Trust model, RTP Protocol docs

What the contracts enforce, every power each role holds, what the platform layer adds, and where the stated limits are.

Enforced by contract

No upgrade path on either path: no proxy, no upgradeable delegatecall, no self-destruct, no initialiser to front-run.
Pool liquidity has no removal path; only the graduator may add it.
Terms snapshotted per launch; no setter reaches an existing launch, its roots or its reserve lists.
Pull payments behind re-entrancy guards; trades never push value to third parties.
On Fixed-Price Launch: the treasury is an immutable constructor parameter of FundCore, FundHook and FundGraduator; ETH only for contributions, forced ETH never counted; settlement is atomic and constant-gas, and anyone can settle; refunds need no approval.
On Curve Launch: supply minted once; RtpToken has no owner, no later mint, no transfer tax and no blacklist. The Curve Launch treasury can change only after a 7-day public delay.

Powers in full, RTP Curve Launch (v1.0.0-r4)

Role	What it can do
Owner	Add, enable or disable launch tiers; approve quote assets and set their curve values; set the launch fee, at most 1 ETH. Effective at once, for new launches only. Revoke the attestor at once.
Owner, with a delay	Treasury, attestor and verification-gate changes wait 7 days in public. The owner or the current treasury can cancel a treasury or attestor change; only the owner can cancel a gate change.
Owner or treasury	Cancel a pending social-handle binding during its 72-hour notice.
No one	Pause trading or claims, move funds credited to others, touch a pool or upgrade a contract.

The deployed testnet instance. It comes from an earlier build (deployed 22 October 2026). Until the next instance deploys v1.0.0-r4, its owner can pause new launches and change the treasury at once, an attestor change waits 2 days, unbound social-handle balances can be swept after 60 days, the owner and the treasury are one address, and the buy-and-burn engine and the lens are not deployed.

Powers in full, RTP Fixed-Price Launch

Who	What they can do
Operator (the platform Safe)	Pause the creation of new fixed-price launches. After a 48-hour delay, and for later launches only: change the success fee (at most 3%) and the team limit (at most 25%). Enable yield-venue adapters after a 48-hour delay, each with a fixed capacity; disable one at once, which stops new deposits only. Propose a new referral attestor (7 days) or revoke it at once. Cancel an identity binding during its 72-hour public notice, as the treasury can.
Each platform	Set its own fee terms and payee within the compiled caps: up to 20% of the pool fee as its share and 20% as referral budget, a creation fee up to 0.1 ETH, a FundZap fee up to 1%. Changes reach later launches only; the payee can move at any time.
Never, by anyone	Pause trading, contributions, refunds, claims or settlement; move funds credited to others; touch a pool; change an existing launch; change the treasury; upgrade a contract.

Platform-layer controls (Fixed-Price Launch on RTP.fun)

Display on RTP.fun. Any address can create a launch, so look-alike launches can exist on-chain. RTP.fun shows as verified only launches that pass name, symbol and logo checks; others are labelled unverified, and verification is never inferred from on-chain fields.

Terms and regions. On RTP.fun, users and creators sign the applicable terms with a gas-free wallet signature before creating, contributing or trading, and participation is not offered in restricted regions. These controls do not cover a user who calls the contracts directly or uses another front end. Refunds and claims are never blocked.

Airdrop list rules. Lists come from the creator and are signed by the creator. Screening can only remove addresses, never add them. Eligibility may not depend on buying, holding or promotion, and snapshots precede announcements.

Design boundaries

On-chain rules cannot identify multiple wallets controlled by one person. A team using secondary wallets in public batches is addressed by platform-layer controls and documented in the threat model.
Platform-layer controls such as terms signatures apply on RTP.fun; they do not cover a user who calls the contracts directly or uses another front end.
Sequencer behaviour on each network is outside the contracts' control. The design assumes worst-case ordering, and the failure direction of a stalled settlement is a full refund.

Trust assumptions, RTP Curve Launch

Topic	What holds, and what does not
Opening tax	It raises the cost of buying in the opening seconds. A buyer who pays it can still buy in the launch block.
One party, several roles	On-chain rules cannot tell two addresses of one person apart. The same party can be creator, platform and referrer, and self-trading economics are disclosed rather than prevented.
Referrer check in the pool	The hook sees the router, so pool trades compare the referrer with the transaction's origin.
Verified tiers	They read an external attestation registry. A change in that registry affects new verified launches and creator-key transfers, not existing balances.
Social-handle bindings	They depend on the attestor key and on someone watching the 72-hour notice; the owner or the treasury can cancel a binding in that window and the owner can revoke the attestor.
Deferred migration	If the hand-over fails in the graduating trade, trading stays on the in-core pool until anyone completes it.
Buy-and-burn	Rate-limited and price-banded; it may not run when the market is moving, and it is not a price support.
Sequencer ordering	Outside the contracts' control on every network; the design assumes worst-case ordering.
Deployed instance	The testnet instance is an earlier build with the controls set out above.
Software risk	Smart contracts may contain undiscovered defects. Security review in progress: internal review rounds are under way and an external audit is being arranged. Mainnet deployment follows the review rounds and one complete verification run; the external audit may not be complete by then, and its results are published when it is.

Trust assumptions, RTP Fixed-Price Launch

Topic	What holds, and what does not
Several wallets of one person	On-chain rules cannot identify them. A team member can use another wallet in a public batch; front ends must say so.
Limits per batch	Per-address limits are counted in each batch and not across batches.
Team share in a partial raise	The limit on team batch plus reserve is measured against a full raise; in a partial raise their share of what was sold is higher.
One party, several roles	The same party can be creator, platform and referrer and take all of the pool fee except the protocol's share. That is allowed; the protocol's share holds.
Platform payee	A platform can move its payee at any time; fee numbers are frozen per launch, the payee is not.
Identity bindings	They depend on the attestor key and on someone watching the 72-hour notice; the operator can cancel a binding in that window and revoke the attestor.
Yield venues	A venue can lose value or refuse a redemption; that risk is the opted-in creator's alone.
Pools made by others	Claimed tokens can be placed in another pool before the official opening. The official pool's price and schedule are not affected.
Sequencer ordering	Outside the contracts' control on every network; a stalled settlement fails towards a full refund.
Software risk	Smart contracts may contain undiscovered defects. Security review in progress: internal review rounds are under way and an external audit is being arranged. Mainnet deployment follows the review rounds and one complete verification run; the external audit may not be complete by then, and its results are published when it is.