What this cannot do.
Everything below is either verifiable on-chain or a statement about work that is not finished. Where the site can read the answer rather than assert it, it does — so these entries change on their own when the facts do.
Pons can redirect the fee stream.
The launchpad factory that created SIG is owned by 0x263ed295…19dd. That owner can call setCreatorFeeRecipient(token, anyone) and point this protocol's income somewhere else. There is no timelock on it and no notice period. It also has rescueFees() and rescueCurveFees(address).
None of that is reachable from our contracts and none of it can be removed. Verified by simulating the call: it is permitted from the factory owner and reverts from everyone else. SIGNET is trustless with respect to us. It is not trustless with respect to Pons. Anyone telling you a launchpad token's fee stream is beyond all reach has not read the factory.
No external audit.
There are 63 tests, including property tests driven by random operation sequences and checked by deliberately breaking the contracts to confirm the tests catch it. That found four real bugs — a keeper that stopped silently after one tick, a fee handover that called a function only the launchpad owner can call, a swap adapter written for the wrong DEX entirely, and a price quote that would have blocked every purchase.
Those were found because things were run against reality rather than against assumptions. That is not an audit. Whatever else is in there is still in there, and the vault holds staker funds while an automated operator signs transactions with a hot key.
An operator key signs every cycle.
The operator can only commit, execute and reveal within the caps the treasury enforces — it cannot withdraw, cannot mint, and cannot point a trade anywhere the contract does not already allow. But it is a live key on a live machine. The guardian can rotate it behind a 48-hour public timelock, and can pause new cycles immediately.
Neither of those helps in the window between a key being taken and anyone noticing. What limits the damage in that window is the per-cycle and per-day spend caps, not our reaction time.
Fees land elsewhere for the first 72 hours.
Handing the fee stream to the treasury is a three-step process with a 72-hour timelock built into the launchpad, followed by a 72-hour window in which it must be completed. Until that finishes, creator fees arrive in the launch wallet rather than the treasury. That is the launchpad's design, not a choice, and it cannot be shortened.
Nothing here is a yield promise.
Each epoch pays min(reserve × 0.20%, staked × 0.44%). The rate is an output of how large the reserve is relative to what is staked — it is not a target, not a floor, and nobody is committed to defending it. It falls when the reserve shrinks and when more is staked against the same reserve. A reserve that is never refilled decays geometrically and the rate decays with it.
The upside of defining it that way is the thing this protocol is built on: the vault can always pay what it says it will pay, because it only ever promises a fraction of what it already holds. See the live figures.
If you find something true that is not on this page, say so publicly and it will be added.