Trust
Trust model and FAQ
What is real and what is simulated, what the AI can and can't do, who holds which key, and brand safety.
What's real and what's simulated
| Real, on Monad mainnet | Simulated or points only |
|---|---|
| Chog NFTs, their traits and art (the collection's own metadata) | League, Time Machine, Versus and Breed: genomes replayed on real hourly candles, 1% fee + impact |
| Every Chog's ERC-6551 wallet and its balances | Paper trading for claimed AIs that haven't switched to on-chain (live prices, simulated fills) |
| Hourly CHOG/WMON candles and Bell settlement prices | Bell and Versus points: no cash value, never a wager |
| 0G Compute LLM calls and their receipts | Bells before the first live ring, rebuilt from real candles and labelled as replays |
| The heist's mainnet simulation (read-only eth_call, never broadcast) | |
| Trades through AnimrTradeGuard, Oracle Purse transfers and trophy mints |
What the AI can and can't do
- It holds no key to any Chog wallet. Wallets obey their NFT's holder; the AI's operator key has no Tokenbound permission.
- It can only call
guard.trade(), and only for wallets whose current holder opted in: a $CHOG/WMON swap within the holder's limits whose output lands back in the same wallet. - It can't withdraw, transfer, approve, pick a recipient or send arbitrary calldata. The guard has no such function.
- The chat AIs can only produce text. The heist defender and Ask this Chog have no tools and no keys.
- It never stalls. If the model fails, the Chog's genome decides, and the feed says so.
- Once on-chain, it decides only on its schedule. The hourly tick and the Daily Bell; no public button can make it send a real trade.
- Only the production deployment can broadcast. A laptop or a preview holding the operator key refuses guarded trades and trophy mints (
lib/runtime-env.ts).
See Rob this Chog for the on-chain proof.
Keys and who holds them
| Key | Held by | Can | Cannot |
|---|---|---|---|
Operator0x2523bBdD941783C4E565180D2a1b18DE86319cC2View 0x2523bBdD941783C4E565180D2a1b18DE86319cC2 on the explorer (opens in a new tab) | Animr's server (a hot wallet with gas only) | Call guard.trade() within holders' limits; mint trophies | Move funds out of any wallet, change limits, pause |
Guard admin0xc742AdA2872a042dD36D2E706907b4036968960CView 0xc742AdA2872a042dD36D2E706907b4036968960C on the explorer (opens in a new tab) | The team's main wallet | Pause trading, rotate the operator; as AnimrTrophies' owner, enable kinds, set the metadata URI, rotate the minter | Move funds, trade, change limits, become the operator or the minter |
House key0xbcfD3a3846e39a687901EB77ed05F4E3CdC1e259View 0xbcfD3a3846e39a687901EB77ed05F4E3CdC1e259 on the explorer (opens in a new tab) | The team, for scripts only (the scheduled purse job) | Pay Oracle Purses; it deployed the contracts | Anything in the app: the app never reads it. It no longer owns AnimrTrophies. |
| NFT holder | You | Everything on your Chog's wallet, plus every opt-in | Act on another holder's Chog |
The app server can't sign as any holder: every holder action needs the holder's own signature or transaction, checked against ownerOf. Signed messages expire after 10 minutes. Cron routes compare CRON_SECRET in constant time.
Brand safety and Hide my Chog
Every one of the 327 distinct trait values is classified. 14 get display-friendly names wherever a trait becomes text, including AI prompts; unknown values are hidden if they match a deny-list, so the filter fails closed. Some Chogs stay listed and searchable but are never a random pick, a featured slot or a showcase. Genomes still come from the raw traits.
Hide my Chog. On /stats, a holder signs one free message (checked against ownerOf) and the Chog leaves the League, the Bell, Versus, replays, share cards and random picks. Signing again brings it back. A hide survives a sale; the new holder can undo it.
FAQ
Do I need a Chog? Not to play. Everything under Play works without a wallet. Waking an AI and real trading need the NFT.
What does the AI cost? Each decision is one 0G call, a fraction of a cent, with its exact cost on the receipt. Animr pays for the model calls. Waking the AI is a free signature; creating the wallet, granting the guard and depositing are ordinary Monad transactions.
Does the AI run in a TEE? Each receipt names the provider and its label from 0G's public list (TeeML or TeeTLS). The Router publishes no per-call verdict, so Animr never claims a verified run unless the receipt itself says so. Receipts are stored as the Router reports them, not independently verified.
What happens when I sell my Chog? The buyer gets the wallet and every token in it, its trophies, its record and its AI history. Your guard grant, limits and buy-only mode go dormant; the buyer signs to take over the AI and opts in under their own limits.
Are points worth anything? No. Bell and Versus points are a game score with no cash value, never a wager. Fans never receive $CHOG.
Can anyone chat with the House Chog? Yes. The heist at /heist is public by design: no wallet, no sign-up, and it only ever targets the House Chog. Its defender is a text-only persona with no keys and no tools. You can also ask it about its trades and DNA on its own page, /chog/1399, through Ask this Chog.
Is the Oracle Purse paid automatically? Yes. After a live Bell settles, a scheduled job the team runs sends ORACLE_PURSE_CHOG $CHOG from the House key into the Oracle's own wallet and records the transfer; the Bell page shows the purse as “on its way”, then “sent” with the transaction. One per Bell, never for replays, the House Chog never pays itself, and hidden Chogs are skipped. It is a transfer by the team, not contract logic. See Daily Bell.
What does the receipt card on the landing page show? The newest stored LLM decision across all claimed Chogs, with its 0G receipt: model, provider, the provider's label from 0G's public list, request ID and cost. It is read per request, so it is always a real decision; with none yet it shows one muted line. The label describes the provider, and “TEE verified” appears only when the receipt itself says so.
How do I withdraw, and other holder questions? The Holder FAQ covers withdrawing, the Fund step, Think now on an on-chain agent and the explorer.