Lottery - Evaluating downside risk

Context:

What are the risks?
How can I reduce these?
What is the worst case scenario?
How can I get more feedback?
Smart contract hack leading to loss of funds
- State this is an alpha everywhere in logo - Require users to check a checkbox saying they understand this is risky, and has not been audited - Cap the maximum that can be invested - Personally put money at stake as well, so any hack impacts me too
Users lose funds. They claim that I am liable even though they acknowledged the risk.
- Post on Twitter asking for whitehat hackers - Put up a bounties for evaluating - Put up a bug bounty
Giving up on points program can lead to reputation risk
- Add clear end date for points program (eg. May 31) to cap my responsibility - Be clear that only incentives provided are Blast points and Blast Gold. No token, etc. - Set expectation that this is a proof of concept, with 1 person working on this
Users claim rugpull. They invested time into referring friends and getting a lot of points, but the project got no/limited traction so no rewards.
- Ask others who have given up on building consumer crypto
Operating a non-government-sanctioned lottery
- Block all US users - Require that users check a checkbox stating they are not US residents - Be clear in guidance that this is a proof-of-concept, and that we will aim to be compliant with US law and any other regulators that reach out
Some US users get through via VPN, or contribute via contract, and sue us for offering a non-compliant lottery. Polymarket settled by shutting down US facing product, but can still be VPN. PoolTogether did get sued, but founder just said to block US users is fine.
- Reach out to Vice Ventures - Ask the founders of Polymarket - Look at the PoolTogether, Polymarket, and High5 cases - Ask Bobby and other legal counsel