Can the bottom fall out of this? We read the code.

1. The code can never change.

Some crypto projects use "upgradeable" contracts — the operator can swap in new code after you've joined, changing the rules underneath you. This contract has none of that machinery. No proxy, no delegatecall, no self-destruct — the three mechanisms that allow post-launch changes are simply absent from the code. What was deployed on May 27, 2026 is what runs today and what will run in ten years. And because the source is verified as an exact bytecode match, the code we reviewed is provably the code that's running — not a copy, not a claim.

Verified on both major registries. The source is published and exact-match verified in two independent places: Sourcify ↗ (the open-source registry, verified the day of deployment) and Polygonscan ↗ (Exact Match, contract name TRUSTCorona, Solidity 0.8.28). Two registries, independently confirming the same thing: the readable source you can inspect is byte-for-byte the code that's running.

2. Member money never sits in the contract.

There is no pool, no vault, no balance an operator could run away with. When someone joins or upgrades, the contract splits and delivers every coin in the same transaction — sponsor reward, upline payment, fees — straight to member wallets. If any single transfer fails, the whole transaction reverses and nobody pays anything. You can watch this happen live on the payment proof feed: money in, money out, same block.

3. The prices and payout rules are locked.

Entry and upgrade costs for all 8 levels were fixed the moment the contract deployed — there is no function to change them. The payout split is compiled into the code as constants: on entries, the sponsor receives the slot cost minus a 5% project fee (founders 1% + 1%, development 3%); on upgrades, 100% goes to the eligible upline — the project takes nothing. There's also no pause switch: nobody can freeze joins, upgrades, or payouts. The eligibility rule is public too: an upgrade payment stops at the first upline who is qualified (2 directs) and already at that level — otherwise it passes them and continues up.

4. What the operator CAN do — the honest list.

A fair review reports the levers, not just the locks. The contract owner can do exactly four things:

• Raise or lower the entry fee percentage (currently 5%, hard-capped at 50% in the code). This affects the price of future joins only — it can't touch anyone's earnings, and any change is instantly visible on the blockchain.
• Redirect the project's own fee wallets (founder/development shares) — their revenue, never member payouts.
• Sweep out coins accidentally sent to the contract address — member payment flows never leave a balance behind.
• Transfer ownership of those same limited powers to someone else.

What the owner cannot do: take member funds, change payout rules, change prices, reroute earnings, block withdrawals (there's nothing to withdraw — payments are instant), or replace the code. Even a fully hostile owner is limited to that list above.

5. Where "missed" payments go.

When an upgrade payment finds no eligible upline within 16 levels (or reaches the root), it goes to the project's fee wallet rather than vanishing. That's the strongest built-in reason to get your 2 directs and keep your level current — eligible positions catch payments; ineligible positions watch them pass by. The Member Dashboard shows exactly this happening in real time.

6. What if the creators disappear?

A fair question about any on-chain program: if the people who launched it walked away, lost their keys, or simply vanished — does it quietly break over time? For this contract the answer is no, and we verified it directly on the blockchain — not just in theory.

Nothing needs an admin to keep running. Joins, upgrades, matrix placement, and every payout are fully automatic. There is no periodic "keepalive," no button anyone has to press to keep payments flowing, and no expiry date anywhere in the code. Whether the creator is present or gone changes nothing about what members receive.

A lost or abandoned admin wallet can't jam the machine. Every payout requires its recipient to accept the coins, so we checked what those admin wallets actually are: the founder, development, and fee-receiver wallets are all ordinary wallets, not programs. An ordinary wallet always accepts an incoming payment — even if its key is lost forever and no human is behind it. So even in the worst case, the coins simply arrive and sit there uncollected; the member on the other side of that transaction still gets paid, every time. The only thing that could ever go uncollected is the project's own fee — never a member's earnings.

And if the owner's key were lost, the four limited powers from section 4 would simply freeze in place forever — the fee percentage and wallet addresses could never change again. Members would never notice, because members never depended on those powers. The contract also keeps no stored balance — every payment is delivered in the same transaction it arrives in — so there's nothing sitting inside that could be stranded. In short: this system's survival does not depend on any person staying reachable.

Check it yourself — please.

• The contract on Polygonscan ↗ — every transaction, ever, public — now with the verified, readable source under the Contract tab.
• The verified source code ↗ — the exact code that's running, independently verified.
• The live payment feed — every payout on this site links to its blockchain transaction.
• Ask any developer you trust to read the source against this page. It's ~400 lines.