Reference

Contracts & security

Five Clarity contracts, deployed and tested on Stacks testnet. Everything a viewer earns and everything a creator pays flows through code you can audit.

Deployed contracts

All five live under the same deployer principal:

ST9NSDHK5969YF6WJ2MRCVVAVTDENWBNTFJRVZ3E

mozoflix-videos — Video registry — id, creator, content hash, thresholds, active flag
mozoflix-rewards-v2 — Escrow + distribution — register-and-fund, distribute-reward, withdraw-pool
mozoflix-creators — Optional creator profiles — display name, bio, verified flag
mozoflix-referrals — Referral graph — attribution + bonus claims
mozoflix-admin — Global config — owner, fee bps, fee recipient, paused

Security model

Written in Clarity. Decidable, non-Turing-complete, no re-entrancy — the class of bugs that drained Ethereum vaults doesn't exist here.
Server signer holds only distribute-reward authority. Its wallet can call distribute-reward from the pre-funded pool but cannot withdraw pools, change fees, or edit videos.
Rate limited. Per-IP and per-wallet token buckets sit in front of the signer so a botnet can't drain a pool via spam.
Withdraw is creator-only. Pool funds always land in the creator's registered wallet — enforced by asserts! (is-eq tx-sender creator).
One claim per wallet forever. A has-claimed map records each viewer's first claim per video; reruns are rejected on-chain, not by the UI.

Testing

86+ Clarinet tests cover happy paths and adversarial cases — double-claim, deactivated video, empty pool, fee math, ownership transfer, admin pause. Source is in the repo.

warningHeads up

Contracts are unaudited pre-mainnet. Testnet STX has no monetary value. Do not send mainnet STX to the testnet deployer address.

Verify a payout yourself

Watch a video past the completion gate.
Click the “View tx” link in the reward toast.
Confirm on the explorer that the tx calls distribute-reward on mozoflix-rewards-v2, and that a STX transfer to your address is in the events.