Security
What the contracts guarantee, what nobody can change and how to stay safe.
Non-custodial by design
Gamapad is an interface to a set of public smart contracts. It never takes custody of your ETH or tokens.
- Every action, from a launch to a trade or a fee claim, is a transaction you review and sign in your own wallet. Nothing moves without your signature.
- Your ETH and tokens stay in your wallet or in the public contracts: a token’s bonding curve before graduation, its locked Uniswap pool after. Gamapad never holds user funds.
- Gamapad will never ask for your seed phrase or private key. Signing in is a free message signature that costs no gas and grants no access to your funds.
What the contracts guarantee
These rules are enforced by the contract code itself. They hold for every token from the block it is created:
- Fixed supply. Every token has exactly 1,000,000,000 units, minted once to its bonding curve. Nobody can mint more.
- No owner controls on the token. The token is a plain ERC-20 with no owner, mint, burn, pause or blacklist functions and no transfer restrictions.
- Creator tax fixed. The creator tax (0 to 10%) is chosen at launch and can never be changed, by the creator or by Gamapad.
- Curve settings fixed. The starting point, the graduation target and the protocol share of the fee are stored in each curve at launch and never change for that token.
- Liquidity locked forever. At graduation the pool position is owned by a locker contract with no withdraw, transfer or remove function, and the Uniswap hook also rejects liquidity removal. There is no path to take it out. See Graduation.
- Max-fee protection. Every trade carries the fee you were shown. If the fee rose before your transaction landed, it reverts instead of charging more. Base fee and creator tax together can never exceed 12%.
- No upgrades. The contracts are not upgradeable proxies. The code at a contract address can’t be swapped out.
What can change and what never can
A few protocol-wide settings live in the fee settings contract. This is the complete list of what can change there, as written in the contract:
Can change
- The base trade fee, within 0 to 2%. A change is scheduled on-chain and takes effect only after a 24-hour delay, so it is visible in advance on token pages and the Fees page. A scheduled change can be cancelled.
- The launch fee, up to a hard cap of 0.01 ETH. It applies to launches created after the change.
- The protocol share of the base fee and the curve settings (starting point and graduation target), for future launches only.
- New launches can be paused and resumed. Trading, selling, graduation and fee claims on existing tokens are not affected.
Can never change
- An existing token’s creator tax, curve settings and protocol share.
- Locked liquidity. No contract has a function that removes it.
- Anyone’s ETH or tokens, including creator earnings waiting in the fee vault. Only the owner of those earnings can claim them.
- Nobody can mint, freeze, pause or blacklist any token. Tokens have no owner functions at all.
Contracts and testing
The contracts build on OpenZeppelin and Uniswap v4, and they are tested with:
- Integration tests that run full launches, trades and graduations against a real Uniswap v4 PoolManager.
- Unit and fuzz tests for the bonding curve maths.
- An invariant test that checks the curve’s token supply and ETH reserve accounting stays correct across random sequences of buys, sells and fee claims.
Staying safe
- Verify the contract address. A token is identified by its address, not its name or image. Copy it from the token page and compare it before you buy.
- Watch for copies. Anyone can launch a token with any name, ticker or image, including copies of well-known projects or of other Gamapad tokens. Tokens are not reviewed or endorsed by Gamapad.
- Use official channels only. @gamapadcom on X is the only official Gamapad account. There is no official Telegram or Discord. Be wary of anyone who messages you first offering help.
- Never share your seed phrase or private key. Not with support, not with a partner, not with anyone. Anyone who asks is trying to steal your funds.
- Check what you sign. Before you confirm, check that the network is GIWA Sepolia in your wallet, that the amount matches what Gamapad showed you and that the request comes from the Gamapad site you opened yourself.
Reporting a token
If a token impersonates a project, contains harmful content or links to something malicious, report it to the Gamapad team:
- 1Open the token pageOpen More actions next to the token header and choose Report token.
- 2Pick a reasonChoose Impersonation or scam, Harmful image or text, Harmful link, or Something else. You can add details if they help.
- 3Send the reportReports are reviewed by the Gamapad team.
A token hidden after review leaves Explore and search, and its page shows a warning. The token itself stays on-chain: its contract keeps working and holders can still trade it. Gamapad can’t freeze, delete or change a token.