> For the complete documentation index, see [llms.txt](https://docs.novamp.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novamp.io/protocol/security-model.md).

# Security Model

What makes a Novamp launch hard to rug — fixed supply, no mint, no owner, permanent liquidity choice, and a minimal, disclosed admin surface.

Novamp's security comes from what a launch **can't** do. Every token is a fixed-supply contract with no mint function and no owner, deployed from a verified template, trading on a real pool from block 0. This page lays out the guarantees, the small admin surface that remains, and exactly what is immutable.

{% hint style="warning" %}
⚠️ A strong security model reduces specific risks — it does **not** make any token safe, legitimate, or a good investment. Prices can still go to zero. Always read the [Risk Disclosure](/legal-and-safety/risk-disclosure.md).
{% endhint %}

## Overview

Every Novamp EVM launch is built to remove the classic rug vectors at the contract level:

* **Fixed supply** — minted once at launch, fixed forever. **No mint function.**
* **No owner** — the token contract has no owner/admin who can change it after launch.
* **Real pool from block 0** — no bonding curve to abandon, no graduation to gate.
* **Permanent liquidity choice** — the creator picks **burn or lock** at launch; it can't be quietly reversed later.
* **Taxes are lowerable-only** — a tax token's buy/sell tax (0–10%) can only ever be reduced, never raised.
* **Auto-verified bytecode** — every launch shares byte-identical runtime bytecode with a verified template, so it verifies on the explorer.
* **No upgradeable contracts, no blacklists, no dynamic taxes** (v1).

## The no-rug-surface

The table maps each classic rug/scam vector to how Novamp closes it.

| Rug vector                       | How Novamp closes it                                                                                                                             |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Infinite mint / hidden mint**  | Fixed supply, minted once — **no mint function** exists on the token.                                                                            |
| **Owner changes the token**      | Token has **no owner** — no privileged post-launch functions to call.                                                                            |
| **Liquidity pull (rug)**         | Liquidity is **burned or locked** at launch as a permanent per-launch choice (`LiquidityLocker`); v3 positions are custodied by `PositionVault`. |
| **Stealth tax hike / honeypot**  | Taxes are set at launch and **lowerable-only** (max 10%); **no dynamic taxes**, **no blacklists** in v1.                                         |
| **Team dump on launch**          | Optional creator allocation (0–10%) can be **locked** via `CreatorVesting`.                                                                      |
| **Snipers eat the launch**       | **Auto-expiring** anti-snipe caps (max-buy / max-wallet windows) applied at launch.                                                              |
| **Contract swapped later**       | Contracts are **non-upgradeable** — no proxy, no upgrade path.                                                                                   |
| **Fake / unverifiable contract** | Every launch **auto-verifies** against a verified template via matching bytecode.                                                                |
| **Copycat identity theft**       | AntiVamp normalized `Name + Ticker` locks + cross-chain blocklist fan-out.                                                                       |

## Admin roles

Novamp is not "no admin" — it's a **small, disclosed** admin surface. No admin can mint tokens, drain a pool, or change a launched token.

| Role                  | Who                            | What it can do                                                                                                              | What it cannot do                                                           |
| --------------------- | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| **Owner**             | A **Safe multisig**, per chain | Configure protocol wiring (seeders, registries, fee router), creation fee, supply bounds; **lower** the initial-buy ceiling | Mint tokens, touch user funds, change a launched token, raise a token's tax |
| **AntiVamp guardian** | A hot key (per chain)          | Fan out **symbol/identity blocks** to each chain's `GraduatedTokenRegistry`; reverse mistaken blocks                        | Mint, move liquidity, alter tokens or fees                                  |
| **Treasury**          | Protocol fee sink              | Receive the protocol's 50% of the 1% swap fee                                                                               | Any control over tokens or pools                                            |
| **Keeper**            | Authorized ops key             | Report launch / market-cap milestones (e.g. \~$1M) to drive time-limited AntiVamp locks                                     | Mint, move funds, or set permanent bans                                     |

{% hint style="info" %}
The **guardian** is intentionally a hot key because it must react quickly to fan out copycat blocks across chains. Its powers are limited to the identity blocklist — it cannot touch tokens, liquidity, or fees.
{% endhint %}

## What's immutable vs. time-limited

| Item                                                | Status                                            |
| --------------------------------------------------- | ------------------------------------------------- |
| Token supply / no-mint / no-owner                   | 🔐 Immutable                                      |
| Contract logic (non-upgradeable)                    | 🔐 Immutable                                      |
| Liquidity burn (if chosen)                          | 🔐 Permanent                                      |
| Liquidity lock duration (if chosen)                 | 🔐 Fixed at launch                                |
| Token tax rate                                      | 🔐 Lowerable-only (never raised)                  |
| Anti-snipe caps                                     | ⏳ Auto-expiring windows                           |
| Creator allocation lock                             | ⏳ Fixed duration (if chosen)                      |
| AntiVamp copycat locks (bond 60d/48h; \~$1M 90d/7d) | ⏳ Time-limited                                    |
| AntiVamp guardian block                             | ⚠️ Permanent-until-reversed (guardian-reversible) |

{% hint style="success" %}
✅ The only **permanent** AntiVamp state is a manual **guardian block**, and even that is reversible by a guardian. Every automatic copycat lock is time-limited.
{% endhint %}

## How it fits together

```mermaid
flowchart TD
  L[NovampLaunchFactory.launch] --> T[Fixed-supply token · no mint · no owner]
  L --> S[Seeder creates + seeds real DEX pool]
  S --> LL[LiquidityLocker: burn or lock]
  S --> PV[PositionVault: custody v3 position]
  L --> CV[CreatorVesting: optional alloc lock]
  L --> AS[Anti-snipe caps · auto-expire]
  G[AntiVamp guardian] --> GR[GraduatedTokenRegistry blocklist]
  O[Safe multisig owner] -.config only.-> L
```

Every arrow is disclosed on the token page, and every contract address is published on the [Contract Addresses](/protocol/contracts-and-addresses.md) page.

## Important details

| Property                   | Detail                                                                     |
| -------------------------- | -------------------------------------------------------------------------- |
| Token                      | Fixed-supply `NovampToken` (v3) / `NovampTaxToken` (v2); no mint, no owner |
| Liquidity                  | Burn or lock — permanent per-launch choice                                 |
| Upgradeability             | None — non-upgradeable contracts                                           |
| Blacklists / dynamic taxes | None in v1                                                                 |
| Owner                      | Safe multisig per chain (config only)                                      |
| Guardian                   | Hot key limited to identity blocklist fan-out                              |
| Verification               | Auto-verified via matching template bytecode                               |

## What happens next?

* See exactly which contract does what in [Contract Architecture](/protocol/contract-architecture.md).
* Confirm any launch yourself using [Contract Verification](/protocol/contract-verification.md).

## Continue exploring

* [⛓️ Contract Architecture](/protocol/contract-architecture.md) — the full stack
* [🔎 Contract Verification](/protocol/contract-verification.md) — verify a token yourself
* [🛡️ Anti-Sniper Protections](/creators/anti-snipe-and-protection.md) — the auto-expiring caps
* [⚠️ Risk Disclosure](/legal-and-safety/risk-disclosure.md) — what security can't remove


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.novamp.io/protocol/security-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.