Protocol
Safety and risk
What holds no matter who launched a token, and what does not.
Where things stand#
The deployment runs on GIWA Sepolia. Admin keys are held by a single wallet rather than a multisig.
Risks worth reading before you trade#
Tokens here are created by users. There is no review, no allowlist, and no quality signal anywhere in the product.
- Names and images can be copied. Two launches can look identical. The address is the only reliable identifier.
- Liquidity can be thin and prices can move fast. A quote is an estimate; the amount you receive can differ, which is what slippage settings are for.
- Graduation is not an endorsement. It means a curve filled, nothing more. It does not promise future liquidity, price, or an exit.
- Infrastructure can fail. Wallets, RPCs, explorers, and our own indexer all can. Displayed numbers are read from the chain but they are not execution guarantees.
- Nobody can undo a signed transaction. Read the wallet prompt, including which contract you are approving.
And a plain one: we will never ask you for a seed phrase or private key, and we will never ask you to send funds to process anything.
What holds regardless of who launched a token#
These are properties of the contracts, not policies we enforce by hand:
| Supply | fixed at creation, no mint and no burn |
| Opening pool liquidity | locked, with no withdraw function anywhere in the locker |
| Fee rates | constants in deployed code, not settings |
| Token metadata pointer | written once, with no setter for anyone |
| Contract logic | not upgradeable, no proxies, no admin implementation slot |
| Your balances | only movable by you |
Because nothing is upgradeable, the rules a launch shipped with are the rules it keeps. The tradeoff is that fixes arrive as a new stack rather than a patch — see network.
How the code has been checked#
| Layer | What it covers |
|---|---|
| Unit and integration tests | behaviour across the launch and DEX contracts, plus the indexer and the app |
| Property-based fuzzing | curve quoting, fee arithmetic, and guard conditions under randomised inputs |
| Stateful invariant runs | supply, custody, and fee-ledger properties across long randomised call sequences |
| Static analysis | every finding triaged and reasoned rather than suppressed |
| Source verification | all seven stack contracts verified on the explorer |
The properties those runs hold to, in plain terms: supply never changes, a pool always holds at least what it owes, accounting never exceeds custody, one person's trade cannot spend fees another has earned, the fee ledger always balances across handovers, a launch's lifecycle only moves forward, and LP share value never decreases.
One lesson from the last review is worth passing on: a fully green test suite proved nothing about the issues that review found, because none of the tests exercised the path an attacker would take. Every fix since then ships with a test that fails against the old behaviour.
Graduation on this stack#
The graduation path is covered by the local suite and was exercised end-to-end on an earlier V4 deployment. This
2026-07-28 stack has not yet run a live graduation on-chain (~3.68 test ETH). Read lockedPair(token) and
lockedLiquidity(token) on the locker once one does.
What is still centralized#
"Decentralized" gets used loosely, so here is the specific version:
| Power | Who holds it | Can it affect your token? |
|---|---|---|
| Where the protocol's own fee share goes | our deploy key | no |
| Which launch factory is allowed to graduate | our deploy key | it gates graduation for future stacks |
| One-time wiring between contracts | our deploy key | already used and not reusable |
| A token's fee recipient | immutable feeAdmin | yes, for future creator fees only |
| The locked opening liquidity | nobody | it cannot be withdrawn at all |
| Supply and metadata | nobody | no mint, no burn, no repointing |
Nothing on that list can mint tokens, move your balances, drain a curve, or unlock liquidity.
Known gaps#
Tracked, not hidden:
- Admin keys are one wallet. Moving them behind a multisig is a requirement before mainnet.
- Coverage is uneven. The curve and the pools carry invariant suites; the router is covered by unit tests only.
- New tokens start unverified on the explorer, until we submit them. See network.
Reporting something#
If you find a problem, please tell us privately first and give us a chance to ship a fix. Since nothing here is
upgradeable, a fix means a new stack and a coordinated cutover, which takes a little time. Reach us at
contact@joseon.fun.