BoilerBrokers

3,333 desks . one floor . Robinhood Chain

BoilerBrokers is 3,333 pixel-art characters working a 1980s sales floor, and a browser city that is the project's website rather than a picture of one. The piece you hold is meant to become the character you walk that city as.

This page is the public record: how it is built, what is decided, and what is not.

Start here

Collection

Supply

3,333

Chain

Robinhood Chain

Standard

ERC-721

Name / symbol

BoilerBrokers / BOILER

Artwork

1200 x 1200 PNG

Storage

IPFS

Each piece is drawn at 48 by 48 and scaled up by 25 with no smoothing, so every pixel stays a hard square at any size. A piece is eight layers deep - background, base, hair, shirt, neckwear, eyes, mouth, headwear - and the base is the body itself, in three variants.

Artwork and metadata live on IPFS and are addressed by content hash, so a file cannot be swapped without its address changing. The contract holds the pointer to that address, and the pointer can be frozen permanently once reveal has been checked. It has not been frozen yet, because nothing has been deployed to mainnet yet.

The collection name is set when the contract is created and there is no way to rename it afterwards.

Royalty

The contract implements EIP-2981 and reports a royalty of 5%. EIP-2981 reports royalty terms, it does not enforce them: a marketplace reads the number and decides for itself whether to honour it, and transfers sent directly between wallets pay nothing.

The royalty is also not fixed - the owner can change the receiver and the rate at any time. Listed with the other owner powers under Smart contract.

Rarity

Rarity is a property of the artwork, and every count below is exact rather than approximate. Which token number ends up holding which artwork is a separate question, settled after minting closes - see Reveal.

How the counts were fixed

Traits are not drawn by weighted random. Each layer starts as a pool of exactly 3,333 values holding the published counts, so the totals match the table by construction rather than by luck, and every piece is checked to be unique as a finished image rather than as a list of traits. Method in the appendix.

The chase

Fedora (33) and Cowboy Hat (99) are the headwear worth hunting, three times apart so there are two tiers of hunt rather than one. On their own layers the rarest are Monocle (33), Bolo Tie (43), Scarf (60), Cigar (67) and Night Skyline (83), and the rarest base is Zombie (88). Just under half the collection wears no headwear at all, so the eight hairstyles stay visible.

The 1-of-1

A Zombie wearing a Fedora. Exactly one exists. Left entirely to chance the combination might not have occurred at all, so it is locked to exactly one and was stated as such from the start. Which token number holds it is decided by the reveal draw, after minting closes, and nobody knows it in advance.

The city

The city is the direction this project is pointed at: a place where a piece would be a character rather than an image in a wallet.

It is not finished, and nothing here should be read as a commitment that it will be. What exists today is below; what does not is listed under it by name. A piece is worth its artwork and its place in a fixed set, and nothing on this page adds to that.

What exists today

The site is not a page with a picture of a city on it. It is the city, with the page laid over it: nine blocks, four streets, and a park in the middle. Three doors open - the Mint Office explains how the sale runs, the Trading Hall is where allowlist entry happens, and The Ticker covers the token. Every other door is locked and says so on its sign, because a door that promises something and does not open is what loses people.

The street moves on its own. People walk the pavements, traffic runs both ways, birds cross overhead and a cat works the park. None of it is video - every figure on it is drawn frame by frame.

What does not exist yet

Nothing on that page responds to a keyboard. There is no character you control, no building interior, and no other players. Holding a piece does not currently unlock anything in the city, because there is nothing yet to unlock.

No date is attached to any of it, and none will be until it is close enough to be true. The status table lists each part as not built until it is built.

Ownership

What you own on chain

An ERC-721 token on Robinhood Chain, with the ordinary rights that carries: hold it, transfer it, sell it anywhere that supports the standard. The token points at metadata and an image stored on IPFS and addressed by content hash.

What holding one gets you today

• The artwork at full resolution, on IPFS, addressed by content hash rather than by a URL somebody has to keep paying for.
• A place in a fixed set whose trait counts are published, exact, and checkable by anyone.
• An asset that trades anywhere supporting ERC-721.

Not promised

• No revenue share, no staking, no yield, no airdrop.
• No guarantee about secondary price, floor, or a listing anywhere.
• No date for the city becoming playable.

Mint

The sale runs as an OpenSea Drop, on a contract OpenSea deploys. Four phases, and two of them cost nothing.

Free means free: you pay the network fee to send the transaction and nothing reaches us. The ladder runs this way on purpose. The people who were already holding, and the people who applied and got through, pay nothing. The next thousand on the same list pay 0.001. Anyone arriving at the end pays 0.002. Turning up early is the discount, and it is the only one there is.

Applying does not put you in FCFS. The whitelist and FCFS are drawn from the same screening, one after the other, and both of them run out. If an application clears neither, the public phase is still open to it like it is open to anyone - the difference is the price and the wait.

The order, and the clock

The team's pieces are minted first. Each sale phase opens an hour after the one before it, and a phase closes when the next one opens, so there is exactly one place to be at any moment.

• Open Outcry opens an hour after the team mint.
• Whitelist an hour after that.
• FCFS an hour after that, and it runs for 45 minutes.
• Public follows, and stays open until the collection sells out or the clock runs out.

Missing your window is not fatal. Eligibility runs downward: whoever could mint in Open Outcry can also mint in FCFS and Public, and whoever could mint in Whitelist can do the same. The one exception is that Open Outcry does not carry into Whitelist, because those are two different lists rather than two rungs of one.

What happens to whatever does not sell

Twenty-four hours from the team mint the sale ends and does not reopen. The clock starts with the first piece minted, not with the public phase, so the whole sale happens inside one day. Whatever was not minted by then is never minted: not sold quietly later, not held back for a partnership, not kept by the team.

Being exact about what that does and does not change, because the two get confused and the difference is the kind of thing people feel lied to about. The number on the contract stays 3,333. An OpenSea Drop is a limited edition, so pieces that go unsold stay unsold rather than disappearing; what ends is the ability to buy them. Each phase carries its end time on the contract, so once the last one passes that phase cannot mint another piece, and anyone can check that without taking our word for it.

The ceiling holds in the other direction too, and this part is not a promise but a rule of the platform: once minting starts, the total cannot be raised. 3,333 is the most that will ever exist, whoever asks for it.

What is left is one thing you are trusting us on. Whoever owns a collection can create a new phase after the old ones close. Nothing in the code stops that; what stops it is this paragraph, written before the sale rather than after it. A mint of 2,000 out of 3,333 leaves 2,000 pieces in existence and 1,333 that were never minted, and an unminted remainder hanging over holders who cannot know when several hundred more might surface is exactly what ending the sale on a clock is for.

Team allocation

33 of the 3,333 go to the team, taken before the sale opens.

The team draws blind, like everybody else. Which artwork those 33 hold is decided by the same shuffle as every other piece, and the shuffle is drawn after minting closes from a block nobody controls. We find out what we got at the same moment you do.

Getting on the list

Entry is a short set of steps on X plus the wallet you intend to mint with. Entries are reviewed after they close, not as they arrive, so entering first buys nothing.

The reviewed list is loaded into the Drop before the phase opens, and a place belongs to the wallet it was entered with and cannot be moved to another.

Reveal

The provenance hash, published before mint

a7ed16f5470654c27b1d46e31f7393487094698772f3e6b635b916ba77434139

Every image is hashed with SHA-256, the 3,333 digests are chained in artwork order, and that chain is hashed once more. It proves one thing and only one: the artwork set and its order were fixed before anybody minted, and were not rearranged afterwards to suit who turned up. The algorithm and a script that reproduces it are in the appendix.

Why there is a shuffle at all

The artwork is finished and hashed before anyone mints, which is what makes provenance possible. On its own it would also make the mint readable: if token #34 always showed artwork #34, anyone who got hold of the metadata address could wait for a rare number to come up. An address that must never leak is a hope, not a mechanism.

How the shuffle is drawn

One number decides everything. It shifts every token onto a different artwork, the same distance for all of them, wrapping around at the end so no artwork is used twice and none is left out.

That number comes from a block that has not happened yet. Before the mint we publish which block. When it arrives its hash is public and identical for everyone, and the number is that hash reduced to the range 1 to 3,333. The metadata is then built with that shift and published.

Anyone can check the result afterwards: take the block hash, compute the number, confirm the artwork behind any token is the one the shift points at, and confirm that artwork's image matches its line of the published hash list. Nothing about that check requires trusting us.

Before reveal

Until the reveal every token shows the same placeholder, so nothing about an individual token leaks early. The artwork and metadata addresses are not published until then.

Depends on the contract Whether the artwork address can be frozen permanently after reveal depends on what OpenSea's Drop contract allows. Ours had a one-way lock for exactly this. Whether the replacement does will be stated here once it is deployed.

Smart contract

Standard

ERC-721

Chain

Robinhood Chain

Deployed by

OpenSea

Address

Not deployed

The mint runs on a Drop contract that OpenSea deploys. We do not write it and we do not control its code. The collection name, the symbol and the chain are fixed when it is deployed and cannot be changed afterwards.

Why the change

Trust at the point of sale. A drop page on a marketplace people already use, with a wallet flow they already know, removes the moment where somebody has to decide whether a mint button on an unfamiliar website is safe to press. That moment costs more buyers than any mechanism wins back.

The cost of the decision is above, and it is not small. Our own contract is written, tested, rehearsed on testnet, and will not be used.

Testing & audit

Changed This section used to describe 35 tests and a full lifecycle rehearsed on the Robinhood Chain testnet. Both were real, and both tested the contract that is no longer being used. They say nothing about the contract the mint will actually run on, so they are no longer offered as if they did.

The Drop contract is OpenSea's. We did not write it, we have not audited it, and we did not write its tests. We make no claim about it beyond the fact that it is what their Drop product deploys and that other collections have minted through it before this one.

That is a weaker statement than the one it replaces, and it is the accurate one. Anything stronger would be us vouching for code we have not read.

Treasury

Mint proceeds are held by the contract itself and moved by a withdrawal that sends the entire balance to the treasury address and nowhere else. There is no function that sends funds to an address chosen at the time of the call.

The treasury address is set at deployment and can be changed by the owner at any time. The royalty receiver is set to the same address at deployment and can also be changed. Both appear in the list of owner powers above, because a treasury that can be repointed is a different promise from one that cannot.

The mainnet treasury address will be published here alongside the contract address at deployment.

Future ecosystem

$BOILER

Status

Not deployed

Contract address

none

Ticker

$BOILER

Planned supply

1,000,000,000 Not final

$BOILER has not been deployed and there is no contract address. Anything trading under this name today is not it. The address will be published here and on the front page, and nowhere earlier.

What each would be for, if it is built. The design has the NFT as the character and the token as what moves it up a rank - a title under the name, a look that changes with it. Standing rather than yield. None of it exists: there is no rank, no city to walk and no token. This paragraph describes a drawing, not a feature.

A supply of 1,000,000,000 is the planned figure and nothing more than that. Allocation and launch date are not decided, and no part of this document should be read as a commitment on either. It would be a separate contract from the 3,333 pieces and would share none of their supply; the two numbers on this page are not the same number.

What the token would be for

There is a design for how the token and the collection would need each other: a piece carries a visible rank, a title under the name and a look that changes with it, moved by spending the token. What that offers is standing rather than yield.

Postponed It is not built, and postponed is not the same as coming soon. The thresholds in it are calculated against a supply that is not final, so they move if it moves, and one part has no answer yet: rank advances by spending a token that does not exist, so either the trigger changes or it waits. It is recorded here as the direction, not as a commitment.

The rest of the city

Making the city playable is the project's main direction and is described under The city, along with an honest account of how much of it exists. Interiors, other players and anything persistent sit behind that and are not dated.

Status

Still open

Decisions not yet made, listed so the record is complete rather than flattering.

• Mint date and prices.
• Whether the mint runs in four phases as planned, or three.
• Whether the contract source is published for outside review before mint, and whether an independent audit is commissioned first.
• Whether the mint happens here or through a marketplace drop page.

Technical appendix

Detail that belongs in the record but would slow down a first read.

Provenance algorithm

Each of the 3,333 images is hashed with SHA-256. The 64-character lowercase hex digests are concatenated in artwork order 1 to 3,333 with no separator between them, and that whole string is hashed once more with SHA-256. The result is the hash published under Reveal.

Note what is being hashed: the concatenated hex text, not the raw digest bytes. Hashing the bytes, or joining the lines with newlines, gives a different and equally valid-looking answer, which is why the recipe is spelled out rather than described.

Reveal threat model

The shuffle is drawn from a block hash published in advance. What that does and does not protect against is worth setting out, because the honest answer got weaker when the mint moved to a contract we do not control.

• The artwork set cannot be changed. Its order was fixed by a hash published before the mint, and any image can be checked against its line of that list. This is the strongest guarantee here and it did not change.
• The block hash cannot be chosen. It is public, identical for everyone, and does not exist when the block is named. Nobody can arrange a particular result in advance.
• Nothing forces us to use it. This is the part that used to be enforced by code. On our own contract anyone could run the draw, a live commitment could not be withdrawn, and every attempt was counted on chain. None of that exists on a Drop contract we do not control. We could name a block, dislike the result, and name another one.
• It would be detectable. The named block is published before the fact and its hash is permanent, so a result that does not match the block we named is visible to anyone who checks. Detectable is a real deterrent. It is not the same as impossible, and this page will not pretend otherwise.
• A leaked metadata address before reveal stays a spoiler rather than an exploit: the shuffle is drawn after minting closes, so seeing the artwork early does not help anyone pick a rare token during the sale.

Artwork generation

Each layer is a pool of exactly 3,333 values holding the published counts, shuffled with a fixed seed and zipped together. Weighted random was rejected because it cannot hit a published table: a 1% weight on a 3,333 set returns a number near 33 but never reliably 33, and the counts are the thing collectors check one by one.

Three requirements then have to hold at the same time: no duplicate trait combination, exactly one 1-of-1, and no two pieces rendering to the same image. Fixing one can break another, so the pass repeats until all three hold on the same round. If they cannot, the build stops rather than shipping a set that misses the table.

Counts and uniqueness are checked before a single file is written, then checked again by a separate checker that shares no code with the generator. A checker built from the same code only proves the code agrees with itself.

Before generation, 1,791 layer combinations were tested for three defects that only appear when layers meet: enclosed gaps where the background shows through a body, a silhouette changed by something that is not hair or headwear, and any drift in the eyes or brows. Some of these come from a pair of layers that are each clean on their own, so the repair also runs at assembly time rather than in the assets alone.

Token number is not artwork number

A token's artwork number is ((id - 1 + shift) mod 3333) + 1. The arithmetic runs in zero-based space and shifts back, because skipping that step is the easiest way to produce artwork 0 or 3,334 and point at a file that does not exist.

One consequence is worth knowing before somebody reports it as a bug: each metadata file carries the artwork number in its name field, so after reveal token #34 displays the name of whichever artwork it drew, not "#34". The token number is the thing you own; the artwork number is the thing you drew. The 1-of-1 is artwork #1374, which is not a token number and says nothing about who holds it until the shuffle is drawn.

Verification scripts

Reproducing the provenance hash, once the images are published. Files are named by artwork number.

for i in $(seq 1 3333); do sha256sum "$i.png" | cut -d' ' -f1; done | tr -d '\n' | sha256sum

Checking a single token after reveal: read artworkOf(id) from the contract, fetch that numbered file from the published metadata address, and confirm the image it points at hashes to the corresponding line of the published image-hash list.