The Paddock Society — Disclosure

The honest fine print.

Everything worth knowing before you hold, mint, check in, or send — written plainly, because a society built on showing up shouldn't hide anything in legalese.

The council's review — the meme's provenance, the platform, the business model, and the security work behind it.

1 · What this is right now

An early build, and growing. The membership registry, laps, check-ins, and the team grid are live and real; the full app is still being built. Where this goes: venue check-ins, streaks, and the leaderboard grow into the full app, then the economy phase (redemptions, gear drops) — with the prize being race day at the championship's first weekend. Features can change, move, or be reset as the app grows.

2 · The token, plainly

$WEN is a memecoin — extremely high-risk, and most memecoins go to zero. Nothing on these pages is financial advice, an offer, or a recommendation to buy anything. Membership and perks are access and rewards, not income, yield, or any promise of value.

The founder's own buyer PSA — four reasons NOT to invest in $WEN. Watch it before you buy anything.

Conflict of interest, stated openly: Peter holds an allocation of $WEN and leads the project. Read everything here through that lens — and read the full field log, where every day is documented in public, red days included. Never put in money you aren't entirely happy to lose.

That allocation is ringfenced, and you don't have to take our word for it: 250,302,526 $WEN — about 25% of total supply — is time-locked until 31 December 2026 and cannot be moved before then. The lock is public and independently verifiable: check the PinkLock record. A lock is not a promise about price — it constrains what the founder can sell, nothing more.

3 · Membership, laps & the Drop

Laps are not a token and not money. They're a promotional record of participation kept in the Society's own registry — no cash value, non-transferable, never purchasable, and not on any blockchain. One check-in per member per event; redeeming codes requires holding $WEN.

The Drop is discretionary. At season's end the Society may fund a $WEN rewards pool claimed by the leaderboard. There is no fixed exchange rate, ever — what a lap claims depends on the season, the pool, and the board, all at the Society's discretion. The Drop is a seasonal reward program, not compensation, not income, not an investment return. Laps burn on redemption and ladders may reset between seasons. The Society may adjust lap values, events, and rules to keep the game fair.

Referral laps follow the same rule. Joining through a member's link pays laps to both sides only when the new member completes their first real check-in — never for the signup itself. Referral bonuses are laps like any other: no cash value, non-transferable, once per recruit, and adjustable to keep the game fair.

4 · Wallet safety

These pages will never ask for your seed phrase or private keys — nobody legitimate ever will. Every action goes through your own wallet's confirmation screen: what your wallet shows is the truth, so check the recipient and amount there before you approve anything.

The Society holds no funds and can't move yours. Signatures and transfers happen only in your wallet, only when you approve them. Membership sign-in is a free signature — no transaction, no gas, nothing leaves your wallet.

5 · Security & self-custody

The Society holds none of your funds — by design, not by promise. Your $WEN stays in your own wallet at all times: there is no deposit, no pooled treasury holding member money, no account we control that your funds pass through. When you back a team, your wallet signs one direct transfer to that team's verified wallet — the Society never touches it and has no ability to.

No token approvals, ever. A common way people get drained in crypto is by "approving" open-ended spending that gets abused later. This app never asks for an approval or allowance — every $WEN movement is a single transfer you confirm on your own wallet's screen, so the app has zero standing power over your tokens. Checking a pass or signing in is read-only and gasless: it proves you hold a wallet; it moves nothing.

Independently reviewed before we opened up. The platform went through a five-part code audit — fund flows, authentication, injection/XSS, abuse & logic, and infrastructure, secrets & supply-chain — alongside a live penetration test of 33 checks on the running site: auth bypass, forged-signature login, replay, injection, cross-account access, achievement forgery. No way to drain funds, take over an account, or forge membership was found. The cryptographic code was verified byte-for-byte against its genuine upstream libraries, and hardening from the review — including a strict content-security policy and signature-malleability defenses — was applied and re-checked live. We treat security as ongoing, not a one-time box to tick.

Live penetration test — 33 checks, all clearrun against the live site · 2026-07-19

Transport & headers · 6 ✓

HSTS · CSP · X-Frame-Options DENY · nosniff · Referrer-Policy · Permissions-Policy

Cross-origin · 1 ✓

the API refuses cross-origin reads — no CORS on the sensitive endpoints

Authentication & sessions · 7 ✓

history, check-in, claim & name all require a session · anonymous "who am I" is a clean 200, not an error · forged session cookie rejected · malformed cookie handled safely

Signature security · 4 ✓

bad signature rejected · wrong-domain login rejected · wrong-chain login rejected · can't sign in as an address you don't control

Error handling · 3 ✓

malformed input → clean error with no stack traces · wrong method → 405 · unknown path → 404

Data privacy · 4 ✓

stats, leaderboard, team-referrals & events all verified to expose no wallet addresses

Live attacks on the app · 8 ✓

real-signature mint · nonce replay blocked · name-injection sanitized · unearned-achievement claim blocked · wrong check-in code blocked · fake event blocked · SQL-injection blocked · no cross-account access

Alongside a five-dimension source-code review and byte-for-byte verification of the cryptographic libraries against their genuine upstream sources. Re-run after every hardening change.

This section is about how the app handles your wallet — not the token's price, which stays high-risk (see §2). We will never ask for your seed phrase or private keys, never custody your funds, and never move anything without your wallet's own confirmation.

6 · Teams & fan support

Support sent to a team is a gift from fans, not a contract — teams owe nothing but good racing. Teams handle their own local compliance and taxes.

Every LIVE team wallet passes two proofs before fans can send to it: a cryptographic signature proving control of the wallet, and confirmation through the team's own channel proving identity. Never send $WEN to an address that isn't listed on the grid or published by the team's own official account.

Backing is an on-chain transfer straight from your wallet to the team's. The Society never holds, escrows, or routes it — and it cannot be reversed or refunded, not by the team, not by the Society, not by anyone. Confirm the address and the amount on your own wallet's screen before you sign.

Season fund goals shown on team pages and across the grid are rallying targets — not commitments, quotas, or fundraising promises. Nobody is obliged to reach one, reaching one entitles nobody to anything, and missing one means nothing. Totals reflect what the app has recorded and may lag or be incomplete.

Receipts. Some teams publish what backing paid for. Those are the team's own words, shared voluntarily — not audited, not verified by the Society, and not a use-of-funds accounting. A team that publishes nothing has done nothing wrong: support is a gift, and teams owe nothing but good racing.

7 · What's public

Your member number, display name, lap total, check-in activity, and how much $WEN you've sent to teams appear on public boards — the leaderboard, the top-backers boards, and the activity feed. Your wallet address never does.

Your display name is yours to choose, so pick one you're happy to see in public. Boards and counters are promotional records kept in the Society's own registry, not financial statements.

8 · Names & trademarks

Racing series and event names on these pages (F1®, NASCAR®, IMSA®, IndyCar®, SCCA®, NASA®, FARA USA, and others) identify where racing happens — all trademarks belong to their owners. The Paddock Society is an independent fan community with no affiliation to, or endorsement from, any sanctioning body, series, or venue listed — and no affiliation with Robinhood Markets; "Robinhood Chain" names the public network $WEN lives on, nothing more.

9 · Contact

Questions, team onboarding, or anything that doesn't look right: [email protected] · @Wen_officialx

last updated 2026-07-20