Proof, not promises

PopLocker has no withdraw, transfer, or arbitrary-call function. Read the verified source. Every bonded position NFT is minted directly to it.

There is no admin override of a launch's creator fee recipient anywhere in the code. Only the current recipient can transfer it. Lost keys mean lost future fees. That is the price of this guarantee, and we say it out loud.

Every launch snapshots its economics at creation; the hook's fee policy is a constructor immutable. The owner's config changes apply to future launches only, never to a launch already live.

The factory holds each launch's curve position. Its only paths are bond(), which converts the whole raise into the quote and seeds the locked pool, and a rescue that opens only after a launch has been bond-ready and stuck for 14 days, paying only the launch's own creator fee recipient. During that whole window anyone can still bond it permissionlessly. There is no withdraw-to-anyone function; read the verified source.

Anyone can list any graduated Pons token whose permanently locked ETH liquidity clears the floor, proven on-chain against the verified Pons factories. There is no delist function; a quote that loses its backing simply stops hosting new launches, automatically.

Plain fixed-supply ERC-20: no owner, no mint, no blacklist, no pause, no transfer hooks. Anti-snipe protection is a decaying launch-window tax enforced by the hook, not token-level control.

Bond-readiness is a price fact recorded by the hook; the bond itself is permissionless, atomic, and retryable. The raise's conversion into the quote is bounded by the quote's own 30-minute TWAP, so a manipulated pool delays a bond rather than repricing it, and the new pool seeds at the curve's terminal price. Every bond is a public market buy of the quote token with the entire raise, visible on-chain.

The four ownable contracts are owned directly by the protocol owner, a single key, and its changes take effect immediately with no delay. That is the weakest part of this deployment and we would rather say so than imply a timelock we did not deploy. What that owner can reach is narrow and worth reading literally: launch configs and the snipe-tax window for FUTURE launches, the $POP holder revenue share on the splitter, and constrained rescue paths for launches or fee balances that get stuck. Every rescue pays only fixed recipients, the launch's own creator recipient or the protocol's, so there is no address the owner can name. The bond rescue unlocks only after a launch has been bond-ready for 14 days, during which anyone can still bond it permissionlessly. It cannot touch locked liquidity, cannot redirect a creator's fees, and cannot change the terms of a launch that already exists.

$POP's creator fees accrue to the buyback burner, whose 25% burn ratio is a constructor constant: that slice can only ever leave the contract as $POP sent to the dead address, and $POP's creator fee recipient has been transferred to that burner permanently. The other 75% goes to the protocol. Separately, this page previously claimed 15% of protocol revenue was paid to $POP holders. It is not, and it cannot be: the splitter pays holders by sending $PONS to the token contract and calling sync(), a function only the holder-rewards token variant has, and $POP was launched in quote-burn mode. Every distribution reverted until the share was set to 0%. The splitter's one-time pointer to the platform token is already spent on $POP, so restoring a holder share would require a new splitter, which we are not promising. Past distributions still cannot be clawed back; there simply were none.

Every contract is immutable once deployed. A v2 is a new deployment; v1 launches run forever on v1.