How the house is built.

Loxley is a permissionless, fair-launch token launchpad and a professional trading terminal, built natively for Robinhood Chain (an Ethereum L2, chain ID 4663). Anyone deploys a token in a single transaction. Every token trades immediately on a transparent bonding curve — no presale, no team allocation, no insider rounds. On reaching its graduation threshold it migrates automatically to a public Uniswap V3 market with the liquidity permanently burned.

The price you see is the price everyone gets. The curve is identical for every buyer. Liquidity can never be pulled — not by the creator, not by the protocol, not by anyone, because the design has no fund-rescue backdoor.

Loxley uses a constant-product curve with virtual reserves — the battle-tested x · y = k model. The launchpad holds a token reserve and tracks a virtual ETH reserve; each buy walks up the curve and raises the price, each sell walks down it, smoothly and deterministically. There is no order book to spoof and no off-chain price oracle to manipulate: discovery is mechanical and on-chain from the first wei.

Milestones are denominated in USD and snapshotted to ETH at creation, so a creator gets consistent dollar targets regardless of where ETH trades between launch and graduation.

Every Loxley token shares fixed, transparent parameters:

Total supply

1,000,000,000

Sold on the curve

700,000,000 (70%)

Reserved for liquidity

300,000,000 (30%)

Starting market cap

≈ $4,000 (virtual)

Graduation market cap

≈ $44,000

LP at graduation

100% burned 🔥

Fee per trade

1% (hard-capped at 2%)

The full supply mints at launch straight into the curve contract — there is no separate mint authority, no owner balance, nothing held back. What the contract sells is all there ever is.

Every contract minted through Loxley can carry the house mark: an address ending in the ASCII bytes for hood — 0x…686f6f64. It is earned cryptographically by grinding CREATE2 salts, not assigned.

Crucially, the salt is bound to the caller: the top 20 bytes of every salt must equal msg.sender. This makes vanity front-running impossible — an attacker cannot pre-grind a salt and race your deployment, because a salt that isn't bound to them reverts. It is a genuine security property, not a cosmetic one. The grind runs in a multi-core Web Worker pool in your browser; enforcement is an owner-settable contract toggle, so high-volume launches can opt for instant issuance while keeping the wallet-binding guarantee.

Once the curve fills its ETH target, the token graduates. The reserves migrate into a real Uniswap V3 pool at the curve's fair price, full-range liquidity is minted, and the LP position is burned to 0x…dEaD — liquidity is locked forever. From that point the token trades on the open market and can never have its liquidity removed.

Migration is a permissionless on-chain call: any user can click Graduate → DEX, or an unattended keeper with a gas-only key can drive it. The keeper has zero privileges — it can only ever call migrate(); it can never touch curve funds or the locked LP.

DEX

Uniswap V3 (native RH deployment)

Fee tier

10000 (1%)

V3 Factory

0x1f7d7550B1b028f7571E69A784071F0205FD2EfA

Position Manager

0x73991a25C818Bf1f1128dEAaB1492D45638DE0D3

WETH9

0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73

Because a token's address is public from launch, anyone can pre-create and rig the (token, WETH, 1%) pool at a false price before graduation. Most launchpads add liquidity directly to a V2 pair and hope. Loxley closes the window by construction with a seed → swap → seed reprice:

1. Fresh pool→ initialize at the curve's fair price and seed. (clean path)
2. Pre-initialized within ±3% of fair → honor the live price and seed.
3. Pre-initialized out of band (griefed) → a tiny bootstrap position gives the pool depth, a bounded swap with a hard sqrtPriceLimit pushes price back into the fair band, then the bulk liquidity seeds at the repaired price.

The bulk deposit is always gated by a price-band check and a terminal in-band assertion, and the reprice swap is capped, so the repair can only ever improve liveness — it can never deposit funds far from fair, and worst-case value leaked is bounded to a few percent and only under an actively-funded attack. If the band can't be reached, the whole migration reverts atomically and the collateral stays put, retryable.

A single 1% fee applies to every trade, hard-capped at 2% in code and set before ownership hands off. It splits 70% to the protocol treasury, 30% to the token creator by default.

Fees are pull-payments: they accrue and are claimed, never pushed. A hostile fee recipient can therefore never brick trading by reverting on receipt — a subtle but real failure mode that push-payment designs expose. Creators claim their accrued ETH from their dashboard at any time.

• Per-curve ETH accounting.One token's collateral can never be spent by another.
• Reentrancy guards and checks-effects-interactions on every state-changing external function.
• Guardian circuit breaker. A guardian or owner can pause new launches and buys during an incident — but sells, fee claims and graduation always stay open, so users can always exit.
• Solvency canary. solvent() must always hold; it is monitorable on-chain and backs an incident runbook.
• Two-step ownership with zero-address guards on every role setter; treasury and owner are multisigs.
• No backdoor by design. Nobody — including the owner — can withdraw curve reserves or the burned LP. That is the point.

The contracts ship with a Foundry suite: unit tests, fuzzing, and a stateful solvency invariant that hammers thousands of randomized create / buy / sell / graduate sequences and asserts the launchpad can always cover its liabilities. A mainnet-fork test pre-poisons the graduation pool and asserts the reprice repairs it into the fair band and seeds real two-sided liquidity.

An in-process EVM harness additionally replays the full lifecycle against genuine on-chain bytecode — proving ABI parity and factory/position-manager behavior without trusting a testnet. Both contracts are source-verified on Blockscout.

Hoodbridge is Loxley's crossing between Ethereum and Robinhood Chain — no toll, no allowlist, no seven-day exit window. It routes ETH and USDG through the Relay solver network, which settles in seconds rather than waiting on a canonical challenge period. Your keys and coins never leave your wallet; Loxley only constructs the route.

The launch registry and every coin's chat (the pit) are persisted in Postgres. Both are wallet-authenticated with EIP-191 signatures: reserving a launch or posting a message costs no gas but requires a signature that recovers to the claimed address — so nobody can plant launches on your dashboard or post as you. Rate limits and length caps keep the pit civil.

Loxley runs on Robinhood Chain — an Arbitrum-stack, EVM-equivalent Layer 2, chain ID 4663, ETH as the native gas token. Creation, trading and graduation all happen on-chain and are verifiable on Blockscout. Network telemetry across the app — blocks, gas, ETH price — streams live from the chain; pair-level market data runs on a deterministic simulation, clearly badged, until the venue contracts are wired to their deployed addresses, at which point the same surfaces route real transactions with no code change.

Loxley is experimental software for launching and trading tokens on a bonding curve. Tokens launched here are not investments and carry no promise of value. Nothing here is financial advice. Crypto assets are volatile and you may lose everything you put in. Always do your own research and only risk what you can afford to lose.