Built so there is nothing to steal from you here.
CULET reads the chain. It does not hold funds, it does not need your wallet to grade a pool, and the few transactions it can build only ever remove permissions. Every claim on this page can be checked from your own browser.
Ask for a recovery phrase or private key
No page has a field for one. Anyone asking you to type a phrase into a website is stealing it.
Ask you to sign a message
There is no sign-in. Grading and permission checks are read-only and need no wallet at all.
Ask for an approval
CULET never builds approve with an amount above zero, and never asks for permit signatures.
Remember your wallet
A wallet connection exists only to send a revoke. It is not stored; reload the page and it is gone.
The only transactions this site can create are approve(spender, 0), setApprovalForAll(operator, false) and Permit2.lockdown([(token, spender)]). Each is shown in full, with its calldata, before your wallet opens. The code that builds them ↗
How the site is locked down
These controls are enforced by your browser from the headers this server sends. Open developer tools, select any request, and read them.
Scripts may only come from this domain. The page may only talk to the Robinhood Chain RPC endpoints, Blockscout and Sourcify listed in the policy. It cannot send data anywhere else, even if a script tried.
checking…No analytics, no trackers, no CDN. three.js, ethers and the fonts are served from this domain, pinned to exact versions, and listed in the integrity manifest.
by designframe-ancestors 'none' and X-Frame-Options: DENY stop another site from embedding CULET to trick clicks.
HSTS with a two-year lifetime, so browsers refuse plain HTTP to this domain.
checking…Addresses you check are never leaked in a Referer header. Camera, microphone, location, payment and USB are disabled by policy.
checking…Pool grades and permission checks go from your browser straight to public infrastructure. The server serves files and published datasets only.
by designVerify every file
The server publishes a SHA-256 fingerprint of every HTML, script, style and font it serves at /integrity.json. If a file were changed without a new manifest, the fingerprints would stop matching.
curl -s https://culetlab.com/src/chain.js | shasum -a 256 # compare with "files" → "/src/chain.js" in https://culetlab.com/integrity.json
The simulator itself is checked against real execution: six fork tests, including a token with a hidden 5% transfer tax and a token that refuses sales, both caught exactly.
Official channels
The only official places for CULET are listed here and in every page footer, all from one configuration file. A contract address is published on this site and on X first. Anything else claiming to be CULET, including direct messages offering help, is not.
Incident briefing
Recent wallet drains, what actually happened, and what helps. Summaries are written from the linked reports; figures may still change as investigations continue.
Ledger devices sold through one reseller (CryptoBilis)
- Ledger says all confirmed losses involve devices sold through the reseller CryptoBilis. Its Donjon lab describes an implant in one device that read the 24-word recovery phrase from the screen during setup and sent it out over a built-in SIM.
- On TRON, 25 wallets signed the same USDT approval to the same address within three seconds, and about $29M was pulled within six seconds of the first. The thief had tested the same approve-and-pull pattern for two weeks beforehand.
- One victim lost 70,000 USDT more after the drain, because the thief still held the key to the drained wallet.
What helps: buy devices only from the maker or authorised sellers; never use a device that arrives opened or with words already written; move funds to a new wallet with a new phrase if in doubt; then check and revoke permissions on the old one. Revoking alone cannot protect a wallet whose phrase is known to someone else.
UNCX Vesting V2 accounting flaw
- A bookkeeping flaw in the shared VestingManager let an attacker withdraw tokens backing other users' deposits. No private keys were compromised.
- On Robinhood Chain, the CASHCAT and RKST tokens were affected. UNCX advised against trading in affected pools until each token team issues guidance.
What helps: before trading an affected token, grade its pools to see current liquidity and whether a round trip still completes.
Pools that take most of a swap
- 345,781 of 1,076,574 Uniswap v4 pools on the chain were created with a fee above 50% per swap.
- 2,132 swaps in the last 24 hours paid such a pool more than half of what they put in.
How risk is scored
The permission check uses five plain rules, applied in this order. They are deliberately simple so that you can predict them.
The allowance is held by a plain wallet, not a contract. No legitimate app needs this; it is the approve-then-pull pattern seen in recent drains.
revoke nowAn unverified contract with an unlimited allowance, or an upgradeable contract with an unlimited allowance.
revokeA verified contract with an unlimited allowance, or an unverified contract with a limited one.
reviewA known contract such as Permit2 or the Uniswap v4 PoolManager, or a verified contract with a limited allowance.
fineIf any token could not be read, the result is marked incomplete and no "clean" verdict is shown.
retryReport a problem
If you find a security issue on this site or an error in a grade, message @culetlab on X or the Telegram channel listed above. A machine-readable contact is published at /.well-known/security.txt. Please do not post exploitable details publicly before they are fixed.