Your commitment lives in your locker
D17 removes the website from participant custody.
Many launch interfaces ask users to send assets into one shared sale contract or platform account. D17 places a smaller custody boundary around each participant: a locker contract with one immutable owner.
When the owner commits native ETH, the locker wraps it to WETH. The WETH remains accounted in that locker while the launch records how much belongs to each round. The website never receives it, and the optional read API only observes public state.
The locker permits only the launch paths its code recognizes:
- ordinary round refund, releasing eligible WETH;
- permanent failed-launch refund;
- settlement, splitting final commitment into sale tokens, treasury WETH, and liquidity WETH;
- owner withdrawal of released WETH; and
- owner withdrawal of claimed tokens after trading opens.
Before rules-sensitive work, the locker checks deployed code, launch identity, WETH address, exact rules hash, and canonical factory registration. This does not make every webpage safe—a malicious page can still ask a wallet to sign an unrelated call—but valid locker calls remain constrained by the locker and launch contracts.
If the hosted interface disappears, custody does not move. The owner can call the locker from another Ethereum interface using the same public ABI.