The contracts behind the protocol
Cosmic Signature runs on Arbitrum One, chain ID 42161. Gestures, cycles and allocations all go through one contract, the Cosmic Signature Protocol, deployed as an upgradeable proxy: its address stays the same while its logic lives in the implementation contract the proxy points to. CST, both NFT collections and the Cosmic Council each have an address of their own.
- Cosmic Signature Protocol
- 0x6a714Ae7B5b6eA520F6BCA23d2E609C4Fd5863F2 (opens in a new tab)
- Implementation contract
- 0x50eB3d05d2C463949DE9238D419385594f7AdB97 (opens in a new tab)
- Cosmic Signature CST Token
- 0xAD91843e6A58Ba560F577E676986AFb1dba6FBA0 (opens in a new tab)
- Cosmic Signature NFT
- 0xbb84Be3500A63581d3F2d5AC3bdF8685AAedad25 (opens in a new tab)
The contracts page is the one list of official addresses, the vaults and wallets included. Treat any other address that presents itself as Cosmic Signature as unofficial.
Cycle 0
Check a contract yourself
None of these steps needs a wallet.
Open the address from the contracts page on Arbiscan (opens in a new tab), and confirm the network is Arbitrum One, not a test network.
On the Contract tab, confirm the source code is verified. Compare it with the public contracts repository (opens in a new tab), or check the exact match on Sourcify (opens in a new tab).
For the protocol contract, open Read as Proxy: the implementation it names should be the implementation address on the contracts page.
Pick a record in the app, such as a gesture or an allocation, and find the same transaction among the contract’s transactions on the explorer.
What has been audited
In late 2025, Hacken reviewed the production contracts: the core protocol that runs each cycle, the CST token, both NFT collections, the anchoring wallets, and the wallet and system management contracts. The report (opens in a new tab), published in January 2026, lists 23 findings, none of them critical or high, and 14 of the 14 invariants Hacken fuzz-tested held.
The contracts repository also carries Certora Prover specifications, a Solidity SMTChecker configuration, Slither static analysis and a test suite, each linked from the audits page. They prove or test the properties they state, and no more.
The audit’s scope was the smart contracts: this website, the data service behind the app and the art pipeline were not part of it. Like every check, it lowers risk without removing it; read the risk disclosures before taking part.