SECURITY

How ArkhamPad protects your funds

ArkhamPad's smart contracts went through two independent security reviews covering every contract, plus an automated scan with 102 detectors. Every issue found along the way was fixed and covered by tests.

Final review result

Critical0

High0

Medium0

Low (open)0

Two independent reviews, October 2026 · Solidity 0.8.26, OpenZeppelin 5.1, Uniswap v4 · Automated scan: 0 confirmed issues

What the contracts guarantee

You sign the exact termsEvery trade, launch and withdrawal is an EIP-712 message with the amount, minimum received, fee and deadline inside it. The relayer that submits it cannot change any of them, and each signature works only once, on one chain.

No custody between tradesThe router finishes every trade in a single transaction and holds nothing afterwards. Unused money is refunded in the same transaction.

Liquidity is locked foreverWhen a coin graduates, its liquidity moves into a Uniswap v4 pool position held by the contract. There is no function that can withdraw or transfer it.

Graduation can't be front-runA dedicated hook lets only ArkhamPad's pool builder open a coin's pool, at the price set by the bonding curve.

Creator locks are enforced on-chainIf a creator locks their coins, the coin contract itself blocks every transfer out of their wallet until the lock ends.

Fixed-supply coinsCoins launched on ArkhamPad have a fixed supply and no owner controls: nobody can mint more, block sellers or add a tax.

Limited admin powersAdmin rights cover settings such as pausing new buys in an emergency. They cannot move user funds or locked liquidity, and selling is never paused.

A capped fee vaultPlatform fees are held in a vault. The automated key that pays referral rewards can only send rewards, up to a fixed daily limit.

What was reviewed

All nine contracts: PadCoin, PadCurve, PadHub, PadRouter, PadPoolBuilder, PadInitGuard, PadPromote, PadExtSwap and PadFeeVault. The reviews focused on:

EIP-712 signatures, nonces and replay protection · Gasless relayer permissions · Bonding curve pricing, rounding and the final fill · Graduation accounting and Uniswap v4 pool creation · Pool trading, quotes and callback authorization · Creator token locks · Fees, buyback and treasury accounting · Swaps for coins from other DEXs · Admin and guardian roles · 6- and 18-decimal dollar tokens

Issues found and fixed

Severity	Finding	Resolution
High	A launch refund could include funds already held by the hub	Fixed. Refunds now use only the current transaction's balance change. Regression test added.
Medium	Pool callbacks relied on a single caller check	Fixed. Callbacks now also require that the contract itself started the operation.
Medium	Minimum-output on swaps of fee-on-transfer tokens	Fixed. The minimum is now checked against what actually reaches the user's wallet.
Low	Tokens sent to contracts by mistake could not be recovered	Fixed. Admin-only recovery added for stray tokens.
Low	Fee vault could be deployed without a payout key	Fixed. Deployment now rejects it; zero-amount payouts also revert.

Two informational notes remain by design: a tiny amount of rounding dust can stay in the pool builder after graduation, and the pool's opening price can differ from the curve's final price by a negligible amount. Both are tested.

Tests

The contracts run more than 100 unit and fuzz tests on every change, plus fork tests against real networks (Base, Robinhood Chain and BNB Chain) covering the full path: launch, trade, graduation, pool trading and buyback, with both token orderings and 6- and 18-decimal dollars.

Good to know

Security reviews lower risk but can't remove it. Meme coins are highly volatile and most lose value. These were independent peer reviews, not an engagement with an audit firm. Only trade what you can afford to lose. Found a problem? Write to [email protected].

How to spot a rug pull Help centre