Security and trust
What is genuinely locked, what an admin key can reach, and every way we know of that this can still go badly for you.
What is locked, and by what
| Supply | No mint function exists in FlowToken. Not gated, not renounced. Absent. |
|---|---|
| Liquidity | Held by the launchpad, which has no function that decreases a position or transfers one. Not a timer, not a vault. |
| Fee and split | Written once at registration. The hook reverts on a second registration for the same pool and has no setter. |
| Beneficiary | Same. Written once, no setter. |
| The fee ceiling | MAX_FEE_BPS = 200 is a constant checked at registration. No pool can ever charge more than 2%. |
| Your accrued balance | Only the address that earned it can move it, and only to a destination it names. |
What the admin key can do
Worth being precise, because most launchpads are vague here. The admin can:
- set the launchpad address on the hook, once, immediately after deployment;
- point the treasury at a different address, which affects future credits only;
- change the flat launch fee for future launches;
- hand the admin role to someone else.
It cannot:
- change any existing pool's fee, split or beneficiary;
- touch a balance already credited to any address, including moving the treasury's own history;
- withdraw, move or reduce liquidity in any pool;
- mint, pause, block or freeze any coin;
- upgrade either contract, because neither is behind a proxy.
There is a test for this
test_adminCannotTouchAccruedBalances earns a fee, moves the treasury, and asserts the beneficiary's balance is untouched.What can still go wrong
The contracts are not audited
They are short, they use Uniswap's own libraries and OpenZeppelin's ERC-20, and 26 tests cover the fee in all four swap shapes, the split, claims, a hostile recipient, access control and the deploy path. None of that is an audit. Nobody independent has reviewed this code. Read it yourself before sending anything you would miss.
Seeded liquidity is unrecoverable
By design, and it cuts both ways. If nobody trades your coin, the ETH you put in sits in the pool forever and there is no mechanism, and no favour anyone can do you, that gets it back.
Launches can be sniped
Trading is live in the transaction that creates the pool. There is no anti-bot window, no first-block tax and no allowlist. A bot watching the mempool can be the first buyer. This is a deliberate omission rather than an oversight: every mitigation we considered either hands the deployer a lever worth abusing or punishes real buyers too.
A second pool can exist without the hook
Anyone can open another pool for your coin with no hook attached, and no fee would apply there. They would have to supply the liquidity themselves, since all of yours is locked in the Etherflow pool, but the gap is real. See where the fee is taken.
The recipient address is permanent
If you nominate an address you do not control, or one that cannot claim, the fees accrue there and stay there. There is no recovery path and no admin override, which is the same property that makes the terms trustworthy.
Most coins go to zero
Fee sharing changes where a trading fee goes. It does not create volume. A generous share of nothing is nothing, and the overwhelming majority of coins launched on any platform never trade meaningfully.
Verifying it yourself
- Both contracts are verified on Blockscout. Read the source there rather than trusting this page.
- The coin page shows the fee, the split and the nominated address read live from the hook. If an announcement disagrees with the coin page, the coin page is the truth.
feesByPoolis public, so anyone can check what a pool has actually paid out without asking anyone.
Nothing here is financial advice