Security & admin powers
What no one can do
These limits are enforced by the contracts. No admin key, including Makina's, can get around them:
- Touch a market's money. No role can move a launch's curve reserve, its locked pool liquidity or the fees credited in its escrow.
- Change a live market. Every economic setting (target, first-buy cap, launch-window tax, fee split) is copied into the launch when it's created and can't be changed afterwards.
- Pause trading. Buying and selling on an existing launch can't be paused or blocked.
- Mint tokens. Each token has a fixed supply of 1 billion and no mint function.
- Upgrade contracts. None of the contracts is upgradeable, and none has an arbitrary-call function.
- Remove pool liquidity. The graduated pool position is held by a vault with no withdrawal path. See Graduation.
Admin roles
| Role | What it can do | Delay |
|---|---|---|
| Owner | Change settings for future launches, within hard limits; replace the verifier or guardian; transfer ownership in two steps | 2 days for every change |
| Guardian | Pause or unpause new launches; pause builder payouts while a verifier key is rotated; cancel a scheduled settings or verifier change | Immediate |
| Verifier | Propose a builder wallet for a launch | 3-day waiting period per proposal, which the guardian, the verifier or the current builder can cancel |
| Platform | Receive the platform share of fees; it's a fixed address and has no other power | — |
The owner can also pause new launches. The factory starts paused when it's deployed, so no one can launch until the team has checked the deployment.
A builder proposal made with a verifier key becomes void as soon as that key is rotated. The settings delay (2 days) is shorter than the builder waiting period (3 days), so a compromised verifier key can always be replaced before a proposal made with it can pay out.
On testnet these roles are held by team-controlled test wallets. Their addresses are on Contract addresses.
Reviews so far
- V8 contracts, October 2026: internal review and test campaign. It reproduced every finding from the previous version on its real bytecode and showed each one fixed in V8. Testing included unit tests on the release bytecode, stateful invariant testing, fuzzing with Echidna (over a million calls with no failures) and fork tests against Robinhood Chain mainnet's real Uniswap v4 PoolManager and WETH.
- Mosh pad, October 2026: internal review.
- November 2026: a further internal security pass across contracts, app and infrastructure. Fixes from it are on testnet.
None of these is an independent audit. An independent security review is required before mainnet.
Before mainnet
Makina's contracts will not be deployed to Robinhood Chain mainnet until all of these are done:
- independent security review of the contracts;
- separate production deployment records;
- review of the production router;
- approved custody for the owner, guardian, verifier and platform roles (the owner is meant to be a multisig);
- fork invariant tests passing against mainnet;
- reproducible, locked build artifacts;
- production data isolated from testnet;
- an approved process for releasing builder fees.
Staying safe as a user
- Check the address. Real Makina tokens end in
fac7, and real contracts are listed on Contract addresses. Anyone can launch a token with any name. - Read the badge. Project launched and Project endorsed mean the GitHub repository owner is linked to the token. They are not a judgement of the project's quality.
- Read your wallet. The app simulates every transaction and shows what it will do, but your wallet's prompt is the final check.
- Makina never asks for your seed phrase or private key.
Reporting a vulnerability
If you find a security issue, report it to the Makina team privately, for example by direct message on X. Please don't post details publicly until it's fixed.