trust & immutability
the strongest page a launchpad can publish is the complete list of what its operators can do. here is ours.
every owner power — the complete list, nothing else
| power | bound |
|---|---|
setCreationFee(uint256) | hard-capped on-chain at MAX_CREATION_FEE = 0.1 ETH |
withdrawFees() | pull-based; only accrued creation fees, never curve reserves |
setMigrator(address) | applies only to tokens created after the call — each token snapshots its migrator at creation and it can never be changed |
| hook protocol treasury | fixed at hook construction; can claim only the protocol's 25% share of the 1% fee — never user funds, never liquidity |
transferOwnership / renounceOwnership | standard ownership handover, inherited from the ownership library — moves or burns this same list of powers; adds nothing to it |
that's the whole list. there is no pause, no blacklist, no mint, and no owner access to curve ETH or pool liquidity.
what we cannot do — can't, not won't
- we can't stop you selling. there is no pause on sells, on the curve or after graduation. pre-graduation you can always exit to the curve — the reserve that pays you is held by the contract, and no function of ours touches it.
- we can't change any pool's fee split. the 20/40/15/25 split is set when a pool is created, and no function exists — for us, for the creator, for anyone — that changes it afterward.
- we can't mint. token supply is fixed at creation; no mint authority exists in the token contract.
- we can't pull liquidity. every liquidity position from graduation is owned by the burn address (0xdead). that includes us.
- we can't re-wire the contracts. every cross-contract reference is fixed in the constructors at deploy time; no setter of any kind exists afterward.
when this page says "can't," it means the function does not exist in the deployed bytecode — not that we promise not to call it.
moderation, honestly
we can hide a token from this interface — we keep that ability for impersonation and illegal content. hiding is app-layer only: the contracts don't know about it, the token stays fully tradable on-chain, and holders can always exit. we cannot freeze, seize, or de-list anything at the contract layer.
where security stands
- the contracts carry a full unit, fuzz, and invariant suite — the exit guarantee above is one of the invariants.
- we've run repeated internal adversarial reviews — contracts, frontend, backend, and the fee economics — and fixed what they found.
- an external audit has not happened yet. internal review is not a substitute for one, and we won't pretend otherwise.