Fixed and final

Supply

Every launch deploys a standard ERC-20 with a supply of one billion and no mint function. There is no inflation lever, no pause and no blacklist, so after deploy the only direction supply can move is down, through burns the keeper performs on the coin’s behalf.

Nothing about the coin can be changed once it is out: not the asset it trades against, not the wallet its fees pay into, not the way a claim divides. All of it is fixed at launch, and Pons fixes the fee recipient itself — no caller but the factory can move it afterwards.

Fees from the first block

Curve

Coins trade against a bonding curve from the first swap. Every swap pays a flat 1%, which is what funds the engine before the coin has any pool of its own. At 4.2 ETH raised the coin graduates and its liquidity migrates into a full pool.

Graduation moves liquidity and nothing else. It does not touch the reserve, the sub-wallet or the split, so a graduated coin is simply a coin whose engine has been running longer.

One wallet per coin

Sub-wallet

Each coin owns a sub-wallet derived from its launcher’s address and a running index, and the launch itself names that wallet as the coin’s fee recipient. Fees claimed for that coin land there, its reserve is kept there, and its burns are paid from there.

No two coins share a wallet. That is the whole point of the design: one coin’s reserve cannot be spent on another coin, however badly that one goes. The keeper is the only actor permitted to move those funds, and only along the paths below - none of which lead to a person.

What a coin trades against

Pair assets

Pons lets a launch name the asset its curve trades against, and that is the choice this whole design rests on. Pick NVDA and the coin is bought with NVDA and sold for NVDA: its liquidity, its fees and its buy-backs are all denominated in the stock.

Twenty-three are offered in the console — the large caps, SPY and QQQ, gold and silver, T-bills — alongside native ETH and USDG. Forty-two are in use across the chain; the list is a curation, not a limit of the factory.

The asset is fixed at launch, like everything else about a coin. The router reads it off the pair rather than taking it as a parameter, because a registration should not be able to claim a coin trades against something it does not.

50 / 15 / 15 / 20

Fee split

Every claim divides the same way: half stays in the coin’s own wallet as reserve, 15% goes to whoever launched it, 15% to the protocol treasury, and 20% buys the coin back off the market and burns it.

The shares are stored in basis points and must sum to 10000 or the claim reverts, so there is no path by which a claim is split some other way. Nothing is minted to pay any of the four.

• 50% reserve
• 15% creator
• 15% treasury
• 20% burn

Four moves, no discretion

Keeper loop

A keeper service ticks every fifteen seconds. It holds no view on any market and cannot act outside this loop.

1. Claim. The coin’s creator fee is pulled out of the Pons escrow into its own wallet, in its own asset.
2. Split. The claim divides 50 / 15 / 15 / 20. The reserve share does not move — only the ledger does.
3. Burn. The burn share buys the coin off its own pair and destroys what it bought, in the same transaction.
4. Backstop. And if the coin is worth less than its reserve, a quarter of that reserve does the same thing.

There is no fifth move. The keeper cannot send the reserve anywhere, cannot change a share, and cannot act on a coin that was never registered.

Only grows, and only spends one way

The reserve

Half of every claim stays exactly where it landed: in the coin’s own wallet, in the asset it trades against. The router records the amount so later claims divide only the fees that are new — without that, the reserve would be re-split on every tick and bled away a fifth at a time.

It cannot be withdrawn. The sub-wallet exposes one call and only the router may make it; the router has no path that sends the reserve anywhere except into the coin’s own market. That is true for the creator, for the keeper and for us equally.

Its one use is the backstop. The router prices the coin from its pair’s reserves and its own supply — no oracle, since both sides are already denominated in the same asset — and compares that against what the coin is holding. While the coin is worth less than its reserve, the keeper may spend up to a quarter of it buying the coin back and burning what it buys. Above that line the call reverts.

So the keeper picks the moment and the slippage. Whether a backstop is allowed at all is decided by the chain.

Fixed at launch

Why a coin cannot join later

Pons decides at deploy time who receives a coin’s creator fee, and after that the setting is closed: on a fork of the live chain, every caller except the factory itself is refused, including the coin’s own creator. There is no path by which a coin launched somewhere else can be pointed at this engine afterwards.

So the console does the only thing that works. Before it builds a launch it asks the router for the address of that coin’s sub-wallet, and the launch names that wallet as the fee recipient. From the first swap onward the coin pays the engine, and nobody — including us — can redirect it.

Registration is then permissionless, because there is nothing left to trust: the router checks on-chain that the pair really pays the wallet the launcher’s address and index derive to, and refuses anything else. A coin that does not fund the engine cannot be listed as though it does.

All of it in one table

Parameters

Parameters are protocol level and identical for native launches and externally routed coins.

Nothing deployed yet

Contracts

The router is live at 0x35783f062557F0204C09cc3A9d7fE13E1913CABc. It holds the registry and the four moves; the split is a constant in it, not a setting. The factory is Pons’s, not ours, and its 0.0005 ETH launch fee is its own.

Addresses appear here the day they are live on the explorer, and nowhere before that. Anyone can deploy a token and call it ours: an address that is not on this page or posted from @usedustdotfun is not ours.

Said plainly

What can go wrong

The reserve is the stock, and the stock can fall. A coin holding NVDA is holding NVDA: if the stock halves, so does the reserve, in dollars. Nothing here protects against that, and nothing claims to.

A reserve is not a redemption. Holders cannot claim a share of it. It buys the coin back on the open market when the coin is cheap enough, which is not the same as a floor and should not be read as one.

The tokenized stock is somebody else’s contract. We do not issue NVDA on this chain and cannot vouch for whoever does. The reserve is exactly as good as the token it is held in.

A quiet coin has no engine. Everything here is powered by trading fees. A coin that does no volume accrues nothing, opens nothing, and burns nothing.

None of it is audited yet, and none of it is advice. Smart-contract risk and market risk are both real. A coin with a reserve is still a memecoin; the reserve is a fact about where its fees go, not a promise about its price.