Security review

What was checked, what was found, and what still isn't covered

SkirkLabs published a Foundry-based security review of the on-chain protocol in August 2026: the launcher, the launched token, the tandem launcher and the read-only sidecar. The full report is linked below and the contract sources are public.

Read the report Contract sources

Findings

Critical

High

Medium

Low

Informational

All eight Low findings are resolved or mitigated: seven fixed in version 3, one mitigated with the residual risk documented. Of the five informational notes, three are resolved and two are accepted constraints, one of them actively monitored.

Test suites

Suite	Tests	What it pins
Core launcher	18	Launch invariants in both pool orientations, payment rules, floor rule, whale curve economics, fee split and gating, cold key governance, single entry rule
Read sidecar	10	Fee predictions equal actual claims to the wei, pagination boundedness and edge cases
Tandem launcher	6	Money conservation across both pools, parity rule, single claim surface, the contract rests at zero balances
Interface proof	1	An ABI mismatch fails in CI instead of in production
Byte parity	1	Annotated sources and published sources compile to identical bytecode
Fork parity	24	Six tests on each of four production networks: live bytecode versus current source, real wrapper semantics, raw ether launches against real pool managers
Curve study	13	The measurement harness behind the recommended band geometry
Total	73

What the contracts can and cannot do

There is no function anywhere in the protocol that removes pool liquidity.
There is no upgradeability and no privileged launch path: launch() is the only way in, and the team's own operator key pays the creation fee and the floor budget like anyone else.
Fees pay out directly from the pool manager, so the launcher never holds user funds between transactions.
Administration works through a relay: a cold key signs typed EIP-712 actions offline, each signature is one shot and carries a deadline.
The token is a standard, unmodified ERC-20 plus creator-gated metadata setters.

What stays open

Creator identity is claimed, not proven. Version 3 lets anyone launch on behalf of another address, so the creator field is a claim: the interface flags it when the payer and the claimed creator differ, and never treats that field alone as proof of identity.
On one supported network the canonical wrapped native token is a governance-upgradeable proxy, so its deposit semantics could in principle change. The worst case reviewed is a launch that reverts — a denied transaction, with no path to lost funds — and raw ether pools avoid the wrapper entirely.
The launcher ships with under 1,000 bytes of headroom against the EIP-170 contract size limit. New capability goes into stateless sidecars rather than the core.

Source available, not open source

The contract sources are published so they can be read and checked against the deployed bytecode — not so they can be reused. They are licensed under the Business Source License 1.1 with no additional use grant, converting to MIT on 2027-07-31. Production use of the licensed work before that date is not permitted.