Chapter 08

Architecture

Four contracts, none upgradeable, none with an owner. The design goal was that the interesting question — can somebody take the money — is answerable by reading two of them, and that both are short enough to read in a sitting.

The map

Deployment graph

LaunchFactory
   │  launch()
   ├──► ModelToken            (one per launch, fixed supply, all of it into the pair)
   ├──► RevenueVault          (one per launch, holds ETH)
   └──► UniswapV2Pair         (created and seeded here; its LP goes to 0x…dEaD)

TradeRouter
   │  buy() / sell()
   ├──► RevenueVault          (the fee)
   └──► UniswapV2Router       (the rest of the trade)

RevenueVault
   │  buybackAndBurn()        (permissionless)
   └──► UniswapV2Pair ──► ModelToken.burn()

The contracts

LaunchFactory: Deploys a token and its vault, creates and seeds the pair, burns the LP, and optionally buys the creator a stake — one call. Holds no balance between transactions and has no privileged call into what it deployed.
ModelToken: ERC-20. Fixed supply minted in the constructor, no mint path afterwards, no transfer hook, no owner. Stores the provider model id immutably.
RevenueVault: Holds ETH for one token. One state-changing external function, buybackAndBurn, permissionless, with the burn address hard-coded as the destination.
TradeRouter: Wraps a trade: a slice of the ETH side to the token's vault, the rest to the Uniswap router. No owner, no balance between transactions, and a fee ceiling in its constructor.

Uniswap's factory, router and pairs are used as deployed by Uniswap. We do not fork them, wrap them or proxy them.

What has power over what

Nobody can mint. There is no path to increasing supply after the constructor, so “the team minted more” is not a failure mode that exists here.
Nobody can withdraw a vault. The only way ETH leaves is through a swap on that token's own pair, ending in a burn, in one transaction.
Nobody can pause a market. The pair is Uniswap's, and neither the creator nor the protocol has a hook into it.
Nobody can withdraw the liquidity. The LP tokens were minted to an address with no key as the pool was created.

Addresses

The contracts below are the deployment this interface reads. Check an address against the explorer before you approve anything — a documentation page is a good place to look up a contract and a bad place to trust one.

LaunchFactory: 0xc6C7B8979B3C76a79aD68266D9E1b9eC6AB84680
TradeRouter: 0x0842346fF54C951e99B3d989414372A99452822d
Uniswap V2 Router: 0x89e5db8b5aa49aa85ac63f691524311aeb649eba
WETH: 0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73

Chain: Robinhood Chain, id 4663
Uniswap: V2 factory and router, as deployed on that chain
Burn address: 0x…dEaD, hard-coded in the factory and the vault
Deployments: None yet