Mechanics & risks
Read the rules
before you play.
raffle.fun is a fixed-outcome protocol, not a promise about the value, authenticity, or legality of any prize. This is the complete mechanic in plain language.
The mechanic
One prize. Equal $1 entries. One immutable reserve.
A sponsor deposits exactly one ERC721. Sales begin immediately, every entry has the same chance, and each purchase mints one ERC721 ticket containing an inclusive range of entry numbers.
Prize escrowed
The factory deploys and initializes a fixed-implementation minimal clone, then deposits the exact NFT atomically.
$1 entries sold
Any positive entry count is bought in one O(1) purchase. The ticket gets the next sequential ID and its range is stored separately; sales remain open until the fixed end time.
One random draw
After close, Chainlink VRF chooses one entry from 1 through totalEntries inclusively.
totalEntries ≥ reserveEntries
Reserve met
- Settlement records the NFT for the current winning ticket owner
- Settlement records 5% of gross sales for the protocol
- Settlement records the remaining 95% for the sponsor’s fixed recipient
totalEntries < reserveEntries
Cash fallback
- Settlement records 80% of gross sales for the winning ticket owner
- Settlement records 5% for the protocol
- Settlement records 15% plus the NFT for the sponsor
If nobody buys an entry
The sponsor can put an empty raffle into Refunding immediately; anyone can do so after its sale deadline. Refund liability is zero, and anyone can return the NFT to the sponsor’s fixed recipient.
If randomness is unavailable
A sold raffle accepts a permissionless draw request from sale end until its request deadline two days later. If none succeeds before that hard cutoff, anyone can open full refunds. An accepted request gets a fresh two-day callback window; callbacks resolve only before its callback deadline, and refunds open at that deadline. No sponsor proceeds or protocol fee is earned. Current owners burn up to 100 tickets per call and receive $1 USDC for every entry in each stored range; anyone can return the NFT to the sponsor’s fixed recipient. Any valid earlier callback is final and has no later refund timeout.
Exact economics
Every entry is exactly $1 USDC.
One 5% fee is deducted from aggregate gross sales, never added at checkout. Settlement records the winner, sponsor, and protocol claims without moving an asset; the winning ticket's owner later burns it to redeem atomically.
Gross pot
$1 × totalEntries
Protocol
floor(gross pot × 5%)
Distributable
gross pot − protocol
Reserve met: 120 / 100
- Gross sales
- 120.00 USDC
- Protocol fee
- 6.00 USDC
- Distributable pot
- 114.00 USDC
- Winner
- NFT
- Sponsor
- 114.00 USDC
Reserve missed: 80 / 100
- Gross sales
- 80.00 USDC
- Protocol fee
- 4.00 USDC
- Distributable pot
- 76.00 USDC
- Winner
- 64.00 USDC
- Sponsor
- NFT + 12.00 USDC
Purchases never allocate fees, and a VRF result records only the outcome and winning entry. Settling the winning ticket allocates the winner, sponsor, and protocol balances without paying or delivering an asset. The current ticket owner burns it while receiving the winner’s cash or NFT in one transaction.
Randomness & settlement
The callback decides; it never sends assets.
A raffle permits exactly one Chainlink VRF v2.5 request with 30 confirmations. Resolution stores only the winning entry and result, then stops. The callback never searches tickets or transfers assets.
Verifiable draw
Chainlink VRF delivers proof-backed randomness to the same independent raffle through the authenticated direct-funding wrapper.
Ticket proof
The caller supplies a ticket ID. Its separately stored first and last entries prove in O(1) whether it contains the winning entry.
Bearer redemption
Anyone may settle the result, but only the winning ticket's current owner can burn it and redeem. Sponsor and treasury releases still use their fixed addresses.
Oracle delivery is not instantaneous and no replacement request is allowed. Draw requests must be included before the two-day request cutoff. A request at the last valid second starts a fresh two-day callback window, so the maximum nominal wait is almost four days after sale end. Matching callbacks resolve only before their callback deadline; at the deadline they are ignored and refunds are available, even if nobody has opened refunds yet. Only wrapper-authenticated, ABI-decodable calls reach that ignore logic. Anyone may settle the winning ticket without fixing its owner. The ticket remains transferable afterward; whoever owns it when it is redeemed burns it and receives the prize atomically.
Entries & ticket ownership
Ranges keep large purchases simple.
A ticket can represent one entry or an enormous contiguous range. It remains transferable in every raffle state, including after settlement, until successful winner redemption or a refund burns it.
Odds
Your entries ÷ totalEntries. Every entry from 1 through totalEntries is eligible, without minting or iterating once per entry.
One-entry case
Entry #1 wins. There is no zero modulo and no off-by-one exclusion.
High reserve
It cannot make the raffle insolvent. It only changes which settlement branch is more likely.
No sales cap
Meeting the reserve does not close sales. Entries remain available until the published end time. The only technical total is uint128, not a meaningful product cap.
Trust model
Know what code can—and cannot—protect.
The factory and every ERC-1167 raffle clone are ownerless and non-upgradeable. Creation cannot be paused, and the treasury and protocol dependencies are immutable.
Ownerless factory
- Raffle creation remains permanently permissionless
- No owner, role, pause, upgrade, or rescue function exists
- Treasury, implementation, USDC, and VRF settings are fixed
No administrator can
- Change any raffle’s reserve, fee, timing, or quote token
- Change the factory treasury, implementation, or VRF wrapper
- Choose a winner, request another result, or upgrade a raffle
- Seize the prize, settlement pot, or user balances
- Pause an existing raffle or its settlement
Important risks
- The protocol is unaudited. Tests and analysis are not an independent audit.
- Prize NFTs and metadata can be counterfeit, mutable, malicious, or worthless.
- Production factories trust the chain's canonical official USDC and use SafeERC20 without redundant balance snapshots. Circle may still upgrade, pause, freeze, blacklist, or otherwise prevent later claims.
- Deadlines bound protocol liveness, but cannot overcome a halted chain, censorship of recovery calls, or lost keys. A reorganization or censorship that prevents a request or callback from being included before its hard cutoff can force refunds.
- The subgraph can lag or fail. Direct chain state is authoritative.
- Chance-based prize systems may require jurisdiction-specific legal review. This software does not provide regulatory compliance.