Solslot's protective design vs the three drain classes: Omnichain contracts are non-upgradeable (Ownable2Step, no TransparentUpgradeable) — cannot swap out settlement logic even with a Safe compromise Every cross-chain message binds (originChain, originSpoke, canonical-hash) — codec re-encodes and hash-compares (defeats parser divergence) BLS multi-sig uses is-sorted-strict + no-duplicate + range check at every site — one hot key ≠ supermajority Redemption treasury is non-withdrawable — one atomic split with sum-invariant and signed allocations root NAV is a single-signer governance registry, not an announcer quorum — no oracle-collusion surface Admin identities key on immutable launcher IDs; recovery uses slot-sum invariant so the same identity cannot double-sign Release SHA: 24c1d50 (protocol) · f5eaf9c (api) · d2ccc0a (evm) · 392e5e3 (omnichain)