Contracts and security
What is locked, and who can do what
Every Bluu contract address, what nobody can change, and what each key can and cannot do.
Locked for good
- The whole supply is minted once, at launch. There is no mint function.
- A token's taxes, its Early Lock and Hold Mode choices, its Hold Mode ladder and its fee rates are fixed at launch.
- Liquidity is locked from launch. The creator can never withdraw it; on Robinhood Chain and Arc only a token classed Dead has its liquidity released, to the platform. On Solana it is locked forever.
- The Robinhood Chain and Arc contracts are not upgradeable: a change means a new deployment, and tokens already launched keep the rules they launched with. Bluu's Solana program can be upgraded by its upgrade authority.
- A creator's one change of fee recipient is final.
Who can do what
The rule throughout is the attestors attest, the contracts decide. No key can send funds to a destination of its choosing.
| Role | Can | Cannot |
|---|---|---|
| Attestors | Sign rugs, dead-coin calls, scores and payout lists — together, at the threshold | Move funds; act alone |
| Pauser | Pause trading on Robinhood Chain and Arc, launches, rug confirmations and seizures; cancel a pending seizure, a confirmed rug or a payout list before claims open | Withdraw anything; stop a claim once claims are open |
| Parameter admin | Change settings within limits fixed in the code | Set anything outside those limits |
| Liquidity releaser | Release a Dead token's liquidity to a fixed address | Touch a live token; choose where it goes |
| Insurance approver | Approve site-wide fund payouts, each with a written reason | Touch token pools, liquidity or escrow |
| Buy-back keeper | Spend a token's buy-back money buying that token and burning it, with a minimum price | Send money or tokens anywhere else |
Attestor keys sit on separate hosts with different providers, so one compromised server cannot sign anything alone. Any suspect key can be paused, its pending actions cancelled and the key replaced.
Contract addresses
Check any address before you send to it. Each links to the chain's explorer.
Where this stops
- The site-wide insurance fund pays at the team's discretion. Its approver can pay out all of it.
- The admin key can change who holds each role, which makes it the most sensitive key in the system.
- Whoever holds the Solana program's upgrade authority can change how that program works.
- These are testnet deployments. Mainnet addresses will be different and will be listed here.