Security and operator permissions
The fixed-Lot contracts enforce backing, settlement and permission boundaries. Their security also depends on configuration, external assets and integrated contracts.
Contract protections
| Protection | Remaining limits |
|---|---|
| One-time launch issuance | Price and concentration can change |
| Immutable recipe | Correlation, issuer solvency and transfer restrictions remain |
| Full component delivery before minting | Later impairment remains possible |
| Permanently locked launch principal | Liquidity is finite; contracts carry risk |
| Atomic signed settlement bounds | Failed transactions can spend gas |
| Independent fee claims | Received tokens have their own market liquidity |
Verify contract, vault, pool and version through deployments and onchain records.
Upcoming managed-strategy permissions
A Dynamic Lot manager can trade within a mandate without general withdrawal rights over backing. This upcoming model is separate from the current fixed-Lot permissions below.
The operations wallet
A 2-of-3 owner Safe administers assets, routes, issuance/new-launch restrictions, recovery transitions and future-launch parameters. There is no mandatory timelock.
It cannot lend or seize Lot backing, withdraw protected principal, edit fixed recipes, change an existing launch's permanent fee or arbitrarily reassign recovery rights.
The Safe also administers the shared liquidity manager that owns the LotFlow hook. Its security depends on keys, modules and execution permissions. Safe architecture.
Fee commitments and enforced permissions
The deployed locker permits recipient-share changes for future collection within a 50% treasury cap. This does not change a project's permanent trading rate. The fee mechanism describes the current allocation; creator earnings explains historical entitlements and commitments.
No discretionary pool trading pause
Operators have no discretionary official-pool buy/sell pause, even during an exploit. This limits emergency containment. Issuance, new-launch and official-route controls are separate from the pool itself.
Guards, unavailable liquidity, transfer restrictions or chain failure can still stop execution.
Ownership handovers and signer changes
Operations-owned contracts require nomination of a nonzero successor and that successor's acceptance. Until then the current owner keeps authority and can cancel or replace the nomination. Unauthorized acceptance, renunciation and equivalent abandonment are prohibited. Public records track these changes.
Two current signers can replace a signer while preserving three independent signers and the threshold. Ownership changes do not change permanent fees or permit principal withdrawal. Creator fee-wallet transfers use a separate process.
Website and issuer boundaries
Moderation grants no contract-signing powers. Authentication, uploads, access and APIs are separate attack surfaces; sound vault code cannot prevent malicious signature requests.
Issuers retain controls including blocking, pausing, freezing and seizure. A Lot does not remove them. Issuer prospectus, pages 124–126.
Audit status
No independent Lots audit is published. Other protocols' audits do not cover Lots integrations. See product availability.