> ## Documentation Index
> Fetch the complete documentation index at: https://docs.o1.exchange/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and audit

> Launchpad audit report, production safety properties, stock-paired route boundaries, governance controls, and verification guidance.

o1 Launchpad is designed around fixed token supply, token-only opening liquidity, permanent Uniswap v4 liquidity, transparent fee accounting, and vesting schedules that cannot be changed after launch.

<CardGroup cols={2}>
  <Card title="XORS launchpad audit" icon="file-shield" href="https://drive.google.com/file/d/104NoIbswNWIcOe_HDhJqlB39LB5ZKqvZ/view?usp=sharing">
    Independent o1 Launchpad report dated June 29, 2026.
  </Card>

  <Card title="Production contracts" icon="code" href="/launchpad/reference/production-contracts">
    Inspect the current Base and Robinhood addresses on their chain explorers.
  </Card>
</CardGroup>

## Audit result

XORS completed an independent o1 Launchpad contract review dated June 29, 2026. The report records seven Low findings and no Critical, High, or Medium findings, with the status of each finding documented in the report. Reviewed areas include launch initialization, governance and fee-recipient trust, referral protection, configuration changes, optional profile authority, opening-price bounds, and opening-window trading behavior. The linked report should be read according to its date and stated scope.

## Core safety properties

* launch tokens have fixed supply and no mint, pause, upgrade, or balance-seizure authority;
* opening liquidity uses launch tokens only, requires no creator paired-asset deposit, and stays in a hook-owned position that cannot be removed;
* swap-fee balances are backed by Uniswap v4 claims until withdrawn, and all recipient credits add up to the charged fee;
* optional creator authority is limited to supported token profile information;
* a pending launch stops if a protected global setting changes before it confirms; stock opening-price refreshes intentionally use the latest registered frame;
* vesting schedules and beneficiaries cannot be changed;
* private keys and transaction signing remain in the user's wallet.

## Stock-paired safety boundaries

The stock route preserves the same immutable token, single-sided seed, permanent lock, fee escrow, vesting, and announcement boundaries. It adds:

* a separate factory and hook so stock-paired settings do not alter the crypto route;
* per-quote revisions so an older stock opening-price update cannot overwrite a newer one;
* a restricted updater that can change only future opening-price frames;
* a 64-item batch limit for quote-management operations;
* an `01` address-suffix requirement for every stock-paired launch token;
* a route switch that affects new launches only and does not pause existing markets.

The paired Stock Tokens are external onchain assets. Their issuer, transfer behavior, availability, and market value are separate from the launch token and the o1 liquidity lock.

## Governance boundary

Governance can update defaults for future launches only. A completed launch keeps its token supply, pool, fee settings, allocations, vesting schedules, and permanent liquidity. See [Configuration and governance](/launchpad/architecture/deployment-governance) for the complete boundary.

The current governance owner and platform fee receiver are listed in [Production contracts](/launchpad/reference/production-contracts#governance-and-fee-recipient).

## What users and integrators should verify

* use the current factory and contract addresses for the selected chain;
* confirm the wallet is connected to the intended chain;
* review current supply, paired asset, route-specific factory, opening value, free creation fee, swap fee currency, and recipients;
* inspect holders, immediate allocations, vesting schedules, pool liquidity, and a current sell quote before trading;
* review the chain, contract, amounts, and wallet transaction details before signing.

To report a potential issue, follow the [o1 Exchange bug bounty guidance](/community/bug-bounty).