Loading
Loading
Read this before you put money in. Each item names the exposure, who controls it, and what you can do about it.
Everything Index Factory does runs through Pons v2 contracts: the launch factory, the curve, the fee escrow, the v4 hook. Three audits (SB Security, Dingbats, Pashov) were in progress at the time of writing and none had published. A bug in Pons can strand fees, break trading, or lose funds, and nothing in Index Factory can route around it.
Index Factory's own contracts have a fork test suite but no third-party audit either.
A memecoin launched here is a memecoin. The stock in the vault does not back the token's price; it belongs to stakers as a stream, and the token trades wherever the market puts it. You can lose all of what you paid for the token.
Index Factory pins the creator fee recipient to the vault, and the vault cannot re-point it. Pons keeps one override: for a token it judges abandoned, the Pons owner can propose a new recipient behind a public three-day timelock (pendingCreatorFeeRecipient). If that timelock runs out, future fees go to the new address, and no code on Index Factory's side can stop it.
What you can do: watch pendingCreatorFeeRecipient(token) on the Pons factory. A non-zero value means a proposal is pending and you have up to three days to react. Index Factory discloses this; it cannot prevent it.
cast call 0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e \
"pendingCreatorFeeRecipient(address)(address)" <token> \
--rpc-url https://rpc.mainnet.chain.robinhood.com
canLaunch(address) on the Pons factory returns true for everyone right now. If Pons closes public launches, IndexFactory needs whitelisting by the Pons owner before anyone can launch through it again. Existing tokens and vaults keep working; only new launches stop.
Once a token trades on Uniswap v4, some of its fees are collected in the memecoin itself and need converting before they reach the escrow. Only the Pons operator can run that conversion. A harvest picks up what has already landed in the escrow; the rest waits. If the operator stops running sweeps, post-graduation fees stall in the hook.
Several listed stocks have a Uniswap v3 pool with very little liquidity. An ETH-priced vault buying into one moves the price against itself and pays the difference as slippage. The TWAP band limits how far a single harvest can be pushed by an attacker but does nothing about a pool that is thin on its own.
What you can do: pick from the top of the picker, which is sorted by liquidity, or price the launch in the stock so the vault never swaps.
The TWAP guard reverts a harvest when the pool has moved more than about 2% in 15 minutes. During a volatile stretch, harvests fail until the pool settles. Fees stay safe in the escrow; only the timing slips. Someone who wanted to delay a harvest could keep the pool moving, at the cost of trading against themselves.
An ETH-priced vault cannot harvest until its stock pool's oracle buffer has been grown and has recorded 15 minutes of history. The Warm oracle button fixes the buffer; the history takes real trades. A brand-new pool may need a while.
https://rpc.mainnet.chain.robinhood.com is the only public endpoint and it rate-limits by IP. The site memoizes what it can and falls back to a snapshot for the stock list. Wallets can time out under load. Anything doing sustained reads (a keeper, an indexer) should run its own node.
An uploaded logo lives in the site operator's database and is served from the site's domain. If the site goes away, so does the image, and the URL on chain cannot be changed. Host the image yourself if that matters.
Can: call collectAppFees to sweep app-fee stock out of IndexFactory, and transfer ownership through a two-step handoff.
Cannot: change the app fee (it is an immutable, pinned into each vault at launch), touch any vault, move any stake, redirect any fee, pause anything, or upgrade anything. There is no proxy.
IndexVault has no owner, no admin function, no upgrade path, and no withdrawal. Stock leaves it in two ways: 20% of each harvest to IndexFactory, and claims by stakers who earned it. Memecoin leaves it in one way: unstakes by the staker who deposited it. The contract's public write functions are bind (launcher only, once), stake, unstake, claim, exit, harvest, and warmOracle. Anything not on that list does not exist.
Both contracts use OpenZeppelin's SafeERC20 and ReentrancyGuard and hold no proxies. Immutables are checked against live chain state before deployment. That reduces the surface; it does not remove it. Use amounts you can afford to lose.