Safety and pausing
Pinned code
Each launchpad adapter is pinned to the codehash of the Pons contracts we reviewed: the launch factory and the deployer that builds every curve. If Pons redeploys or swaps either one, the hook refuses to route until the new code is reviewed and pinned again.
The keeper
An off-chain keeper watches Pons' proxy slots, the hook's balance and our own health every block. If something changes unexpectedly, it pauses the adapter and alerts the team.
Who can do what
| Role | Can | Can't |
|---|---|---|
| Guardian / keeper | Pause an adapter right away | Unpause, move funds, change fees |
| Owner (Safe + 48h timelock) | Unpause, pin code, set fees up to 1%, add adapters | Touch user tokens, skip the timelock |
| Anyone | Open a lock for an eligible token | — |
Pausing only stops new swaps through the lock. Your tokens stay in your wallet and you can always trade on Pons directly. See the live routing status.
The hook never holds funds
Between swaps, the hook's balance is checked to be zero. Any edge-case refund at graduation is sent straight back to you within the same transaction.