Security
Exactly what Runitup's token contracts can and cannot do to you, in plain terms.
Most ways people lose money on a launchpad aren't exotic hacks. They're ordinary powers written into the token contract on purpose: the creator mints more supply, freezes your wallet, turns off selling, or drains the pool.
This page goes through each of those, says whether Runitup's tokens can do it, and — since "trust us" isn't an answer — says why not.
What the scanner checks actually mean
If you've pasted a token into a tool like GoPlus Security or Quick Intel, you've seen this list. Here's what each item means for you as a holder.
| Check | What it means if the answer is "yes" |
|---|---|
| Mintable | The creator can create more tokens out of nothing, diluting you. |
| Hidden owner | Someone still controls the contract through an address that isn't obvious. |
| Honeypot | You can buy, but you can't sell. Your money is stuck. |
| Proxy / upgradeable | The contract's code can be swapped for different code later. Every other guarantee becomes meaningless. |
| Transfer pausable | Someone can freeze all transfers, trapping everyone. |
| Trading cooldown | Forced waiting periods between trades. |
| Can't sell all | You're blocked from selling your entire balance. |
| Owner can change balances | Someone can edit how much you own. |
| Blacklist | Specific wallets can be blocked from trading. Yours could be one. |
| Whitelist | Only approved wallets can trade. |
Meme tokens (Quick Launch)
A Meme token is a completely standard ERC-20 with no custom logic at all. The entire contract is a constructor that creates the supply once, and then nothing. There is no other code in it.
| Check | Result |
|---|---|
| Mintable | ✅ No |
| Hidden owner | ✅ No — no owner exists at all |
| Honeypot | ✅ No |
| Proxy / upgradeable | ✅ No |
| Transfer pausable | ✅ No |
| Trading cooldown | ✅ No |
| Can't sell all | ✅ No |
| Owner can change balances | ✅ No |
| Blacklist | ✅ No |
| Whitelist | ✅ No |
| Ownership renounced | N/A — there was never an owner to renounce |
Uniswap V4 pools
V4 changes where a pool lives, not what your token is. The token contract is the same standard ERC-20 with no custom logic, so every answer in the table above is unchanged.
Two differences are worth stating because they are real:
- Every V4 pool lives inside one contract, the pool manager, rather than each pool being its own contract. That is a design choice by Uniswap, not something Runitup configures.
- Liquidity is locked the same way. The LP position is an NFT held by the same locker contract used for V3, which has no withdraw function. Same guarantee, same contract.
V4 pools here use no hooks. Hooks are V4's extension mechanism — code that runs on every swap, and the place where a malicious V4 pool would hide its trap. Runitup creates every pool with the hook address set to zero, so there is no such code to audit. If you ever see a Runitup pool with a hook attached, something is wrong.
Tokens paired against tokenized stocks
A token can be paired against a tokenized equity rather than ETH. This is a real difference in risk and worth understanding before buying one.
What does not change. The launched token is the same standard ERC-20, the pool charges the same 1.00%, and liquidity is locked identically. Nothing in the table above moves.
What does change:
- You take on the quote asset's risk too. Your token's price is quoted in shares of that stock. If the stock moves, your token's dollar value moves with it even when the token itself has not traded.
- You need the quote asset to trade. The pool has no ETH side. Buying means holding the stock token first, which is a smaller pool of possible buyers than an ETH pair.
- The stock token is somebody else's contract. Runitup did not issue it and does not control it. Its own guarantees — redeemability, transfer restrictions, who can freeze it — are the issuer's, not ours. Check the issuer before you assume the peg holds.
What Runitup does check. A token can only be paired against an asset on a governed allowlist, set by the platform. That is deliberate: the starting price is derived from the quote asset's value, so a creator free to nominate any token could mint one they control, declare it worth anything, and open a pool at a market cap of their choosing. The allowlist is what stops that.
Pricing for tokenized stocks is configured, not live, on testnet. There is no price feed for these assets on Robinhood Chain testnet, so their USD values come from a figure committed in configuration. It is the same figure the contract prices launches at, so the site and the pool always agree with each other — but both are only as current as that figure. A production deployment must read a real price feed instead.
"Ownership renounced: N/A" is stronger than "Yes", not weaker
This one looks worse than it is, so it's worth spelling out.
Normally a token contract has an owner with special powers. A careful creator gives those
powers up by calling renounceOwnership(), and scanners then report "Ownership renounced: Yes".
But that's an action someone has to actually take. Until they do, the owner still has every power the contract grants. And you're trusting that they did it, and that they did it before anything bad happened.
Runitup token contracts skip the whole problem: they never declare an owner in the first place. There's no button to press, nothing to verify anyone pressed, and no code path that could introduce an owner later. It isn't possible to deploy an owner-controlled version of these contracts, permanently, by design.
The honest caveat
That's about the token contract — the address you'd paste into a scanner. It is not a claim that the whole platform has no admin anywhere.
The surrounding infrastructure (LaunchConfig, FeeSplitter, TaxRouter, LiquidityLocker)
does have a platform owner, with narrow and specific powers: one-time wiring done at deploy, plus
a support backstop that can reassign a creator's own fee-recipient address — for cases like a
creator losing access to their wallet.
What that admin cannot do: touch trader funds, mint tokens, pause trading, unlock liquidity, or change the mandatory fee split.
Why "Honeypot: No" is guaranteed, not just tested
A honeypot usually works by making the sell tax effectively 100% — you can buy, and selling either fails or returns nothing.
On Runitup this is impossible rather than merely absent, and for a simpler reason than a bound on a number: there is no tax to raise. The launched token is a plain ERC-20 whose transfer function is the standard one. There is no creator tax, no fee-on-transfer, and no hook running on swaps — only the pool's fixed 1.00%, which belongs to the pool and not to the creator.
Nothing about that is configurable at launch, so it cannot be set differently by launching through some other route.
Liquidity is locked permanently
Once a pool exists — which is immediately at launch, for every token — the position holding its liquidity is moved into a locking contract.
That contract has no withdraw function. No unlock. No transfer. Not time-locked, not multisig-guarded — the functions do not exist. There is no code path that removes liquidity, for anyone, ever, including Runitup.
The only two things anybody can ever do with a locked position:
- Collect its trading fees — permissionless, anyone can trigger it, and the proceeds split 70 / 20 / 10 as described in Fees & tax.
- Add more liquidity to it — also permissionless. It can get deeper, never shallower.
This is what "rug pull" usually means, and it's the specific thing these contracts are built to make impossible.
What this page does not protect you from
Being honest about the boundaries, because a security page that only lists reassurances isn't one:
- The price can still go to zero. Locked liquidity guarantees you can always sell. It says nothing about what you'll get.
- The creator can sell their own tokens. A dev buy at launch is visible on the token page under Degen stats — check it, along with whale concentration, before you buy.
- The quote asset's own risk. A stock-paired token inherits whatever happens to that stock, and to the contract that tokenizes it.
- A creator selling their own supply. A dev buy is disclosed at launch, but absolutely charge a lot. Look at the rate before trading.
- Custom Forge addresses aren't audited. If a creator points a bucket at their own contract, Runitup doesn't vouch for it. See Forges.