Security model
Access control, fee caps, permanent liquidity lock, and operational recommendations for the LaunchRobin protocol.
What we protect
Liquidity rug
Adapter holds the V3 LP NFT with no withdraw — creators and admins cannot pull seeded liquidity.
Fee gouging
PlatformConfig enforces global caps on LP fee tier and creator share before updates apply.
Cross-platform abuse
Roles are scoped per platformId so one platform owner cannot administer another.
Emergency halt
Global and per-platform pause stop new launches without freezing existing V3 pools.
Role-based access control
| Role | Who | What they can do |
|---|---|---|
| DEFAULT_ADMIN_ROLE | Protocol owner (multisig) | Global pause, fee boundaries, core wiring, UUPS upgrades |
| PLATFORM_OWNER_ROLE | Per-platform owner | Update fees within bounds, set treasury, pause own platform, manage admins |
| PLATFORM_ADMIN_ROLE | Per-platform admin | Update branding only |
| TREASURY_MANAGER_ROLE | Per-platform treasury | Claim / manage platform fees |
Platform roles are derived via keccak256(abi.encodePacked("ROLE_NAME", platformId)), so roles never overlap across platforms.
Fee safety caps
| Parameter | Constraint | Enforcement |
|---|---|---|
| Creation fee | Fixed 0.001 ETH | Factory.TOKEN_CREATION_FEE |
| LP fee tier | 5000, 10000, or 25000 only | PlatformConfig._validateFees() |
| Creator share | ≤ 5000 bps (50%) | PlatformConfig._validateFees() |
Permanent liquidity lock
UniswapV3Adapter has no LP withdraw function. After createToken seeds the pool, the position NFT stays with the adapter forever — creator, platform owner, and protocol owner cannot remove that liquidity.
Fee distribution
Protocol revenue is the flat launch fee. Ongoing trading fees are Uniswap LP fees split between creator and platform on harvest — not a bonding-curve take.
Emergency pause
Global pause
Stops token creation across all platforms. Protocol owner only. Existing pools keep trading on Uniswap.
Platform pause
Stops creation for a single platformId. Platform owner only. Other platforms unaffected.
Reentrancy protection
- Factory.createToken — OpenZeppelin
nonReentrant - ETH transfers — bare
.callwith no calldata after state updates where applicable - Adapter liquidity — follows Uniswap V3 Position Manager settlement patterns
UUPS upgradeability
PlatformConfig, Factory, Registry, and UniswapV3Adapter use UUPS proxies. Only DEFAULT_ADMIN_ROLE can authorize upgrades via _authorizeUpgrade. Use a multisig for production admin keys.
Production recommendations
Multisig for admin
Gnosis Safe (or similar) for DEFAULT_ADMIN_ROLE
Separate treasuries
Don’t reuse the deployer key as protocolTreasury
External audit
Full audit of Factory + Adapter before mainnet reliance
Monitor pause events
Alert on any pause / unpause
Verify on explorer
Verify all proxy + implementation sources
Rate-limit the API
Protect the indexer in production
Separate RPCs
Indexer and frontend should not share endpoints