Safety and risks

Enforced on every coin

• The mint authority is revoked in the launch and there is no freeze authority: no more coins can be made and no holder can be frozen.
• The metadata (name, symbol, picture link) is immutable.
• The whole supply goes into one Orca position at the launch price, locked for good with Orca’s own position lock. Nobody can withdraw it, not the creator, not rocapad (How the pool works).
• The pool is created in the coin’s first transaction, so nobody can create it first, and the deposit refuses any price but the launch price.
• rocapad lists a coin only after checking all of this on chain, and the coin’s fee mode is written into its launch transaction for anyone to read.

What the keeper is trusted with

rocapad runs no program of its own. Everything after the launch that is not a trade is done by its keeper, a service holding the platform wallet’s key:

• collecting each coin’s fees from its locked position;
• splitting them, 1% of the trade to the platform and 0.74% to the fee mode;
• paying the creator, running buybacks and burns, and paying holder rewards (Fee modes);
• keeping track of what each coin is still owed, and selling the platform’s coin share back into the pool.

Each coin’s page shows its ledger: every collection, split, payout, buyback and burn, with its transaction. The risks of this trust are listed below.

Tested, not audited

Risks we accept

These are known, chosen trade-offs. They are listed so you can judge them yourself.

The keeper holds fees until it pays them

Collected fees go to the platform wallet, a key the keeper runs online, and wait there until the keeper pays each coin's fee mode. While they wait they are custodial: a stolen platform key could take them, and if the keeper stops, payouts wait until it runs again. The platform's own share also waits there until the admin claims it, and a claim only ever pays the owner's admin wallet.

The split and the fee modes are off chain

Nothing on chain enforces the 1% and 0.74% split, the buybacks or the rewards: the keeper does them. Every keeper transaction carries a label naming the coin and what it did, and the indexer rebuilds each coin's ledger from those, so anyone can check what was collected and paid.

The platform wallet owns every position

It cannot withdraw any liquidity, but it collects every position's fees and can hand a locked position to another wallet (that is how its key would be replaced). A stolen platform key could redirect the fees of every coin from then on.

Orca can change the pool fee

The 2% fee and Orca's 13% share are Orca's settings. Orca can raise or lower them on any pool (up to 6% and 25%), which changes what traders pay and what the platform and the fee modes earn. Orca can also upgrade its program; the lock on every coin's liquidity is Orca's own.

Anyone can add liquidity to a pool

A coin's pool is an ordinary Orca pool. Anyone can add a position of their own, earn the fees of the trades it fills and so take part of what the platform and the fee mode would have earned, or move the price for a moment. Quotes on this site read only the coin's locked position.

A launch can be blocked halfway

Between the two launch transactions anyone can move the empty pool's price for free. Finish launch moves it back for free, unless someone has added liquidity in the way: then the coin can't be finished and the rent of the first transaction is lost.

Holder rewards trust the keeper's reading

The keeper's reading of who holds the coin decides who is paid. A wrong reading would pay the wrong holders, at most one round's pot. Every payout is a transaction anyone can check.

Buybacks can be front-run

Anyone can trade just before and after a buyback. Each run moves the price at most 1%, which keeps what an attacker can gain small next to the pool fees they pay.

Custodial Telegram wallets

The bot keeps its users' keys. A leak of its database and master key would drain every bot wallet.

A creator wallet can't change

Payouts of an abandoned coin can't be taken over by its community.

Stock issuers

The issuer of a tokenized stock can move, burn or freeze the stock in a coin's pool or in the platform wallet, and switching on its transfer hook could halt those coins.

Moderation

The chain is permissionless: anyone can trade any coin there. This website and the bot can hide a coin (for example after a report) and pause new launches, and rocapad stores each coin’s picture and description, but nothing on chain can be removed. A hidden coin still trades in its pool, and the keeper still pays its fee mode.