Developer reference

Evidence

A transaction-by-transaction ledger of everything Trimmy has done on Flare Coston2, including the refusals that cost no gas.

Working with an agent? Every page here has a markdown twin, the whole site is one file at llms-full.txt, and trimmy-mcp lets it read live rules and compose a payment it cannot send.

Testnet. Trimmy runs on Flare Coston2. Nothing described here has run on Flare mainnet, and no page on this site describes real money.

Scope

Everything here is on Flare Coston2 (chain ID 114). Nothing has run on Flare mainnet. Each figure is recorded in docs/GROUND-TRUTH.md with the command that produced it. Hashes ending in … are truncated there; the full 32 bytes are unrecorded.

The XRPL armed path

One XRPL payment. No EVM wallet, no FLR held. Deployment Trimmy 0x19F81AAB43f7a26B0659754b70179aDcAF43ef7C, 2026-08-09.

An earlier run put keeper and user on one address: the split showed only in the event log.

The same path ran on 2026-08-07 on an earlier deployment, untruncated: XRPL E41504D3356C15789D4B6602F0F2E8B151F04FFAA5BBF2E3F71640C92B59B6E0 (ledger 19698983), FDC 0x0a3f05f72f9425f93ff64290d862ffc6498e82e0dfb7a6f7e57448ea035a82d9 (round 1418293), execution 0x86d54bd6821b7598cde03d68f0e1642da1b4714a52e91e445396095bc12cf6cc (742,307 gas), keeper 0xa74e9fc270bef95449e5821c0403c26b28c00b095d0e7b7a25bc2496e18a37b1. The allowance it set was 1,009,400: exact, never unlimited.

The public executor never acted. Two arming payments, both tesSUCCESS, both watched 600 s: C122663D…326104 at executorFeeUBA = 0, and E41504D3…59B6E0 at executorFeeUBA = 100,000. Neither was picked up: a full fee was offered and the 0xFE branch still ignored, so we run our own executor.

Execution against a vault that is not ours

TESTearnXRP 0x9E63a5D282F2fBb7DcE822B98e363b2719D28319, a third-party vault, share price 1.05917. Trimmy 0xf73a2af0…, 2026-08-07, the M-1 vulnerable build (see provenance).

FXRP 23.150001 → 22.150001. Vault shares 0 → 944,133, exactly previewDeposit(1 FXRP), credited to rule.account and not the caller.

A separate keeper 0xF0533D37F7ed8d1C45A87Bb35750DA4665bd6D9E, funded with gas and given no authority, executed rule 2 in 0x50ef27fd67464424b23687b740df65d2aa7d729d8b3df16deb314173f244a720: user shares 1,888,266 → 2,822,999, keeper shares 0 → 9,400. PersonalAccount.executeUserOp is onlyController: selector 0x2b2ee783 reverts OnlyController() 0x59907813 for anyone else, so a leaked keeper key drives nothing.

The live swaps

Pool 0xafcA1C5DfF08b3B8Bacb7721fb8189d2D8E7C3DB, FXRP/WC2FLR, fee tier 3000. It is ours and it is thin: 0.305637 FXRP and 49.999999996 WC2FLR at L = 155,310,565,707,002. Coston2 had no FXRP pool beforehand (80 getPool calls, 5 factories x 4 counter-tokens x 4 fee tiers, all address(0)).

Row 1's oracle fair value was 0.01 x 170.9222 = 1.709222 WC2FLR. The model predicted 38.4 bips beforehand; the chain returned 38. The tick moved 327738 → 327721 and the pool's FXRP balance rose 305,637 → 315,637, exactly the sale.

The three refusals

The refused rows are the best evidence here.

They cost nothing. Each died in the keeper's eth_call pre-simulation, so the keeper signed none of them. A rule that cannot execute costs an RPC round trip.

They refuted our own first diagnosis. We assumed depth was binding, deepened the pool 2.66x from 1.553e14 to 4.126e14, and were refused again. Computing the floor exactly showed the pool at 170.6357 against an oracle of 171.2618: 36.6 bips below, from row 1's own impact plus an FTSO move. With the 30-bip pool fee on top, no trade size fit inside the declared 50 bips. Staleness was binding, not depth, and a testnet pool has no arbitrageurs. Re-centring by hand (tx 0x38b77fff…) restored the peg and the same rule filled at 170.734 against 170.83.

The ledger counts three refusals across rows 2 and 3, then one fill at 5.6 bips once the venue was priced honestly. A stale venue gives a refusal, never a bad fill.

The confidential path

The threshold 1100000 appears nowhere on chain.

The enclave is a real GCP_AMD_SEV machine, 0xB33E5CF59e3ce1D58427B9F4E23d0444c128D3D7, not the simulated sentinel 0x194844cf417dde867073e5ab7199fa4d21fd82b5dbe2bdea8b3d7fc18d10fdc2 shared by 254 of Coston2's 268 active TEE machines. Only the first four bytes of its code hash are published (0xe9ab7410…). The full 32 bytes are not.

PRIVATE costs 517,962 gas against 383,451 for the plain path. The first attempt (0x486c9122…) ran out of gas after emitting Executed, so eth_estimateGas is unsafe here; the keeper sends an explicit limit.

Two free refusals against the fixed trigger, both cast call: a genuine enclave signature over a genuine fire verdict is rejected with NoEvaluationRequested(0, 7) (0xe6cf311f) because nobody asked it, and the caller-supplied-price entry point requestEvaluation(uint256,string,uint64) no longer exists. Regression: VerdictBinding.t.sol, 8 tests.

PRIVATE's trust model is strictly weaker than the other three triggers. It needs an enclave running, and its operator can censor a rule by declining to act. Not trustless.

Provenance

CREATE transactions and constructor arguments, from contracts/broadcast/.

tokens_  [(0x0b6A3645c240605887a5532109323A3E12273dc7,
           0x015852502f55534400000000000000000000000000, 6),   // FXRP, XRP/USD
          (0xC67DCE33D7A8efA5FfEB961899C73fe01bCe9273,
           0x01464c522f55534400000000000000000000000000, 18)]  // WC2FLR, FLR/USD
venues_  [(0xe2B3aE21461c4ad3415210630EA210e9F53CCEBc, 0, 3000),  // SwapRouter
          (0x9E63a5D282F2fBb7DcE822B98e363b2719D28319, 1, 0)]     // TESTearnXRP
maxFeedAge_            64
protocolFeeRecipient_  0x38d58d1BEA8FF21fd8397494f17F64A99bcF8E83
confidentialTrigger_   0x02EA709e2278EACDbA00D4A88caA604E3b35293b

The whole action surface: two tokens, two venues, written once in src/Trimmy.sol's constructor. No setter, no owner, no upgrade path.

Superseded deployments, left on chain:

Non-upgradeable, so every fix is a redeploy: arm()'s selector moved from c33d4cc3 to cc0c55f4 when the price fields widened. Regressions for the two money bugs: M1Verify.t.sol (7 tests) and M3Regression.t.sol (4 tests), with 66 core tests green. test/research/ holds exploits, many written to fail, so no pass ratio is quoted.