bf54ebf724e9fe4307196a190e23afc99b49c40b50aeblock #41,874,795
what moved
1000 USDC → Sablier escrow (second stream, left running)
what it proved
Steady-state founder stream mirrors what mainnet leaves open for months; cancel triggered only for explicit reroute

Sablier MerkleInstant (Pro allocation analog)

green

script: Dogfood4_MerkleInstant.s.sol

exercises: SablierFactoryMerkleInstant (vetted)

0xf5b4594e4dd326792061b296b62ee885f4a3ec0bd5b230fb6a7778339d9b3955block #41,874,801
what moved
MerkleInstant campaign deployed; 12-week expiration; admin = deployer
what it proved
One-shot per epoch; campaign holds tokens + serves claims; native expiration + clawback replaces our hand-rolled CLAIM_WINDOW + reclaimEpoch
0xb9cb593f0d0d7809af703bb8bc9a727a7e11d0738b56e0bddde249410df3c954block #41,874,801
what moved
100k KEYNOTE → campaign contract
what it proved
Per-epoch campaigns are funded after creation; pattern: bot deploys campaign + transfers from aggregator EOA in one tick
0x4f657d8505a002dc526c08691d5b2382c7c54cff18c8c656cded268e24c3caf6block #41,874,801
what moved
+50k KEYNOTE to deployer via Merkle proof; small ETH fee to Sablier Comptroller
what it proved
Merkle proof verified on-chain by Sablier; claim pays Sablier-protocol fee in ETH (not us); same primitive will serve Pro weekly allocation + staker weekly yield campaigns on mainnet

0xSplits PushSplit (Pro renewal routing analog)

green

script: Dogfood5_PushSplit.s.sol

exercises: PushSplitFactoryV2.2 + SplitsWarehouse (vetted)

0xdde0880ed71341069efd4c4f99b5daca3289b6a444ddcbe0b1b2522c3977f2ecblock #41,874,807
what moved
PushSplit deployed; 40/30/30 allocation to 3 recipients
what it proved
Immutable PushSplit; owner can update params for runway-tier rotation on mainnet (dogfood leaves immutable)
0xae7dc5744af351b7d85bda54deb47e8d7c80a48b56950db0e1ba07f16f2ba539block #41,874,807
what moved
1000 USDC → split address
what it proved
PushSplit holds funds until distribute() is called; analogous to Pro USDC sub or LP-fee inflow on mainnet
0x1bb66e5a9da655dd51add203622664ffbb215fecdf2346bfb3295258819b8916block #41,874,807
what moved
USDC distributed to A (40%), B (30%), C (30%) pro-rata
what it proved
distribute() is permissionless; distributor reward incentivizes bots on mainnet (testnet incentive=0). PushSplit pushes directly to recipients (vs PullSplit → Warehouse).
0x345b54cd3d89b1d15ec0dd92b21e7b2de5eae44065d56e58a966b0dac5773e1dblock #41,874,807
what moved
10k KEYNOTE → split address
what it proved
Same split routes any ERC20 with the same percentages; one split serves USDC and KEYNOTE flows without code change
0xfc27e464dbb3b02db4599d92ba4b13720e62b6e8b4882ab4016c4c03756bf4d5block #41,874,807
what moved
KEYNOTE distributed to all 3 recipients pro-rata
what it proved
Same call shape, different token argument; the split contract is token-agnostic

Gnosis Safes (4 multisigs: 3 USDC + 1 KEYNOTE)

green

script: DeploySafes.s.sol + DeployEngagementTokensSafe.s.sol

exercises: Safe v1.4.1 SafeProxyFactory + SafeL2 singleton (vetted)

0x546a6ee585736f7a3d4afbae9baf356310b802f107a8cd0b77dbebce1edddfaablock #41,875,524
what moved
OperationsTreasury Safe deployed (2-of-3) at 0x73f7a050dD23236d3F707003B9d827B6fb5182C3
what it proved
Recipient of 40% USDC slice; signers verifiable via getOwners(); threshold via getThreshold() == 2
0x1d07e721d5cd09d6ca8e0094aebc06445858cbece8aadb0172c0c36c6c1b74f3block #41,875,524
what moved
EngagementBudget Safe deployed (2-of-3) at 0x3827BdB6BDB0347DA81A1b8B555045a5Bb1dC9E6
what it proved
Recipient of 30% USDC slice; same 3 signers as OperationsTreasury (team / ops / advisor)
0x23d562d574d56344616b859fe0a70f59e7b98f3a05f652878afc8af8ec3628c9block #41,875,524
what moved
Reserve Safe deployed (2-of-3) at 0x265CbBbBF093fAc56e8a8c0dbFD76Cf71C4a5fD0
what it proved
Recipient of 15% USDC slice (memo required per spec); same 3 signers
0x09e08d4c18a072e963a823e8df9b39ee033b6ff188f6f77f805392e2f6cb00dfblock #41,875,716
what moved
EngagementTokens Safe deployed (2-of-3) at 0x19d371bcceaedc394063d799e8b233e00d11f2df
what it proved
Recipient of runway-tied % of KEYNOTE-from-renewals (token-denominated contests, bounties, partnerships); same 3 signers; KEYNOTE-only flow, separate from USDC routing

why this format

tx

Receipt. Block-explorer-verifiable. The thing that actually happened on chain — not a screenshot, not a description.

what moved

State change in plain language. What tokens went where, what flag flipped, what tier was reached.

what it proved

The architectural claim the transaction validates — or the assumption it forces into the open.

Reading the receipt alone is not enough. Reading the description alone is not enough. The third column is where claims get pinned to evidence.

mainnet pre-launch (historical)

The Safes that received USDC routing slices + KEYNOTE-from-renewals were the first mainnet contracts to land, before any custom logic. Same v1.4.1 template + 2-of-3 signer set as the Sepolia mirrors. See /keynote#contracts for the full live footprint that came next.

Base · chain id 8453

pre-launch provisioning

4 Safes deployed 2026-05-23. All are 2-of-3 multisigs with the same {team, ops, advisor} signer set as the Sepolia mirrors. Each Safe is independently verifiable on Basescan via getOwners() + getThreshold().

safes (4)

safe v1.4.1 · 2-of-3 multisig · same signers across all 4

OperationsTreasury

0x2975C387B5DCF959eB3Ecdb1f6a3f12a1D318781

40% USDC slice — hosting, RPC, gas reserves, audit, app store, legal. Owner of both PushSplits.

deploy tx → 0xcbf4e864…787b47

EngagementBudget

0x34adEC5A3D7BA8844c9AC83D0526b148420e76BB

30% USDC slice — sponsored casts, contests, partner integrations; also catches FounderPay reroute during 60-day cliff

deploy tx → 0x86627758…771d11

Reserve

0xe804E08364a5dfA09a455eC8dea10dea4988D7EE

15% USDC slice — opportunistic / emergency / unplanned audit findings (memo required on spend)

deploy tx → 0x811de026…3c1fa4

EngagementTokens

0x6012D2ae3d55b195E7e927BC7dccf412FCDAdCd9

Runway-tied % of KEYNOTE-from-renewals — token-denominated contests, bounties, partnerships

deploy tx → 0x67e8f110…a3411c

push splits (2)

0xsplits v2.2 · immutable params · owner = OperationsTreasury

USDC routing (40/30/15/15)

0x812faBe73ed973540865385334bA4107E95EDa60

Receives all USDC inflow (LP fees + Pro USDC subs). Routes 40% to OperationsTreasury, 30% to EngagementBudget, 15% to Reserve, 15% to FounderPay payroll deposit EOA. Owner = OperationsTreasury Safe.

deploy tx → 0x86550aa3…d86037

LP-fee KEYNOTE buyback (85/15)

0x53Ee4a31456B0132B033d538C94b6c2933E14AeF

Receives 20% of LP fees as KEYNOTE (auto-bought-back by Liquid via FeePreference.Liquid). Routes 85% to Pro allocation pool EOA, 15% to staker yield pool EOA. Token-agnostic — does not depend on the specific token contract.

deploy tx → 0x1a66d4bd…8fa5dd

pending mainnet artifacts

deployed in sequence ahead of token launch

·KEYNOTE-from-renewals PushSplit (runway-tier-0; recipients = BurnAddress + EngagementTokens Safe + FounderTokens VestingWallet)
·First Pro-allocation Sablier MerkleInstant campaign (epoch 1)

abandoned artifacts (3)

superseded

on-chain artifacts that were deployed before a design pivot; left here for honest accounting (small gas loss, not in active routing)

founder.payroll Safe0x6cbc62228fe71a2ee90b680c1e8617fa162846b7
Deployed 2026-05-23 as 2-of-3 USDC accumulator; superseded by OZ VestingWallet design same day. No funds, not in routing.
founder.keynote Safe0x77a6dae82faa7e93222c26fba680b6c7b03eaa5a
Deployed 2026-05-23 as 2-of-3 KEYNOTE accumulator; superseded by OZ VestingWallet design same day. No funds, not in routing.
founder.payroll-deposit EOA0x8fF2b30D81Ee6439540424DE9eaF5989da6d2Fcd
Placeholder recipient on the USDC PushSplit's 15% slot. Will be replaced with the FounderPay VestingWallet address via OperationsTreasury Safe `updateSplit` action after VestingWallet deploy post-token-launch.

audit surface (what we wrote vs what we vendored)

Two custom contracts; four vetted primitives. The smallest surface area we could draw and still hit the spec.

on-chain footprint

6 things on chain · 2 are ours

~249 lines of code we wrote · the rest is shared infrastructure with billions in tvl

custom · 2

LecternBoostEscrow

Boost · settle · claim

153 loc · solidity 0.8.28

LecternStakingVault

Stake · tier · discount

96 loc · solidity 0.8.28

vetted primitives · 4

OZ VestingWallet

Founder cliff enforcement

Sablier MerkleInstant

Per-epoch Merkle distribution

0xSplits PushSplit

Revenue routing

Safe 2-of-3

Multisig wallets

smaller audit surface · same economic mechanics · primitives are audited shared infrastructure (oz, sablier, 0xsplits, safe)

live testnet inventory

Base Sepolia · chain id 84532

live

→ live ledger + redeploy workflow at /keynote/sepolia

custom contracts (2)

solidity 0.8.28 · internal review · audit deferred until $500k tvl

LecternBoostEscrow

0x04bfb92807545ce623a2a42d2ce726f12805adb7

boost(castHash, amount) → admin settleEpoch(epochId, root, total) → claim with Merkle proof (12-week window) → admin reclaim of unclaimed after window. Per-cast running totals back the curated-feed ranking.

loc

153

tests

deploy tx → 0x51055b1a…c4a56c

LecternStakingVault

0x0ac9b70d2740159dbda05d7a2ebf03cb6dd91795

stake / unstake. tierOf / discountBpsOf / isProEligible view ABI for LicenseGate.swift dual-source Pro check.

loc

tests

deploy tx → 0x41d69b4c…ced645

vetted primitives (4)

sablier + 0xsplits · same address sepolia + mainnet (deterministic)

OZ VestingWallet OZ 5.x

deploy per-instance (same source)

Founder cliff enforcement — deploy per-instance for FounderPay USDC (60d cliff) + FounderTokens KEYNOTE (12mo cliff). beneficiary = founder cold; start = tokenLaunchTimestamp + cliff; duration = 1s.

mainnet: deploy per-instance from `@openzeppelin/contracts/finance/VestingWallet.sol`

SablierFactoryMerkleInstant airdrops-v3.0

0x863b326Ef7Ce2B82d881931bE577Ba04dd4D58BE

Per-epoch Merkle distribution — weekly Pro allocation + weekly staker yield campaigns. Native 12-week expiration, admin clawback on expiry.

mainnet: 0xD5a361519F6c417Cc4bCfcC15501191C816705a6

PushSplitFactoryV2.2 v2.2

0x8E8eB0cC6AE34A38B67D5Cf91ACa38f60bc3Ecf4

Revenue routing — USDC 40/30/15/15 split, LP-fee KEYNOTE 85/15 split, KEYNOTE-from-renewals per-runway-tier splits

mainnet: 0x8E8eB0cC6AE34A38B67D5Cf91ACa38f60bc3Ecf4

SplitsWarehouse v2

0x8fb66F38cF86A3d5e8768f8F1754A24A6c661Fb8

Failed-send fallback for PushSplit distributions

mainnet: 0x8fb66F38cF86A3d5e8768f8F1754A24A6c661Fb8

mock tokens (testnet only)

mint() is public — grab some for testing

KEYNOTE (mock)

0x20e3d5abce6a1d2c2715fbfc8932edd63fd16613

Test ERC-20 with public mint() — anyone can grab tokens for testnet experimentation. NOT the production token.

USDC (mock)

0xdbfb7f8d30fdcdee51e5bdb4d6ff6a135f28ee2e

Test ERC-20 with public mint() — 6 decimals, mirrors Base mainnet USDC. NOT the production stablecoin.

test coverage

unit tests

across 2 custom contracts

line coverage

100%

every executable line tested

branch coverage

100%

every conditional path tested

invariant runs

16k+

random call sequences

forge test · 52/52 passing. forge coverage · 100% lines + 100% branches + 100% functions across LecternBoostEscrow + LecternStakingVault. forge test --match-contract Invariants · 16,384 random calls per run.

internal security review

in progress

Internal uncertified review · 80% common-vector coverage · formal external audit deferred until $500k tvl

·Reentrancy
·Arithmetic overflow / underflow
·Access control / privilege escalation
·Front-running / MEV
·Denial of service / griefing
·Initialization correctness
·Logic and state-transition bugs
·Storage layout / collision
·Token integration assumptions
·Approval and allowance handling
·External call safety
·Boundary input validation

← back to /keynote spec

sepolia dogfood ledger

redeploy workflow

1.Custom contracts deploy

2.Dogfood 1 — StakingVault

3.Dogfood 2 — BoostEscrow

4.Dogfood 3 — Sablier LockupLinear

5.Dogfood 4 — Sablier MerkleInstant

6.Dogfood 5 — 0xSplits PushSplit

7.Ledger refresh

dogfood flows (6)

why this format

tx

what moved

what it proved

mainnet pre-launch (historical)

Base · chain id 8453

safes (4)

OperationsTreasury

EngagementBudget

Reserve

EngagementTokens

push splits (2)

USDC routing (40/30/15/15)

LP-fee KEYNOTE buyback (85/15)

pending mainnet artifacts

abandoned artifacts (3)

audit surface (what we wrote vs what we vendored)

on-chain footprint

LecternBoostEscrow

LecternStakingVault

OZ VestingWallet

Sablier MerkleInstant

0xSplits PushSplit

Safe 2-of-3

live testnet inventory

Base Sepolia · chain id 84532

custom contracts (2)

LecternBoostEscrow

LecternStakingVault

vetted primitives (4)

OZ VestingWallet OZ 5.x

SablierFactoryMerkleInstant airdrops-v3.0

PushSplitFactoryV2.2 v2.2

SplitsWarehouse v2

mock tokens (testnet only)

KEYNOTE (mock)

USDC (mock)

test coverage

internal security review