Every coin on Stag Hunt lives inside an on-chain Kaspa covenant— a tiny program compiled into the very UTXO that holds your KAS. It can do exactly two things: pay the winner when a hunt is delivered, or refund you when it isn't. No admin key. No custodial wallet. No third path.
The platform holds no keys that can move funds. Your coins sit in a P2SH covenant address the moment you contribute — governed only by the script.
The refund branch needs no signature and no server. If every referee — and Stag Hunt itself — vanished tomorrow, you could still reclaim your funds after the deadline.
The payout branch can only pay the verified winner. There is no fee output the script will accept, so no cut can be skimmed on-chain.
Every hunt exposes its compiled redeem script, quorum, and refund DAA. You can verify the exact rules before committing a single coin.
When you back a hunt, Stag Hunt compiles a redeem script just for you and hands you its P2SH address. Your KAS pays straight into it.
From this moment the coins can only move the way the script allows. Baked in: your refund address, and the frozen M-of-N referee committee.
The winner is paid by an M-of-N Schnorr multisig of the hunt's frozen referee pubkeys. The threshold is a simple majority — M = floor(N / 2) + 1 — so a 5-referee hunt needs 3 signatures, a 3-referee hunt needs 2.
Referees sign partial signatures off-chain. Once M of them exist, anyone can assemble and broadcast the release transaction — the referees never need to be online at the same moment, and no coordinator holds the funds.
Guarded by OP_CHECKLOCKTIMEVERIFY against a fixed Kaspa DAA score (the deadline). Before the deadline this path is dead; after it, it opens to everyone.
The script then pins the output: the refund transaction must have exactly one output, and that output's script must equal the address you committed at fund time. So even though anyone may broadcast it, the coins can only ever land in your wallet.
This is the actual covenant compiled for every contribution — an OP_IF / OP_ELSE switch. The spender pushes a boolean to pick a branch. Nothing else can move the coins.
OP_IF ; ── PAYOUT: refs co-sign a release ── OP_<M> <pk₁> <pk₂> … <pk_N> OP_<N> OP_CHECKMULTISIG OP_ELSE ; ── REFUND: permissionless after deadline ── <T_hunt_end_daa> OP_CHECKLOCKTIMEVERIFY OP_TXOUTPUTCOUNT OP_1 OP_EQUALVERIFY ; exactly one output OP_0 OP_TXOUTPUTSPK <backer_spk> OP_EQUAL ; …paying only you OP_ENDIF
OP_CHECKMULTISIGVerifies M valid Schnorr signatures against the N frozen referee pubkeys. Pubkeys are sorted KIP-39-canonically so signatures line up with the redeem's iteration order.
OP_CHECKLOCKTIMEVERIFYBlocks the refund until the chain's DAA score passes the deadline. Kaspa's CLTV consumes the locktime operand — no trailing OP_DROP, unlike Bitcoin.
OP_TXOUTPUTCOUNT · OP_1Forces the refund transaction to carry a single output, so no sneaky extra output can siphon change elsewhere.
OP_TXOUTPUTSPK · OP_EQUALIntrospects the spending transaction and asserts output 0 pays the exact script pubkey you committed. This is what binds the refund to your address.
M = floor(N / 2) + 1OP_CHECKLOCKTIMEVERIFY on a Kaspa DAA score (8-byte LE u64)520-byte element limit (grows ~33 bytes per referee)Because reviewable code holds the money instead of a company, the safety of your funds rests on math you can audit rather than a promise. On any hunt, open View the on-chain covenant to inspect the committed referee committee, the exact quorum, and the refund DAA — before you contribute a single coin.
Browse hunts →