Security
Exactly what Runitup's token contracts can and cannot do to you, in plain terms.
Most ways people lose money on a launchpad aren't exotic hacks. They're ordinary powers written into the token contract on purpose: the creator mints more supply, freezes your wallet, turns off selling, or drains the pool.
This page goes through each of those, says whether Runitup's tokens can do it, and — since "trust us" isn't an answer — says why not.
What the scanner checks actually mean
If you've pasted a token into a tool like GoPlus Security or Quick Intel, you've seen this list. Here's what each item means for you as a holder.
| Check | What it means if the answer is "yes" |
|---|---|
| Mintable | The creator can create more tokens out of nothing, diluting you. |
| Hidden owner | Someone still controls the contract through an address that isn't obvious. |
| Honeypot | You can buy, but you can't sell. Your money is stuck. |
| Proxy / upgradeable | The contract's code can be swapped for different code later. Every other guarantee becomes meaningless. |
| Transfer pausable | Someone can freeze all transfers, trapping everyone. |
| Trading cooldown | Forced waiting periods between trades. |
| Can't sell all | You're blocked from selling your entire balance. |
| Owner can change balances | Someone can edit how much you own. |
| Blacklist | Specific wallets can be blocked from trading. Yours could be one. |
| Whitelist | Only approved wallets can trade. |
What a launched token actually is
A token launched here is a completely standard ERC-20 with no custom logic at all. The entire contract is a constructor that creates the supply once, and then nothing. There is no other code in it.
| Check | Result |
|---|---|
| Mintable | ✅ No |
| Hidden owner | ✅ No — no owner exists at all |
| Honeypot | ✅ No |
| Proxy / upgradeable | ✅ No |
| Transfer pausable | ✅ No |
| Trading cooldown | ✅ No |
| Can't sell all | ✅ No |
| Owner can change balances | ✅ No |
| Blacklist | ✅ No |
| Whitelist | ✅ No |
| Ownership renounced | N/A — there was never an owner to renounce |
Uniswap V4 pools
V4 changes where a pool lives, not what your token is. The token contract is the same standard ERC-20 with no custom logic, so every answer in the table above is unchanged.
Two differences are worth stating because they are real:
- Every V4 pool lives inside one contract, the pool manager, rather than each pool being its own contract. That is a design choice by Uniswap, not something Runitup configures.
- Liquidity is locked the same way. The LP position is an NFT held by the same locker contract used for V3, which has no withdraw function. Same guarantee, same contract.
V4 pools here use no hooks. Hooks are V4's extension mechanism — code that runs on every swap, and the place where a malicious V4 pool would hide its trap. Runitup creates every pool with the hook address set to zero, so there is no such code to audit. If you ever see a Runitup pool with a hook attached, something is wrong.
Tokens paired against tokenized stocks
A token can be paired against a tokenized equity rather than ETH. This is a real difference in risk and worth understanding before buying one.
What does not change. The launched token is the same standard ERC-20, the pool charges the same 1.00%, and liquidity is locked identically. Nothing in the table above moves.
What does change:
- You take on the quote asset's risk too. Your token's price is quoted in shares of that stock. If the stock moves, your token's dollar value moves with it even when the token itself has not traded.
- You need the quote asset to trade. The pool has no ETH side. Buying means holding the stock token first, which is a smaller pool of possible buyers than an ETH pair.
- The stock token is somebody else's contract. Runitup did not issue it and does not control it. Its own guarantees — redeemability, transfer restrictions, who can freeze it — are the issuer's, not ours. Check the issuer before you assume the peg holds.
What Runitup does check. A token can only be paired against an asset on a governed allowlist, set by the platform. That is deliberate: the starting price is derived from the quote asset's value, so a creator free to nominate any token could mint one they control, declare it worth anything, and open a pool at a market cap of their choosing. The allowlist is what stops that.
Stock prices come from a Chainlink feed, with a fallback. Each tokenized equity is registered with both a live feed and a fixed price. During market hours the feed is used. Outside them the feed stops updating, and after six hours the contract stops trusting it and falls back to the fixed figure — without which a launch would simply revert every evening and all weekend.
That fallback is only ever read to set a new pool's opening price. It is not an oracle the pool consults afterwards: the price is read once, converted to a starting tick, and never referenced again, so a stale fallback misprices the first moment of a launch and nothing else. The market corrects it from the first trade.
"Ownership renounced: N/A" is stronger than "Yes", not weaker
This one looks worse than it is, so it's worth spelling out.
Normally a token contract has an owner with special powers. A careful creator gives those
powers up by calling renounceOwnership(), and scanners then report "Ownership renounced: Yes".
But that's an action someone has to actually take. Until they do, the owner still has every power the contract grants. And you're trusting that they did it, and that they did it before anything bad happened.
Runitup token contracts skip the whole problem: they never declare an owner in the first place. There's no button to press, nothing to verify anyone pressed, and no code path that could introduce an owner later. It isn't possible to deploy an owner-controlled version of these contracts, permanently, by design.
The honest caveat
That's about the token contract — the address you'd paste into a scanner. It is not a claim that the whole platform has no admin anywhere.
The surrounding infrastructure (LaunchConfig, FeeSplitter, LiquidityLocker)
does have a platform owner, with narrow and specific powers: one-time wiring done at deploy, plus
a support backstop that can reassign a creator's own fee-recipient address — for cases like a
creator losing access to their wallet.
What that admin cannot do: touch trader funds, mint tokens, pause trading, unlock liquidity, or change the mandatory fee split.
Why "Honeypot: No" is guaranteed, not just tested
A honeypot usually works by making the sell tax effectively 100% — you can buy, and selling either fails or returns nothing.
On Runitup this is impossible rather than merely absent, and for a simpler reason than a bound on a number: there is no tax to raise. The launched token is a plain ERC-20 whose transfer function is the standard one. There is no creator tax, no fee-on-transfer, and no hook running on swaps — only the pool's fixed 1.00%, which belongs to the pool and not to the creator.
Nothing about that is configurable at launch, so it cannot be set differently by launching through some other route.
Liquidity is locked permanently
Once a pool exists — which is immediately at launch, for every token — the position holding its liquidity is moved into a locking contract.
That contract has no withdraw function. No unlock. No transfer. Not time-locked, not multisig-guarded — the functions do not exist. There is no code path that removes liquidity, for anyone, ever, including Runitup.
The only two things anybody can ever do with a locked position:
- Collect its trading fees — permissionless, anyone can trigger it, and the proceeds split 75 / 25 as described in Fees.
- Add more liquidity to it — also permissionless. It can get deeper, never shallower.
This is what "rug pull" usually means, and it's the specific thing these contracts are built to make impossible.
Liquidity lock names the contract holding it, lists every function it has, and walks through checking any token's position yourself on the explorer — two contract reads, no Solidity required. Worth doing rather than believing this paragraph.
What this page does not protect you from
Being honest about the boundaries, because a security page that only lists reassurances isn't one:
- The price can still go to zero. Locked liquidity guarantees you can always sell. It says nothing about what you'll get.
- The creator can sell their own tokens. Nothing stops them, and a dev buy at launch means they may hold a lot. The token page's Top holders tab shows what the creator holds right now and what the top ten hold between them — current figures, not a launch-day snapshot. Check both before you buy.
- The quote asset's own risk. A stock-paired token inherits whatever happens to that stock, and to the contract that tokenizes it.
- The venue's own contracts are third-party. Uniswap's and SushiSwap's code is not ours, and a pool lives inside it. That is the same trust anyone trading on those venues already accepts.