How Kitty works

A room is a group chat. A pledge round is a small contract that holds the room's pot. The admin can only spend that pot by buying the agreed token, and everyone ends up with the same average price.

A round, start to finish

The admin opens a round and fixes the rules: what may be bought, the step schedule, the guards, the deadlines. The rules are written into the round contract when it is deployed and can't be changed afterwards.
Members pledge USDC. Until the first buy, anyone can withdraw part or all of their pledge, at any time and for any reason.
The admin names the token (unless the address was fixed at creation). This starts the review window. While it runs nobody can buy, and members can check the contract, withdraw, or veto.
The admin buys in steps. Each step spends its fixed share of the pot through the allowlisted DEX, path USDC → token, straight into the round contract. The first buy closes pledging. After that, pledges are locked until the round ends.
The round finalizes after the last step, when the admin stops early, after the buy deadline, or after a 24-hour stall past the cooldown. Every member then claims bought × myPledge / pot tokens plus unspent × myPledge / pot USDC. Everyone gets the same ratio, so everyone pays the same average price.

Guards

Each round mixes and matches these. The factory refuses unsafe combinations.

Guard	What it does	Why
🔤 Ticker lock	The token's on-chain `symbol()` must equal the plaintext ticker, e.g. `PEPE`. Checked when the target is proposed and at the first buy.	Stops "oops, wrong coin".
✅ Verified list	The token must be on the curated registry, and must have been listed before the round was created. With the ticker lock on, the registry's ticker must match too.	Anyone can deploy a fake "PEPE". The list pins the real contract, and a later listing can't sneak a new target into a live round.
🎯 Exact address	The token is fixed when the round is created. It can never be re-proposed.	The strictest mode.
⏱ Review window	No buy until this long after the target is named. Required (at least 10 minutes) whenever the address isn't fixed.	Gives members time to look before money moves.
✋ Veto	If members holding X% of the pot veto the target, the round cancels and everyone is refunded. Required whenever the address isn't fixed. A veto only counts pledges made in an earlier block, so a flash loan can't cast one.	The group, not the admin, has the last word on an open target.
💲 Max price	Required. A step reverts if its average fill is above this many USDC per whole token.	Stops anyone, the admin included, from pumping the pool right before the group buys.
↔ Max slippage	The admin's minimum output must be within this % of the live quote.	Stops the admin accepting a terrible fill.
💧 Min liquidity	Blocks buys into pools holding less USDC than this.	Thin pools are where rugs live.
Caps	Min raise, max raise, per-wallet cap.	The round fails cleanly if not enough is raised.

Who can do what

Role	Can	Can't
Room admin	Open rounds, name the target, pick when each step runs and its minimum output (within the slippage + max price), stop early, cancel before the first buy.	Withdraw the pot, send tokens anywhere, change the rules, change the DEX, buy above max price, skip the review window.
Members	Pledge, withdraw before the first buy, veto, claim, close a round after a deadline or a stall.	Withdraw after the first buy (the money is committed to the plan).
Factory owner	Allowlist DEX routers and base tokens for new rounds.	Touch any existing round.
Registry curator	List or delist tokens. A delisting before a round's first buy blocks that buy, and members can still withdraw.	Open a new target in an existing round, or freeze a round that is already buying.

Known limits

The max price is the real price protection. The admin can still time a buy anywhere up to the ceiling, so pick a ceiling you're comfortable paying.
Tokens with a transfer fee or rebasing supply aren't supported. Keep them off the verified list.
The per-wallet cap is per address. Someone with several wallets can get around it.
Rounding dust (a few wei) stays in the round contract.
This is a test network with test tokens. The DEX is a minimal Uniswap V2-style AMM using the same interface as V2.

Contracts

Audit

Audit of 2026-11-08 on commit 4c4f991. Findings were fixed in 393b574. A separate reviewer then tried to break those fixes and found three more gaps, which were fixed in 80f5a4a. Each Medium+ finding has a proof-of-concept test that now asserts the attack fails. Full report · Fix tracker · System map

ID	Severity	Finding	Status
KR-1	High	Slippage floor and min-liquidity were read in the same tx, so an admin could pump → buy → dump.	Fixed: max price is required
KR-2	High	A zero review window let an admin propose and buy a same-ticker fake in one block.	Fixed: open targets need ≥10 min review + veto
KR-3	Medium	Flash-loan pledge → veto → refund could cancel any round for free.	Fixed: vetoes need a pledge from an earlier block
REG-1	Medium	The registry curator could freeze running rounds or add new targets to them.	Fixed: listing snapshot at round creation; checked at proposal + first buy only
KR-4	Low	An admin stalling after step 1 locked funds until the deadline.	Fixed: anyone can close after a 24h stall
KR-5	Low	Re-proposing the same token reset vetoes; a veto passed via withdrawals wasn't enforced right away.	Fixed
KR-6	Low	A token with a mutable symbol could halt a ticker round mid-buy.	Fixed
INT-1	Low	The testnet deployer was the public dev key.	Fixed: private deployer key
FR-1	Medium	Fix review: a pledge held for one block could still veto, and withdrawing could tip a veto.	Fixed: veto weight is a snapshot from when the target was named
FR-2, FR-3	Low	Fix review: a 100% veto threshold; registry re-listing and same-second listing.	Fixed: veto capped at 70%; no re-listing; strict snapshot
KR-7…10, FAC-1, DEX-1	Info	First buy closes pledging; dust; fee-on-transfer tokens; per-address cap; single-key factory owner; test DEX scope.	Documented above