Skip to main content

Security & guarantees

pools.fun's core promise is simple: the things that protect your money are bytecode, and the things that make the platform fun are policy. Here's exactly which is which.

Enforced by immutable bytecode​

These cannot be changed by anyone — not the team, not a multisig, not a compromised key:

  • Liquidity is locked forever. The locker has no function that withdraws an LP position, and no sweep or rescue of pool assets. Rug-proof by construction, not by promise.
  • The creator's 20% of every fee, on both sides of the pool, credited to a pull-based ledger only the payout address can spend.
  • Your launch-time fee split. Every token snapshots its split at launch; no later governance change can touch it.
  • Fee collection is permissionless. Anyone can trigger collection; claims can't be frozen or gated. Your money is always reachable.
  • Fixed supply. 1 billion, no mint, no owner, no transfer hooks.

Governed with public timelocks​

  • Default splits for future launches can change only through an on-chain action with a 48-hour public timelock — and the protocol-side proportions are frozen in bytecode, so the composition of the platform side can never drift.
  • Dead-token takeovers (CTO) happen only through a 7-day public on-chain notice. A takeover reassigns future fees only — fees already earned are settled to the original creator automatically, and creator vaults are never touched. The entire capability can be permanently burned on-chain if the community decides it should not exist.

Policy (we'll tune it, and we'll say so)​

  • The daily buyback-and-burn program: cadence, token count, and selection criteria.
  • The allowlist of paired assets (which tokenized stocks can be launched against) and the venues used to process fees.
  • Points, leaderboards, and other programs.

We ship fast and we'll modify things when the platform needs it — but only in the policy layer. The bytecode layer is forever.

Process​

The contracts went through repeated adversarial security review rounds before launch — independent review passes hunting for fund-loss paths, with every fix re-reviewed — and ship with a 220+ test suite including integration tests against live Robinhood Chain state. Fee processing runs through narrowly-scoped, keeper-operated machinery with on-chain pacing caps — liquidation sales are hard-capped in bytecode at 10% of any inventory per 30 minutes, and buyback conversions ship with the same pacing inside hard bytecode ceilings — so no single actor, including us, can move size against a pool in one shot.