7175 616C 6D2F 7072 6F74 6F63 6F6C 2F30 31 · 5355 5050 4C59 2049 5320 4D4F 4E4F 544F 4E49 43
the protocol
a contract on robinhood chain owns the token's creator revenue and can do exactly one thing with it: buy that same token back and burn what it bought. not a policy. not a promise. the only path the ether has.
- functions that move money
- 1
- owners
- 0
- crank interval
- 210s
- burn share
- 100%
- pinned token
- 1
status qualm currently runs one token, its own. the distribution layer in section 04 is a specification and is not live.
00 the protocol proven on a mainnet fork
where the money comes from
every trade of the token pays a creator fee. on pons that fee accrues on the launch's bonding curve, and after graduation on a uniswap v4 hook, and is credited to whatever address the factory records as the creator-fee recipient. one wallet launches the token, deploys this contract, and hands the recipient to it with a single factory call. from that block the revenue is addressed to an account no human holds a key to.
there is no other income. no treasury behind the treasury, no emissions, no yield manufactured in a back room. when the chart is quiet the escrow is thin, and a thin escrow burns a small number. the machine does not have an opinion about this.
recipient := QualmBurner the address the fees are paid to is a contract with no owner, no withdraw, and no upgrade. it exists after the token does, and it cannot be told to do anything but burn.
the contract holds no keys
the contract deliberately has no privileged function. there is no owner, no pause, no rescue, and no way to change the token, the curve, the escrow or the router after construction. every dependency is an immutable read from the factory's launch record at the moment of deployment, and the constructor refuses to deploy at all if the launch pays its fees in anything but native ether or has pons's own buyback enabled.
the cycle
sweep, claim, buy, burn. one function, one transaction, atomic. either every leg lands or the transaction reverts and the contract is exactly as it was.
| leg | contract | moves |
|---|---|---|
| sweepFees | pons curve, or the hook after graduation | accrued fees to the escrow, split protocol and creator |
| claim | pons escrow | the creator share, in ether, to the burner |
| buy | pons curve, or uniswap v4 after graduation | the burner's ether to the same token |
| burn | the token | every token the buy returned out of existence |
| bounty | the burner | a fixed amount to whoever cranked |
the buy is addressed to the contract itself and the burn takes the whole balance, measured after the buy rather than estimated before it. there is no dial. the burn share is one hundred percent, and there is no instruction that could make it anything else.
the floor and the ceiling
two immutable numbers bound every crank. below minSpend the contract refuses, so nobody can farm the bounty on dust. above maxSpend the contract caps the buy and leaves the remainder for the next crank, so no single buy can move the curve further than the deployer chose to allow. both live in the contract, not in the process that calls it, so a broken cranker cannot spend through them.
spend = balance - bounty spend < minSpend => revert spend > maxSpend => spend = maxSpend
the crank
something has to choose the moment. a crank process calls the contract on a fixed interval, defaulting to 210 seconds with jitter, after quoting the buy off-chain and simulating the call. it holds no power the contract does not grant to everyone: the function is permissionless, and the caller is paid a fixed bounty out of the claimed fees. the worst a stolen crank key achieves is buying the correct token at a bad price, and the slippage floor it passes is checked by the curve itself.
graduation
a pons launch trades on a bonding curve until 4.2 eth has been raised, then graduates into a uniswap v4 pool behind pons's hook. the contract reads the launch phase on every crank. on the curve it buys from the curve. once the pool exists it buys through the universal router with the hook in the pool key. in the gap between the two, when the curve has closed and the pool has not been created, the crank refuses and the worker creates the pool itself, which anyone may do.
01 what cannot happen enforced on chain
every protocol has a list of things it promises not to do. this is the shorter list of things it is not able to do, which is a different document entirely. each of these is checked by the contract on every call, not by the process that runs it.
- the fees cannot buy another token. the token and its curve are immutables set at construction from the factory's own record. there is no function that changes them.
- the contract cannot pay a human. every destination is fixed: the curve or pool it buys from, the burn, and one bounty of one fixed size to whoever cranked. the function is permissionless precisely because a caller chooses only the moment, never the recipient.
- nobody can turn it off. there is no pause, no owner to add one, and no upgrade path to introduce one later.
- the contract cannot hold the token. the burn takes its entire balance every crank. there is no sell, no transfer, and no approval anywhere in the code.
- a partial cycle cannot exist. sweep, claim, buy and burn are one transaction. there is no state in which the fees have been claimed and the tokens have not been bought, or bought and not burned.
for all t : supply(t+1) <= supply(t) supply is monotonic downward. the contract contains no mint, no authority over one, and no path to acquire one. the only direction is fewer.
02 the function surface shipped
one contract, deployed once per token. its state is five counters and a reentrancy lock: lifetime tokens burned, lifetime cranks, the timestamp of the last crank, and the ether spent and tokens burned by the last crank. that is the entire state, and all of it is public.
| function | who may call | what it does |
|---|---|---|
| crank(minTokensOut) | anyone | sweep, claim, buy and burn in one transaction, then pay the caller the bounty |
| unsweptFees() | view | fees accrued on the curve or hook that the next crank will move |
| claimable() | view | ether waiting in the escrow under the contract's name |
| spendable() | view | what the next crank could spend after the bounty |
| totalBurned, crankCount, lastCrankAt | view | the lifetime record |
| lastBurnQuote, lastBurnTokens | view | the last crank, for the page's one live line |
| poolKey() | view | the uniswap v4 pool the token trades in after graduation |
crank is open to anyone because every destination is already fixed. handing a stranger the ability to press the button is safe exactly when the button is wired to one place. if you want to pay the gas to make the burn happen sooner, the protocol will pay you a bounty for it.
03 the maths current
revenue
dR/dt = phi * V(t) the escrow fills at the creator's share of the fee rate times traded volume. a quiet chart is a cold room. this is a burn engine, not a printing press.
the burn
B_k = q_k q is what the buy actually returned, measured across the transaction, not estimated before it. every bought token is burned. there is no second place.
cumulative supply removed
dS(t) = -(sum over k <= t) q_k the counter on the desk is total supply at launch minus total supply now, read from the token, not from the engine's own memory. a number that reports on itself is not a report.
the spend ceiling
spend_k <= min(maxSpend, balance - bounty) the engine may spend what it holds above the bounty and not one wei more, and never more per crank than the ceiling the deployer set.
lemma: the destination is not a choice
let m be the pinned token and c its curve. both are immutables read from the factory at construction, and the buy is always addressed to the contract itself. neither is supplied by the caller. therefore for any caller, authorised or stolen, the set of reachable destinations has cardinality one.
lemma: the cycle has no partial state
sweep, claim, buy and burn execute inside a single transaction. the evm reverts a failed transaction in full. therefore no block exists in which the fees have been claimed and the tokens have not been bought, or bought and not burned. the intermediate states are unobservable because they are never committed.
lemma: nothing moves value but the crank
the contract has exactly one non-view function and no owner. there is no rotation, no rescue, and no administrative path. the only thing that can move value is the cycle, and the cycle moves it to one place.
04 the distribution layer specification, not yet live
status everything above this line is implemented and proven. this section is the specification for the registration layer being fitted to the same engine: other pons launches handing their fee streams to burners of their own. it is written here so the mechanism is public before it runs, not after. nothing in this section is live, and no fee outside qualm's own has been burned.
registration
a launch registers by deploying a burner from the same bytecode with its own token pinned, then transferring its creator-fee recipient to it through the factory. the registry records the pair. from that block the launch's fees have the same single path qualm's do.
lemma: registration is not custody
the registry holds no funds and no keys. it lists addresses. a burner deployed for another token has that token pinned and cannot be pointed at qualm's, and qualm's cannot be pointed at it. the cranker that serves the registry can only ever make each burn happen sooner.
the crank pool
for each registered burner: if spendable() >= minSpend then crank one process, many buttons, all wired to one place each. the bounty pays for the gas of every button it presses.
05 records and failure current
what was proven, and where
the contract is proven end to end on a fork of robinhood chain mainnet against the deployed pons factory, escrow, hook and the deployed uniswap v4 universal router. not a mock, not a testnet stub. the fork suite launches a token through the real factory, hands the fee stream to a burner, generates third party volume, and cranks.
| measurement | value |
|---|---|
| fork tests | 9 of 9 |
| transactions for sweep, claim, buy and burn | 1 |
| total supply removed by the first fork crank | 10,658,455 tokens, 1.0658% of supply |
| ether left in the burner after the crank | 0 |
| graduation and pool creation by the worker | proven |
| buy through the uniswap v4 pool | proven |
the attestation
the page reads every number from the chain: the contract's own counters and the token's total supply. the engine's journal is a record of attempts, not of outcomes. books claiming more than the chain shows is the alarm that outranks every other alarm.
what is promised
nothing. no yield, no appreciation, no roadmap, no future. the protocol promises conduct: fees claimed, supply burned, records kept, failures published. whether the token is worth holding is a judgement this page is not equipped to make, and any page that offers to make it for you is selling something.
7468 6520 6F6E 6C79 2064 6972 6563 7469 6F6E 2069 7320 6665 7765 72 · supply is monotonic downward