SHELLBOUND

A signal worth following.

A browser expedition. A buried transmission. An armadillo waiting to be discovered.

The idea

SHELLBOUND is an armadillo NFT collection built around recovering a lost underground signal. Players tune a receiver, search three increasingly difficult layers with their own device, and reconstruct a discovery. Mining has no entry fee. A player who completes a valid wallet-bound expedition may then choose to mint up to two NFT with ETH on the configured Robinhood Chain network, while supply remains.

What makes it different

The search is real computation: each layer requires a valid SHA-256 proof linked to the previous layer. The story gives this work a setting: weathered equipment, subterranean outposts and explorers whose shells carry the tools of their trade. Pixel artwork connects the expedition to the collectible.

What the project is not

This mining does not earn a fungible token, validate Robinhood transactions or promise income. NFT ownership carries no promised yield, buyback, revenue share or guaranteed resale value. No additional token, staking system or future reward is committed in this design.

Mint availability

The Receiver displays current mint availability. Minting requires an open, verified collection contract and a completed wallet-bound expedition. Local practice discoveries cannot be used to mint. A published website alone does not mean that minting is open.

The expedition.

Connect. Tune. Search. Recover. Decide whether to mint.

1 / Load a free challenge

Connect an installed Ethereum-compatible wallet and use the configured Robinhood Chain network. Load your wallet-bound challenge from the collection contract. Starting mining requires no entry payment, token approval or transaction. Each wallet needs to complete only one expedition to unlock its allowance of up to two NFT.

2 / Recover three fragments

SURVEY searches for 23 leading zero bits; TRACE requires 24; EXTRACT requires 25. A new layer derives its search seed from the root and the previous verified fragment. The receiver asks the player to retune each carrier, with a one-unit alignment tolerance. Frequency tuning is an interface challenge; the contract enforces cryptographic proofs, not mouse movements.

3 / Manage the search

CPU runs in a background worker; WebGPU is available only on compatible browsers and devices. Players can change workload, pause and resume. Moving to a hidden tab pauses the search. Progress is stored locally and verified again on restoration. Clearing local data, switching browsers or losing the device can lose progress; wallet connection alone does not back up a field log.

Difficulty without a fake clock

The 23/24/25-bit sequence requires approximately 58.7 million candidate hashes in expectation across the three layers. This is an average, not a minimum duration. Luck, hardware, implementation and workload change completion time. Faster hardware has an advantage in finishing; it does not select rarity. Free mining still consumes computing resources and electricity.

3,333 field operators.

Four rarity tiers. One collection. No rarity advantage from mining speed.

Collection allocation

There are at most 3,333 lifetime mint tickets and two lifetime mints per wallet. Refunds and transfers never replenish either allowance. Active supply can decrease after refunds. Common, Rare, Epic and Legendary share one collection. The trusted server draws unused artwork without replacement; mining speed does not select rarity.

Visual identity

The new pixel collection uses consistent armadillo silhouettes, layered shells and clothing, distinct field tools, and detailed underground locations. Common carries practical gear; Rare uses specialist instruments; Epic adds crystal equipment and animated signal accents; Legendary carries exclusive antenna designs, gilded equipment and golden effects. Each NFT combines a coherent set of character traits and underground backgrounds.

Random reveal

Only after a confirmed mint, a trusted server uses an operating-system CSPRNG to select unused artwork and submits it with the authorized reveal signer. This is not trustless randomness and not publicly verifiable VRF. The operator can influence or withhold assignments. The reveal worker persists each unique allocation before submission: retries reuse it, with no reroll. Each artwork can be allocated only once, and an accepted on-chain artwork assignment is permanent. Tokens reveal independently, not through an ordered queue.

Ownership and metadata

Final metadata and artwork must use IPFS. tokenURI appends the assigned artwork ID and .json to the final ipfs:// metadata directory, not the mint token ID. Metadata image and animation paths must reference the final pinned media. Pending NFT use unrevealed metadata and cannot transfer until reveal. Transfers do not reset lifetime mint caps. A wallet is not a person; no human-identity guarantee is made. Marketplace display depends on third-party indexing.

Mine first. Mint by choice.

No entry purchase. An explicit ETH transaction only when minting.

Payment

Mining is free. Minting requires ETH on Robinhood Chain. Each NFT costs US$0.50, converted to ETH using the official ETH/USD price feed on Robinhood Chain (4663). The contract enforces a price-data freshness limit of 86,400 seconds (86400s). Selecting two NFT charges twice the unit quote in one transaction. Review the total and network gas in your wallet before confirming. The reference price is public contract data. If you reject a wallet confirmation, your completed mining record remains available for a later attempt.

One expedition, up to two NFT

The challenge binds the chain, contract, wallet and expedition ID. The first mint verifies all three fragments and records the wallet qualification on-chain. Choose one or two NFT in that transaction. If you mint one, you can claim the remaining slot later without mining again, while supply remains. The contract enforces the two-NFT allowance even when called outside this website. On-chain qualification survives loss of browser storage after the first successful mint. Before that first mint, keep the saved mining record. Mining does not reserve supply.

Failed or delayed transactions

Pending wallet requests are tracked to avoid duplicate payment. Invalid proofs or stale price data revert minting; network gas may still apply. Server reveal is asynchronous and its availability is not a prerequisite for the mint transaction. A confirmed payment can remain awaiting reveal. Check wallet activity when broadcast status is uncertain.

Reveal timeout and refunds

If an NFT remains unrevealed 24 hours after mint, an eligible timeout refund burns it and credits the original payer in ETH. Anyone may trigger the contract refund; the admin interface restricts its operational controls to the current contract owner. Withdrawal is separate. Gas is not refunded. An already revealed NFT cannot be refunded. Refunds never restore the lifetime wallet limit of two or the collection limit of 3,333 mint tickets; mining qualification survives but spent slots remain spent. Accepted excess ETH is credited separately.

Project funds

There is no mining fee and no community prize vault in this project. Only earned mint revenue, recognized after reveal, can be withdrawn to the fixed treasury. Pending refundable mint funds and outstanding ETH credits cannot be withdrawn as treasury revenue. Revenue is not automatically distributed to NFT holders.

Operate with clear limits.

Useful controls, visible state and bounded authority.

The admin panel

Field Control reads lifetime mint tickets, remaining tickets, earned revenue, contract balance, owner, treasury, quote availability and recent NFT records. It identifies the trusted VPS reveal signer and awaiting-reveal records without inventing rarity or claiming worker health. Unknown readings stay unknown. Pages show up to 20 records, not collection-wide analytics or global mining telemetry.

Owner controls

The panel verifies the current contract owner wallet before reviewing mint open/pause/resume, eligible refunds or earned-revenue withdrawals. Those actions still require wallet confirmation. Reveal is automatic on the trusted VPS; the browser offers no manual artwork or rarity selection. Pausing mint does not stop local mining.

Authority in the contract

Only the authorized reveal signer can assign unused artwork to pending tokens. The owner can rotate that signer; browser transactions fail closed if the current signer differs from the published release. Eligible timeout refunds are permissionless. Revenue withdrawals always pay the fixed treasury. The panel restricts operational controls to the current owner. Signer rotation and ownership transfer are not exposed by this panel.

What admin cannot change

The supply cap, lifetime wallet cap, proof requirements, mint price reference, treasury and metadata locations are fixed at deployment. There is no browser rarity selector. However the trusted reveal signer can influence artwork assignments before on-chain reveal, and the owner can rotate that signer. Already accepted assignments cannot be changed. The private admin password gate supplements, not replaces, contract authorization.

Known trust boundaries

The server operator and reveal key are trusted for unbiased selection, secure persistence and timely delivery. They can influence or withhold assignments; on-chain authorization does not prove honest random sampling. Browser storage is not authoritative. This release has no automated sequencer uptime check or post-recovery grace-period guard. The 86,400-second (86400s) freshness limit does not detect sequencer outages or provide a recovery grace period. The owner can manually pause minting, but manual pause does not replace an automated sequencer uptime/grace guard. Sequencer-related pricing risk remains even when a quote passes the freshness check. Price-feed reliability, key security and IPFS availability remain dependencies. Automated tests are not an independent audit.

Availability and verification.

Progress by verified milestones, not invented dates.

Availability

The Receiver is the source of current mint status. It distinguishes closed minting, paused minting, available minting and exhausted supply. Connect your wallet to check your remaining allowance. A completed expedition unlocks a maximum of two NFT; it does not guarantee availability or reserve a place in the collection.

Production deployment

The collection contract is deployed on Robinhood Chain (4663); its runtime has been checked and its source verified on the explorer. Source verification is not an independent security audit. Reveal uses server-trusted-csprng-v1 mode, not an external randomness subscription. The Receiver reports current mint availability; publication of this document does not itself open minting.

Prelaunch testing

Prelaunch mint/reveal testing used read-only mainnet simulation and a local mainnet fork. There were zero preliminary production mints. These checks are not actual wallet-extension acceptance or live mainnet mint acceptance, and this document does not claim either. Independent security review remains recommended.

Verification scope

Tests cover bound proofs, quantity and lifetime caps, pending-payment recovery, independent reveal and refund accounting. Simulated and local-fork results do not establish live oracle reliability, unbiased server operation, IPFS durability, actual wallet-extension prompts or live mainnet mint acceptance. No preliminary test result should be presented as a production purchase.

Document version

This release edition describes server-trusted CSPRNG reveal after confirmed mint and non-replenishable lifetime allowances. Check The Receiver for current mint availability. The website address is temporary; the owner will configure the purchased domain and DNS separately. Older downloadable PDFs have been retired because they describe superseded randomness and refund rules. Use this online edition until a new PDF is regenerated and reviewed.