Security model

Trusted inputs

Users still trust their wallet software, the network endpoint used to read and submit transactions, the correctness of the deployed bytecode, and their own review of transaction details. In API mode they additionally trust the read service for presentation availability, while canonical transaction effects remain on-chain.

Reduced trust

• The website never receives a private key or holds user funds.
• The read API is GET-only and signs no transaction.
• Participant WETH stays in a wallet-owned locker.
• Launch rules are immutable and hash-verifiable.
• Token minting closes during atomic launch creation.
• No unsettled locker can veto the endgame.
• Protocol LP stays in a vault without a withdrawal method.

Reentrancy and transfer boundaries

Locker and vault asset-moving functions use explicit non-reentrancy guards. State is updated before external transfers where required. ERC-20 movements use a bounded low-level transfer helper compatible with tokens that return no Boolean while rejecting failed or false-returning calls.

Pair and market risk

The official pool path rejects an already-live pair and a pair preseeded with the D17 token. A third party may create an empty pair or donate WETH before creation; the contract records preseeded reserves and the donated value accrues to locked LP rather than granting the donor protocol control.

After trading opens, market price can diverge. Late liquidity is supplied using the launch's reserved token/WETH relationship; an imbalanced mint may transfer value to existing LP holders through normal Uniswap V2 mechanics. This does not increase the late participant's configured WETH charge or reduce their sale-token entitlement.

Operational API controls

The reference API includes origin checks, GET/OPTIONS restrictions, in-process IP rate limits, HTTP/WebSocket/SSE client caps, bounded WebSocket payloads, SVG sanitization checks, and conservative proxy-header handling. Public operators still need HTTPS, an edge proxy, process supervision, backups, log rotation, and limits sized for their traffic.

Disclosure

Extensive automated, local end-to-end, adversarial, and Sepolia evidence is useful but not equivalent to a formal professional audit. Treat D17 as experimental code and independently review any deployment that may hold real value.