Security & risks
Review status
Section titled “Review status”The contracts repository contains internal review reports, remediation records, Foundry tests, fork tests and mainnet canary evidence. A contracts-only external-audit freeze was prepared earlier; subsequent Arc changes include adapter repairs and third-party-liquidity support.
A completed external audit of the current deployed stack is not established by the records used for this documentation. Do not describe the deployment as independently certified, risk-free, or covered by an earlier review without matching the exact source and bytecode. Explorer source verification was deliberately not performed during the documented operations.
Administrative trust
Section titled “Administrative trust”The documented launchpad owner is a temporary EOA. A two-step ownership transfer supports a later multisig, but that capability is not the same as a completed multisig handover.
The owner has powers over approved quote assets, future launch defaults and infrastructure, access settings, takeovers and recovery operations. Buybacks and fee collection have privileged execution paths. Existing launch snapshots limit which terms can change, but the protocol is not free of administrative trust.
Market and liquidity risk
Section titled “Market and liquidity risk”Token prices can move sharply. A fixed supply and locked graduation position do not guarantee demand, a minimum price, enough liquidity for your order, or the ability to exit at your purchase price. External liquidity providers can remove their own positions where the adapter allows them to do so.
The curve’s phantom reserve is mathematical, not withdrawable collateral. FDV is a price-times-supply estimate, not reserve backing. Creator taxes, anti-snipe taxes, slippage and gas can materially change execution.
Chain, quote and infrastructure risk
Section titled “Chain, quote and infrastructure risk”USDC and Arc carry issuer, network and operational dependencies. Quote-token transfer restrictions can affect contract operations. RPC failures, indexer lag, wallet behavior, contract bugs and third-party integrations can interrupt trading or display stale information.
The UI’s USDC-to-USD convention is not a live guarantee of dollar redemption or a depeg oracle. Verify chain and token addresses before signing, and examine the spender and limits in each approval.
Rebranding communications
Section titled “Rebranding communications”A brand announcement is not a token migration instruction. Never treat a request to reveal a recovery phrase, send assets to a “rebrand wallet,” or approve an unlisted spender as a normal rebranding step. Use the application and addresses documented here, and inspect the actual transaction requested by your wallet.