Trust & security

The honest framing: launchpads are a category where the operator usually can take your money and is asking you to believe they will not. $POP is built to make most of those questions unanswerable rather than answered.

This page explains the reasoning. /proof has the exhaustive list with explorer links for every contract and every power.

What nobody can do, including us

Touch locked liquidity. The locker has no withdraw, transfer, or arbitrary-call function. This is not a long timelock; there is no code path out at all.
Redirect a creator's fees. There is no admin override anywhere in the system. Only the current recipient can hand off their own stream.
Change a live launch's terms. Fee split, cashback mode, thresholds and pool parameters are snapshotted at creation. Later protocol changes apply only to launches created afterwards.
Mint, pause, freeze or blacklist a launch token. Those functions do not exist.
Delist a quote token, or list one that does not satisfy the on-chain rules.

What the protocol owner can do

Ownership is held directly by a single key, with no timelock, so the actions below take effect the moment they are sent. We are telling you this plainly because it is the weakest part of the deployment, and because the list itself is short by construction rather than by promise. The complete list:

Configure terms for future launches (fee recipient, launch fee, curve config).
Add a new quote-origin adapter (append-only, never replacing an existing one, so listed quotes keep their verification path forever).
Pause new launches on a specific quote token. Never pauses trading, never affects an existing curve or pool.
Run two narrowly-scoped rescue paths for quote tokens that turn hostile after listing. Both pay fixed recipients: the launch's own creator and the protocol treasury. The reserve rescue only unlocks after 14 days during which anyone can still complete the graduation. The owner chooses when, never where.
Rotate the fee-sweep operator, which can only trigger fee conversions with a price floor.

That is the whole surface. Anything not on that list does not exist in the code.

The deliberate tradeoff: lost keys

Because no admin can redirect a creator's fee stream, a creator who loses their key loses their future fees. Permanently. We could add a recovery path; the launchpad this design borrows its mechanics from has one. But that same path is by construction the power to take any creator's revenue and give it to someone else.

We think the guarantee is worth more than the safety net, and that you deserve to be told about it rather than discovering it later. Nothing about it affects traders, holders, or liquidity.

Where the code comes from

The curve, graduation and hook mechanics are adapted from the verified, MIT-licensed PonsV2 launchpad, which has processed tens of thousands of launches on this chain and is itself derived from an audited codebase. We did not invent the risky parts from scratch.

What we changed is the trust model, and every departure is documented with its rationale and the risk it introduces in the audit scope document in the repository, including the ones that cut against us.

Audit status

An external audit is pending. Until it lands and is linked on /proof, treat this as unaudited code and size your positions accordingly. What exists today: a full test suite including adversarial cases (reentrant quote tokens, blocklisting quotes, fee-on-transfer quotes, 6- and 8-decimal quotes), property-based invariants, and end-to-end tests against a fork of the live chain using a real graduated token and the real Uniswap deployment.

Three real bugs were found and fixed by that suite before any of this shipped; they are disclosed in the audit document rather than quietly patched.

Risks that remain

Smart contract risk. Unaudited code. This is the big one.
Quote token risk. Your launch inherits the quote token's fate. If it collapses, your launch's denomination collapses with it.
Market risk. Locked liquidity guarantees a market exists, not that it is liquid at any particular price. Most tokens on any launchpad go to zero.
Creator risk. Immutable fee terms mean a creator cannot rug the mechanics, they say nothing about whether the creator will keep building.

Something unclear or wrong? The contracts are the source of truth, and every claim here is checkable on /proof.