Security
What the owner can do, what nobody can do, and what has been checked.
What the owner can and cannot do
| Can | Cannot |
|---|---|
| Set the creation fee, up to the hard-coded ceiling | Pause trading or launches |
| Set the star share, up to the hard-coded ceiling | Remove, move or resize a pool position |
| Change the treasury address, and hand over ownership | Change a pool's price, range or fee tier |
| Claim the treasury's own fee share | Take ETH or tokens from users, or from anyone's claimable balance |
| Mint, blacklist, tax |
The liquidity cannot be pulled
The position belongs to the launcher, and the launcher has no function that removes liquidity. Its callback understands three actions and no more: open a position at launch, collect with a liquidity change of zero, and swap. Nothing in the contract passes a negative liquidity delta to the PoolManager, so there is no call — by the owner, the creator, the star or anyone else — that takes the supply back out. Not a timelock, not a promise: no code path.
Other guards
- Reentrancy guard on every function that moves ETH or tokens.
- The PoolManager callback accepts only the PoolManager; so does
receive(), so no ETH can sit outside the accounting. - Slippage checked on the amount actually taken out of the pool, not on a return value.
- The position's liquidity is shaved by a hair so Uniswap's round-up can never ask for more tokens than the launcher holds.
- ETH owed to a star or to the treasury is pulled with
claim(), never pushed: a wallet that reverts on receive cannot break the trade that earned the fee. - The token implementation locks itself in its constructor, so the master copy can never be initialised by anyone.
What has been checked
A harness runs the whole lifecycle against the real Uniswap v4 PoolManager on Robinhood Chain inside a single eth_call: deploy the launcher, launch a token, read the pool back through Uniswap's own StateView, buy with ETH, sell back, collect the position's fees and pull a claim. Any step that fails reverts the call and names itself. The same run is used to check this site's quote arithmetic against the live pool, where a single wei of disagreement fails the run.
The code is tested, not audited by a third party. Treat it as any other new contract: size positions accordingly.