Risk disclosures

Merry Men removes several structural risks by construction, but it does not make launched tokens safe investments. Here is what the design protects against and what it does not.

What the design protects against

These hold structurally, not by policy:

Rug pulls via liquidity removal. The launch position NFT is held by a locker that never releases it. Liquidity is locked forever; only trading fees can be extracted. There is no code path that moves locked liquidity out.
Malicious token contracts. The launch token is inert: no owner, mint, pause, blacklist, transfer tax, or upgrade path. Supply is fixed forever. A creator cannot mint, freeze, or tax after launch.
Migration exploits. There is no bonding curve and no migration step, so the migration window, the classic launchpad exploit surface, does not exist.
Half-completed launches. A launch either fully completes (token + pool + locked single-sided position) or reverts. A mispriced launch reverts wholesale rather than stranding supply.

What it does not protect against

Market risk. Price can fall to zero. Locked liquidity guarantees a token is tradeable, not that it holds value. The liquidity floor only reflects the quote asset buyers have already put in.
Snipers and MEV. An Open launch is live from block one, so the launch transaction is snipeable like any DEX pool. The newer generations blunt this (the creator’s first buy rides inside the launch transaction, the decaying sell fee taxes fast dumps, and Game/Verified gates replace the open snipe window with a capped one), but bots still trade open launches, and a gated launch is open the moment its window ends. Use standard slippage protection on every trade.
Identity misuse. Verified launches prove a launch was made by an X account, not that the account is honest, notable, or who it claims to represent. A verified badge is provenance, not endorsement.
Bad actors around the token. The protocol cannot stop a creator from promoting dishonestly, abandoning a project, or coordinating off-platform. Page control and the fee stream are the only things it can arbitrate (see Community takeovers).
Concentration. Nothing prevents a creator or early buyer from holding a large share of supply and selling into the pool.

Audit status

The core V3-generation launch contracts (factory, locker, token) are covered by an extensive Foundry test suite: invariant and fork tests against real Uniswap V3, with 100% line / statement / branch / function coverage on the core contracts, and were reviewed in a 2026 security pass.
The v4-generation contracts are unaudited: the v4 factories, hooks (including the verified generation’s fee-and-burn hook), lockers, and the launch-gate contracts are newer, tested to the same internal bar (invariant, fuzz, and fork suites), but have not had a third-party audit.
The buyback treasury is unaudited. It is immutable and holds protocol revenue.

Test coverage is a strong signal, not a guarantee of correctness. Treat unaudited components accordingly.

Off-chain components

Some things live off-chain and carry their own trust assumptions:

The attestation service. Verified launches (and verified-only trading windows) depend on an off-chain attester that checks an X login and signs an attestation the contracts verify. The attester cannot touch funds, liquidity, or existing coins; a compromise could attest wrong identities or refuse service until the key is rotated. Launch verification is only as good as this service’s integrity.
Graduation is an off-chain milestone badge computed by the indexer. It moves no funds and is not a bonding-curve state. Do not treat it as a migration or a safety guarantee. See Graduation.
Coin metadata (logo, description, socials) is off-chain and controlled by the steward or creator. It can be changed and should not be treated as immutable or verified.
The indexer / public API is a convenience layer. For anything you rely on, verify against the chain: pools, balances, and fees are all readable on-chain.
The game round. In Game-gated launches the tap-trading scores are computed off-chain and settled on-chain by a keeper. The on-chain freeze ceiling bounds the worst case: once it passes, anyone can open the pool, so no coin can be gated forever, whatever happens to the round or the keeper.

No native token

The platform has no native token and takes no team or insider allocation in any launched token. A creator’s bundled first buy is a real, capped, publicly-labeled market purchase, not an allocation. Sell-fee burns are destroyed; there is no held inventory anyone can sell.

Regulatory framing

Mechanics that burn tokens or buy them back can attract regulatory attention depending on jurisdiction and how they are marketed, particularly if presented as a return, yield, or guarantee. That is why these pages describe the mechanic and promise nothing. This documentation is not legal advice; regulations vary by jurisdiction and change over time.

Integration risk

Coins from the V3 generations carry their own trap: testnet and mainnet ship different Uniswap V3 routers with different ABIs, and encoding a swap for the wrong one reverts. See Earlier generations.