Security model

What is enforced by bytecode, what is operated by us, and exactly where the trust boundaries sit.

This page is deliberately unvarnished. Security claims in this space are usually marketing; ours are scoped statements you can check. Three categories: what cannot happen, what we operate, and what you should know.

Enforced by bytecode: cannot be changed by anyone

The holder share cannot be redirected. The 24% travels through an immutable, ownerless splitter: no owner, no setters, recipients fixed at deploy. The fee-distribution legs feeding it carry genesis floors in bytecode, so no configuration on any path can move the holders’ money elsewhere.
Launch-time choices are permanent. The creator/buyback slider, anti-sniper setting, earnings splits, and, for tokens launched with a creator vault, the trading fee and holder dividend share are written once with no setters. Renouncing a creator vault can only send more to holders.
Token dividends can’t be skipped. Since creator vaults went live (October 4, 2026, 16 UTC), a token can only trade while its creator NFT sits in its own creator vault. The vault pays only the token’s holders and the recipients fixed at launch, and no owner function, ours included, can move its funds or a token’s dividends.
Liquidity is protocol-locked. There is no liquidity-pull path for creators or for us.
Escrows pay only their owners. Creator revenue, referral cuts, and X-handle escrows each pay exactly the address their on-chain records designate. The platform holds custody of none of them.

What we run, and how you can check it

The payout keeper. Our service closes each daily round, runs the published formula and posts the result. Every round’s full dataset is published before its root goes on chain, and each root then waits through a 1-hour public review in which a wrong one can be challenged and revoked, so every payout can be checked: see Verify any payout. The same rounds apply the v2 fee split, including each v2 token’s refund to its vault.
The rewards distributor’s owner. The distributor has an owner role that can set a payout root without the 1-hour review, kept for emergencies. Daily rounds never use it: they go through the keeper and the public review. The key is being moved to a multisig.
The X verification signer. When a creator pays a recipient by X handle, a platform key confirms which wallet belongs to that handle after the person logs in with X. That is all it can do: it can never move funds.
The protocol owner. Can lower the total swap fee or grant fee exemptions, within caps fixed in bytecode. Either way every party’s share changes by the same proportion, so income is never moved from one party to another. It can lower the 5% referrer share (never raise it), which leaves more of each fee for the other parties. It can also switch the v2 fee calculator off, which returns v2 tokens to the 1.25% fee while their vaults and dividends keep working, and it approves the templates that new launches use.
The harvest bot. Our bot harvests v2 tokens’ vaults automatically, so holders don’t have to. Anyone can harvest, so if the bot ever stops, nothing is lost: fees wait safely until someone does.

v3 tokens

v3 tokens run on their own contracts, next to the ones above, which v3 didn’t change.

Enforced by the v3 contracts:

UBI holders get at least 13% of every v3 fee, and the creator stream at least 70%. The contracts split each fee on the trade itself. The cut for UBI holders and the protocol together can move only within limits written into the code, from 23% to 30% of each fee. At launch it is 23%: 13% to UBI holders and 10% to the protocol. The protocol’s part is capped at 10/23 of the cut, so UBI holders never get less than 13%.
Launch-time choices are permanent: buy and sell fees, the anti-snipe fee, buyback, holder share and recipients.
Token dividends can’t be skipped. A v3 token trades only while its creator NFT sits in its own vault, and the NFT can never leave it. No owner function moves funds out of a vault or a token’s dividends.
Liquidity is protocol-locked, as on every ubi.fun token.

What the protocol owner can do on v3:

Set the cut for UBI holders and the protocol within the limits above, and lower the protocol’s part of it.
Approve new pairs, each with its own price contract. A pair’s settings are copied into each token at launch, so later changes never touch tokens already launched.
Community takeover. After reviewing a community’s request, hand an abandoned token’s future creator earnings to a new team. The contract allows it only after 30 days with no claim by a current recipient, never on a renounced token, never in a token’s first 30 days or within 30 days of an earlier takeover, and it never moves credit already earned or any other setting. See Community takeover.
The same caps as above on fee exemptions and the referrer share (0% to 5%, never more), and it can switch the v3 fee calculator off, which returns v3 tokens to the 1.5% base fee.

What we run for v3: nothing that holds or routes funds. The site builds your trades. Our harvester only calls public functions anyone can call: a token’s harvest, which is also on its page, and the fee splitter’s distribute. The Underwater engine publishes each hour’s Underwater payouts to their own rewards distributor: its key could misallocate what sits in that distributor and nothing else, the distributor pays out only through claims, and each new set of payouts waits an hour, during which the protocol owner can revoke it. The USDC converter, which pays UBI holders’ gold rewards in USDC for those who turn it on, has no owner: it takes only the gold a holder’s claim just paid them, sells it in one swap that reverts more than 1% under gold’s 30-minute average price, and sends the USDC to that holder.

The pair asset is not ours. Gold-paired tokens depend on XAUm, which its issuer can upgrade and use to block addresses; see What to know about XAUm.

Audit lineage, precisely stated

The holder pool’s vault is Morpho’s Universal Rewards Distributor, a widely used contract audited by Cantina (managed review), OpenZeppelin, and a Cantina security competition.
The launchpad contracts derive from the Flaunch protocol codebase, which has undergone multiple third-party audits, most recently Enigma Dark’s security review of the Flaunch v1.1 protocol upgrade (March 2025). Our modifications are concentrated in the fee-model configuration and the Arc port. They reroute fee shares between recipients fixed at deploy; they add no proxy or upgrade path, no minting, no custody, and no new admin power. Nothing in them creates a path to pull liquidity or seize user funds, and the “enforced by bytecode” guarantees above are properties of the modified code itself.
The creator vault contracts (the vault, the dividend-paying token template, and the fee calculator, live since October 4, 2026, 16 UTC) are new code written for ubi.fun, not part of the Flaunch lineage. They went through several independent review rounds and were tested against live mainnet state before launch. We don’t describe them as audited.
The v3 contracts are built on Flaunch v1.3.3’s verified source with a few small edits to its files, concentrated in the fee-distribution limits and the buyback wall’s burn. Our own v3 contracts (the token template, the fee calculator, the vault, the fee splitter and the price contracts) are new or adapted code. They went through several independent review rounds and were tested against live Arc mainnet state before launch. We don’t describe them as audited.
The distributor is audited; the contract lineage is audited; our composition of them is published, verified on-chain, and open to inspection.

Found something? Contact us on X or Telegram (@ubidotfun). No forms.