Security
Security Model
What is guaranteed by code, and what is not.
Guaranteed by code
- a launched market's rules cannot be changed — by anyone
- the initial liquidity position cannot be withdrawn — by anyone
- the launch token has no mint, no pause, no blacklist and no transfer tax
- a market cannot open against a quote whose oracle is stale, non-positive, mismatched, or mid-corporate-action
- a market cannot open at a price above the requested valuation
- total buy-side quote fees at block zero cannot exceed 10%
- every fee component is capped in
Limits.sol
Not guaranteed
- that a market has liquidity, volume, or any value
- that trading halts or asset-status changes are respected — those are off-chain warnings
- that the sequencer was up when a price was published; see Oracle Failure
- that the indexer, the API or this interface are available
- that a quote asset's issuer behaves as expected
How the design reduces surface
| Decision | What it removes |
|---|---|
| no upgradeability anywhere | the entire class of "the admin can change it later" |
| no owner on the locker | any privileged path to the liquidity |
| rules frozen before pool initialisation | the window where a tradeable pool has open configuration |
| a nearly-empty token contract | transfer-time surprises for integrators |
| experimental modules ship disabled, asserted at deploy | shipping a raceable payout by accident |
| previewer shares production math | drift between what is shown and what executes |
Continue to Trust Assumptions.
TAPEZERO is an independent protocol and is not affiliated with Robinhood, Uniswap or Chainlink. The contracts are unaudited. Nothing here is investment advice.