TESTNETRobinhood Chain testnet (id 46630). USDG here is a faucet token anyone can mint — prices, liquidity and fees on this page are not real money.

Roles and Limits

The buzz

"Who can rug this?" is the only question that matters, so here is the whole answer with no adjectives and no cope. Three keys exist in the hook, and a fourth owns the seed's time lock. Each can do a short list of things and NOTHING else. The list of things nobody can do is longer, and it is the part we are proud of. Print it. Frame it. Check it against the bytecode.

The boring part

The keys

Key Can do Bound by Can it be changed?
poolCreator create the one pool; open trading (once) pair, fee flag and tick spacing enforced; opening is one-way No. Immutable. Used at launch, then it has nothing left to do.
creator receive its share of the protocol fee nothing else — no other function checks this address Yes: two-step transfer (propose, then the new address accepts)
controller setConfig: protocol fee, creator share, regime/impact blend, k values
setCompoundBounty
setFeePaused		 protocol fee ≤ 1%; bounty ≤ 0.5% and ≤ 25 USDG; LP-fee band ends are constants; k ≠ 0 Yes: two-step transfer
seed locker owner collectFees (the seed's LP fees, liquidity untouched)
extendLock (later only)
withdraw — only after unlockAt		 one position, once; the lock never shortens; nothing else in the contract Yes: two-step transfer

At launch all four are the same hardware wallet. Everything but poolCreator is expected to move to a multisig once the rehearsal has exercised the transfer paths (The Launch). Four hats, one head, for now — and every hat is listed.

Things nobody can do 🚫

  • Withdraw the locked liquidity. There is no function. Not a disabled one — none.
  • Withdraw the seed before its unlockAt. Not even its owner; the locker has no rescue path, because a rescue path is a rug path. Every "emergency withdraw" you have ever seen rugged was an emergency for someone else.
  • Mint FLY. The token has no mint function; supply was created once.
  • Halt trading. Once openTrading() has run, nothing in the hook can refuse a swap again. setFeePaused stops the fee, not trading. You can always leave. That is the point.
  • Raise the protocol fee past 1%, or the LP fee outside 0.20–0.75%.
  • Upgrade anything. No proxies. What you read is what runs, forever.
  • Create a second pool through this hook, or change the pair.
  • Take the pot anywhere but into the pool. compound() has exactly one destination.

Things the controller can do that you should know about

  • Turn the protocol fee off (setFeePaused(true)). This exists as a circuit breaker: if the stablecoin issuer ever froze the hook's address, every swap would revert inside the fee path, and this switch lets trading continue without the fee. It is a way to make trading cheaper in an emergency, not a way to take anything.
  • Set the creator's share anywhere from 0% to 100% of the protocol fee. At 100% nothing new reaches the floor; at 0% the creator earns nothing. It is 50% at launch and any change is an on-chain event (ConfigUpdated). If it ever moves, the chain screams it. Watch the event, not the tweet.
  • Lower the protocol fee to zero.

Things anyone can do

  • Add or remove their own liquidity.
  • Call compound() and be paid for it.
  • Call burnAccruedFly().
  • Read everything: every number on the dashboard is a public view. Don't trust. Verify. Then vibe.

Events to watch, if you watch such things

TradingOpened, ConfigUpdated, FeePausedUpdated, CompoundBountyUpdated, CreatorTransferStarted / CreatorTransferred, ControllerTransferStarted / ControllerTransferred, LiquidityLocked, AccruedFlyBurned, WeatherChanged, ProtocolFeeCollected. On the seed locker: Locked, LockExtended, FeesCollected, Unlocked, OwnershipTransferStarted / OwnershipTransferred. Set alerts on these and you will know about any change to the machine before anyone can spin it. 🪰