Official WRST configuration
The official WRST token has not yet been deployed. The whitepaper describes provisional settings; no official mint or live membership configuration has been confirmed. Verified-member access remains disabled.
A token name is not an identity
A name or ticker alone does not identify the official token. When ready, the full confirmed mint and entry requirement must be published prominently here and checked against the configured token program and network.
Wallet sign-in
The prepared flow signs a short-lived message for this exact site and wallet. It does not require a transaction, swap, purchase, transfer, or token approval to sign in. Wallet control and token eligibility are separate checks. WRST never needs a seed phrase or private key.
Membership is checked by the server
A browser success flag cannot grant access. The prepared API checks current holdings before member actions, validates the mainnet network and official mint metadata, and uses exact integer amounts. Permanent member numbers identify history; they do not guarantee current eligibility.
Sessions and community safety
The prepared service uses single-use challenges, HttpOnly sessions, request-origin and CSRF checks, rate limits, private crews, blocking, reporting, and a moderator queue. These controls still require real-provider testing and deployment review before activation.
Promoter pilot access
Approved promoters use separate email/password accounts without a wallet or token. Passwords are stored as individually salted scrypt hashes. Eight-hour HttpOnly, SameSite=Strict session cookies use Secure on production HTTPS, and writes require same-origin and CSRF checks. One-time activation/reset links expire after 48 hours; reissuing access or suspending an account revokes promoter sessions. Administrators independently verify organizer contact and assign individual events. Promoter submissions remain in review and do not publish changes automatically. Ownership claims and profile updates require explicit verified administrator approval. Profile versions and request versions prevent stale reviews; existing ownership cannot be silently replaced. Promoters can withdraw unchanged pending requests, export their own data and revoke all their sessions. Session creation rechecks account access after password verification and bounds active sessions in a transaction. Contact support@wrst.club for manually reviewed recovery or account requests. These implementation controls are not an independent security audit.
Live event corrections
Visitors can report incorrect details on an exact event without a wallet. Reports are private to authorized administrators and do not change listings automatically. The Admin Desk requires allowlisted administrator sign-in for reviewed corrections, artwork uploads and report decisions. Event-report forms use scoped tokens, origin checks, rate limits and duplicate controls. These controls are not an independent security audit.
Reliability and recovery
Encrypted off-server backups and isolated restoration have been tested, including uploaded artwork. Planned reboot recovery has been verified. Chat monitoring currently depends on the operator’s Mac and Codex being available; uninterrupted availability and recovery times are not guaranteed.
Report an issue
security@wrst.club Do not send private keys, seed phrases, or session cookies in a report. WRST Team has accepted moderation ownership. General questions go to support@wrst.club. Reporting is not an emergency service; response times are not guaranteed.