Security model

​

What cannot happen

• The supply cannot grow: no contract has a mint function.
• Liquidity cannot be withdrawn by anyone: the factory holds the launch position and has no function that removes it, and the hook has no liquidity permissions.
• Transfers cannot be blocked or taxed: the coin is a plain ERC-20 with no owner and no transfer logic.
• A sell cannot be reverted by the hook, in any block.
• A coin's fee, anti-snipe, holder-rewards and buyback shares, max-wallet window, starting cap and pair cannot be changed after launch.
• Fees owed to a creator can only be paid to the coin's current creator, and the role moves only by the creator's own two-step transfer or a community takeover after 30 idle days. Holder rewards can only be claimed by the holders they were recorded for, and cashback and referral rewards only by the user they were credited to.

​

No operator

There is no admin and no operator. No contract in the set has an owner after deployment. Nothing can be paused, hidden, blocked, overridden, re-pointed or withdrawn by anyone. What each contract fixes at deployment:

• Factory. No pause or resume of launches. No hidden flag. No metadata override: only the creator's own setCreatorMetadata, and metadataOf(token) returns the creator's metadata if set, else the coin's own. No pair block list. No collect function of any kind: launch liquidity cannot be withdrawn by anyone. No launcher allowlist and no launchFor. The router is fixed at deployment. The platform fee recipient is an immutable address set at deployment; pushPlatformFees stays, callable by anyone, and pays that address. The starting cap presets are fixed at deployment: $3,000, $10,000 and $25,000. The cashback and referral shares are constants: 25% and 25% of the platform part. The creator features are unchanged: 60% of what is left after the pots, claimCreatorFees, setCreatorMetadata, transferCreator and acceptCreator, the community takeover after 30 idle days with a 5% stake and a 7 day delay, and poke.
• Hook. The factory and router addresses are wired once in the deployment sequence and then fixed. The reward split is constant. setCreator can only be called by the factory, for a creator transfer or a takeover. The fee engine, anti-snipe, max wallet, buyback and holder rewards are unchanged. The hook has no liquidity permissions.
• Oracle. The list of pair tokens and their HyperCore markets is set in the constructor at deployment and can never be changed or extended. It still reads live prices from HyperCore's price precompile at 0x0000000000000000000000000000000000000807 at launch time. A token not in the list cannot be launched against (NoPrice).
• Token deployer. The factory address is wired once at deployment, then fixed. Coins are EIP-1167 clones of a sealed implementation: no owner, no mint, no pause, no tax, no blacklist.
• Deployer. Performs the one-time wiring during the deployment sequence; its setup rights are then renounced, and owner() on the factory returns the zero address.

There are no operator events, because there are no operator actions. Adding a new pair token means a new Liqio version with its own factory and oracle. Coins on an older version keep trading there forever, and the site can list more than one version.

​

Verification

The factory, the hook, the router, the token deployer, the oracle and both coin implementations are verified on HyperEVMScan and on Sourcify with exact source matches at deploy. Each coin a user launches is a minimal-proxy clone of a verified implementation, so HyperEVMScan resolves it to the verified source without any action from the creator. Addresses and links are on the Contract addresses page. Review the verified source before relying on anything written here; the code is authoritative.

​

What Liqio depends on

​

Risks

• Price. A coin's price is set by trades in a pool seeded only with the coin itself. Early buyers set the price for later ones, and the price can return to the opening level if everyone sells.
• Liquidity. All liquidity is single-sided and above the current price. Large sells move the price a lot; slippage protection on the site and in the router is your responsibility to set.
• Stock tokens. A stock-paired coin's value tracks the wrapped xStock, whose price follows NYSE hours while the pool trades at any hour, and which the issuer governs under its own terms. Fees and rewards from such a coin arrive in the stock token.
• Launch windows. Buying inside an anti-snipe window costs up to 30% extra, by design. Check the current buy fee on the coin page.
• Routing. Trading a stock-paired coin in HYPE passes through the stock's own pool, with its own fee and slippage; a stock with no route must be bought and sold in the stock itself.
• Max wallet. During a max-wallet window a buy over the cap reverts; the cap counts per originating wallet, so a smart wallet relayed through a shared bundler shares the bundler's allowance.
• Contracts. No audit is claimed on this site. The contracts are open source and verified at deploy; read them before relying on them.
• No operator. Nobody can pause launches, hide a coin, block a pair or withdraw launch liquidity, so there is no admin key to lose or misuse. Equally, nobody can step in if a coin or a pair token turns out to be harmful; what the contracts do at deployment is what they do forever.

​

Disclosures

• Liqio does not custody funds. Coins are held in users' wallets, liquidity in the Uniswap v4 PoolManager, and unclaimed fees in the hook.
• Liqio does not promise or imply any return.
• Coins launched through Liqio are created by their creators. They are not securities issued by Liqio.
• Nothing on this site is financial, legal or tax advice.