Documentation
How a MaroPad launch works
The rules below are the rules the contracts enforce. Where a capability is not available, this page says so instead of describing it as if it were.
Supported network
MaroPad targets Robinhood Chain (chain id 4663). Native ETH is the quote asset. Liquidity is created on the official Uniswap V2 deployment listed in the Uniswap deployment registry and verified by reading the router back from the chain (last verified Tue, 22 Sep 2026 09:11:33 GMT, block 69537667). Robinhood Chain Testnet (46630) has no Uniswap deployment in that registry and is not a target.
Uniform-price batch auction
One sale token, one quote asset, one batch. The creator publishes a fixed sale supply, an opening and closing time, a reserve price and a strictly increasing grid of 2 to 64 limit prices. An order commits a quote amount at one grid price: it accepts any clearing price at or below that limit.
- Clearing price. The highest grid price at which the quote committed at or above it buys at least the whole sale supply. If no price does, every order is accepted in full at the reserve price (a partial sale).
- Rationing. When demand exceeds supply at the clearing price, orders are served by price priority from the top of the grid. The tick where cumulative demand reaches capacity is the marginal tick: orders above it are accepted in full, orders at it pro rata (accepted ÷ demand at that tick), orders below it are refunded in full.
- Everyone pays the same price. An accepted order receives floor(accepted × 10¹⁸ ÷ clearing price) sale-token base units and a refund of the unaccepted quote.
- Rounding. Pro-rata floors can leave up to (orders at the marginal tick − 1) base units of quote in the contract; token dust below one base unit per order stays in the contract. The launch only distributes what participants actually gave up.
- Failure. Below the minimum raise, with no orders, or if settlement and liquidity are not completed within the grace period after the close, the launch fails: every order is refundable in full and every token returns to the creator.
- Verification. Settlement is computed on chain from the orders the contract itself recorded. There is no operator input, no off-chain allocation file and no Merkle root to trust. Anyone can recompute the outcome from the public demand per tick; the app does so with an independent model.
Full specification: docs/AUCTION_SPEC.md in the repository.
Economics and fees
Every number is fixed when the launch is created and readable on its page before participation opens.
- Platform fee: a percentage of the distributed raise (snapshotted from the factory at creation; capped at 5%), paid to the treasury after liquidity is locked.
- Liquidity share: a percentage of the net raise (after the fee) that goes into the pool, with tokens from a reserve escrowed at creation so the pool opens exactly at the clearing price.
- Creator proceeds: the remainder of the net raise, plus unsold tokens and any unused liquidity reserve, withdrawable only after liquidity is locked.
- MaroPad does not supply liquidity, guarantee a price, or promise returns. Nothing about a launch is “fair value”.
Liquidity and lock
After settlement, anyone may call finalisation. It adds the liquidity share and the matching tokens to the Uniswap V2 pair at the clearing price, with a per-launch tolerance if a pool already exists, and deposits the LP tokens into the liquidity locker until the published unlock time. The locker has no owner and no administrative function: only the beneficiary can withdraw, and only after the unlock time.
If an existing pool is priced outside the tolerance, finalisation reverts and can be retried. If it cannot complete before the deadline, anyone may abort: participants are refunded in full and the creator’s tokens are returned. “Liquidity locked” is shown only after the indexer reads the lock and the pair back from the chain.
Participation cap
Per wallet address, per launch. The launch sums every order under the same wallet, across ticks and submissions, and rejects any order that would exceed the cap.
- A wallet is not a person. One person can use several wallets; MaroPad does not claim one-person-one-allocation, whale resistance or Sybil resistance in this mode.
- The cap counts committed quote, not accepted quote: a refunded portion still counts against the cap for that launch.
Privacy boundary
Shielded participation is not available. No verified shielded-pool protocol is deployed on Robinhood Chain (4663). In the transparent mode that is available, the following is public:
The full threat model and the requirements a shielded adapter must meet are in docs/THREAT_MODEL.md. See also Shielded balance.
Security and permissions
- Launch terms are immutable. No function changes a price, time, cap, fee or recipient after creation.
- Funds never leave a launch before liquidity is created and locked. Every failure path refunds every order in full.
- The factory owner can: set the platform fee (≤ 5%, future launches only), set the treasury, pause creation and new orders (never settlement, claims or refunds), and allow-list quote assets, adapters, router and locker for future launches. The owner cannot touch escrow, LP tokens or any outcome. There is no upgrade mechanism.
- The token template is fixed-supply with no owner, mint, tax, blocklist or sell restriction. Existing tokens are accepted only if they deliver exactly what they transfer; fee-on-transfer and rebasing tokens are not supported.
- The contracts are tested (unit, fuzz, invariant and cross-implementation vectors) but have not been independently audited. Do not treat them as ready for real funds until they have been.
Details: docs/SECURITY.md.
Deployment status
Live addresses, indexer position and worker health are on System status. If the factory address there reads “not deployed”, no launch can exist on this network yet; the repository ships a reviewable deployment script and a manifest that only ever contains real addresses.