Deployed and checked
Legacy access controls
Retired account and voting interfaces no longer accept public changes. Existing records were preserved. Public account responses now use an explicit field allowlist and exclude internal review notes.
Trust center · official domain
Security & wallet safety
The official website is https://zeuslobster.com. ZeusLobster never asks for a seed phrase, private key, secret recovery phrase, authentication code, or wallet export.
October 21, 2026 · Application security update
Fixes deployed. Verification continues.
We completed an internal, AI-assisted application security review and deployed access-control fixes. This is a dated engineering update, not an independent security certification or a guarantee that every vulnerability has been found.
Deployed and checked
Fewer public entry points
Legacy alternate hosting and preview addresses have been disabled. Required internal connections use private service bindings. Operator access remains protected, and missing pages return clean not-found responses.
Evidence, not a guarantee
What was exercised
The review covered 16 deployed Workers and 30 route assignments. Read-only and rejection checks were combined with isolated tests using synthetic records. Passport, promo, Arena and Aletheia controls passed the exercised checks. No customer records or onchain transactions were changed during testing.
Further hardening
Still open
Broader browser-policy tightening, older contract-development tooling and account-level policy/log review remain follow-up work. This review did not determine whether historical records had previously been altered, and it was not a formal smart-contract audit.
TLS 1.2+ verified. On October 21, 2026, live connection tests confirmed that zeuslobster.com and auth.zeuslobster.com reject TLS 1.0/1.1 and accept TLS 1.2/1.3.
Please keep checking the exact domain and each wallet request. Application fixes do not make an unknown link, signature, approval or transaction safe.
Before connecting
What each active tool may request
BYOB profile sign-in requests a one-time, domain-bound message naming Base Mainnet (8453). It is an offchain login, not a transaction or token approval. Profile sign-in has been restored following the domain review and successful user retests described below. Public profiles, recorded Arena benchmarks, and anonymous practice uploads do not require a wallet.
Base Board
The Free Trial is read-only and requests no wallet access.
Research Pro
Requests account access and Base network selection only, then reads public CLDv4 ownership. It does not request a signature, approval, transfer, or transaction. Public ownership lookup is not proof that the visitor controls a wallet.
CLDv4 viewer
Artwork, metadata and public ownership lookup need no wallet connection or signature. Sending an owned CLDv4 is optional and requires selecting the owner account on Base, reviewing the simulated transfer, and confirming the NFT transaction in your wallet. No token-spending approval is requested.
CLDv4 sale
Purchases are restored. Public inventory is readable without a wallet. Buying uses native Base USDC: an exact-amount spending approval to the sale contract, when needed, followed by a separate purchase transaction. Both steps require your wallet confirmation; the purchase rechecks the quote and caps the payment.
Verified Base identifiers
Check the complete address in your wallet
CLDv4 Governance
Collection
0xF8E9e84700Cf846e5d80dF4D6A6e2458c2Ead2F6
CLDv4 public sale
Sale contract
0x437415028b1ef845D42a2Ba746FCe2D3C2fc862a
Mobile-wallet warning
Do not bypass a warning blindly
If MetaMask or another wallet displays a harmful-site warning, stop and confirm the exact URL is on zeuslobster.com. Take a screenshot, record the complete affected URL and wallet-app version, and report it. Never use a link sent by an unknown account.
September 12, 2026 · Profile access and CLDv4 sales restored
Blockaid approved the verification request for zeuslobster.com and subsequently confirmed that a domain whitelist was added. The owner and an external tester reported clean Base-only profile-signature prompts. The owner's later CLDv4 retest also showed a 5-USDC spending-cap request on Base without the earlier high-risk approval warning. Normal profile sign-in and website purchases have been restored.
The sale screenshot verifies the appearance of that approval prompt, not a completed approval or NFT purchase. Blockaid's email describes domain whitelisting rather than an independent contract audit. Exact-amount approval, quote rechecks, transaction simulation, and Base/account checks remain in place. These results are not a blanket security certification; cancel and report any request that still displays a warning.
Responsible disclosure
Report privately before publishing exploit details
Email zeus.lobster@gmail.com with the affected URL, time, device or wallet version, screenshot, and safe reproduction steps. Do not include seed phrases, private keys, authentication codes, or sensitive wallet exports.