$POP

Trust & security

The honest framing: launchpads are a category where the operator usually can take your money and is asking you to believe they will not. $POP is built to make most of those questions unanswerable rather than answered.

This page explains the reasoning. /proof has the exhaustive list with explorer links for every contract and every power.

What nobody can do, including us

  • Touch locked liquidity. The locker has no withdraw, transfer, or arbitrary-call function. This is not a long timelock; there is no code path out at all.
  • Redirect a creator's fees. There is no admin override anywhere in the system. Only the current recipient can hand off their own stream.
  • Change a live launch's terms. Fee split, cashback mode, thresholds and pool parameters are snapshotted at creation. Later protocol changes apply only to launches created afterwards.
  • Mint, pause, freeze or blacklist a launch token. Those functions do not exist.
  • Delist a quote token, or list one that does not satisfy the on-chain rules.

What the protocol owner can do

Ownership is held directly by a single key, with no timelock, so the actions below take effect the moment they are sent. We are telling you this plainly because it is the weakest part of the deployment, and because the list itself is short by construction rather than by promise. The complete list:

  • Configure terms for future launches (fee recipient, launch fee, launch config, snipe window).
  • Add a new quote-origin adapter (append-only, never replacing an existing one, so listed quotes keep their verification path forever).
  • Pause new launches on a specific quote token. Never pauses trading, never affects an existing launch or pool.
  • Run narrowly-scoped rescue paths for launches or fee balances that get stuck. Every rescue pays fixed recipients: the launch's own creator recipient or the protocol's. The bond rescue only unlocks after a launch has been bond-ready for 14 days, during which anyone can still bond it. The owner chooses when, never where.
  • Rotate the fee-sweep operator, which can only trigger fee conversions with a price floor.
  • Adjust the holder revenue share on the protocol's splitter, in either direction. It launched at 15% and is currently 0%: the payout requires the holder-rewards token variant, $POP was launched in quote-burn mode, and distributions reverted until the share was zeroed. The owner can also point the splitter at the platform token once (already spent on $POP) and choose the buyback burner's keeper. What the owner cannot do: claw back a distribution that already happened, or change the burner's 25% burn ratio, which is immutable.

That is the whole surface. Anything not on that list does not exist in the code.

The deliberate tradeoff: lost keys

Because no admin can redirect a creator's fee stream, a creator who loses their key loses their future fees. Permanently. We could add a recovery path; the launchpad this design borrows its mechanics from has one. But that same path is by construction the power to take any creator's revenue and give it to someone else.

We think the guarantee is worth more than the safety net, and that you deserve to be told about it rather than discovering it later. Nothing about it affects traders, holders, or liquidity.

Where the code comes from

The in-pool bonding curve, bonding, and hook mechanics follow the same pattern as the verified, MIT-licensed PonsV2 launchpad, which has processed tens of thousands of launches on this chain and is itself derived from an audited codebase. We did not invent the risky parts from scratch.

What we changed is the trust model, and every departure is documented with its rationale and the risk it introduces in the audit scope document in the repository, including the ones that cut against us.

Audit status

An external audit is pending. Until it lands and is linked on /proof, treat this as unaudited code and size your positions accordingly. What exists today: a full test suite including adversarial cases (reentrant quote tokens, blocklisting quotes, fee-on-transfer quotes, 6- and 8-decimal quotes), property-based and end-to-end tests against a fork of the live chain, including a real WETH to PONS bond conversion on the real Pons pool and the real Uniswap deployment.

Three real bugs were found and fixed by that suite before any of this shipped; they are disclosed in the audit document rather than quietly patched.

Risks that remain

  • Smart contract risk. Unaudited code. This is the big one.
  • Quote token risk. Your launch inherits the quote token's fate. If it collapses, your launch's denomination collapses with it.
  • Market risk. Locked liquidity guarantees a market exists, not that it is liquid at any particular price. Most tokens on any launchpad go to zero.
  • Creator risk. Immutable fee terms mean a creator cannot rug the mechanics, they say nothing about whether the creator will keep building.

Something unclear or wrong? The contracts are the source of truth, and every claim here is checkable on /proof.