Smart contracts

Rearctor creates a separate token, pool and fee vault for each reaction. A shared factory registers the launches; a shared hook enforces their canonical V4 pool settings. An optional dedicated protocol treasury accounts for the protocol’s fee receipts and manual spending.

Deployment status: Arc Testnet is connected to live Rearctor deployments; Mainnet remains a preview. The network selector separates the optimized Testnet deployment from the previous immutable deployment. See Network and deployment status for exact identities. Existing Arc or Uniswap infrastructure addresses are not Rearctor factory, hook, vault or treasury addresses.

Contract architecture#

Token, pool and vault implementations are disabled for direct initialization. The factory creates minimal clones and initializes them within the launch transaction. Their implementation target is fixed; these are not upgradeable proxy deployments. The factory’s implementation, manager, quote and treasury addresses are fixed at construction; the hook is bound once before launches can proceed.

The older legacy implementation is not the architecture documented here. A production deployment must explicitly use the reviewed Rearctor contract family.

Values and transaction conventions#

Token amounts use 18 decimals; USDC quote amounts use 6. deadline is a Unix timestamp in seconds. Fee rates and creator-selected allocation shares are basis points, with 10,000 representing 100%. See Tokenomics for the distinction between a trading fee and a share of collected fees.

Successful trades require a nonzero output minimum. Approve the correct input ERC-20 to the canonical pool before direct trading. A launch requires approval to the factory for seed plus any optional dev-buy input. Expired transactions revert, and a quote does not reserve the price or guarantee inclusion.

Factory API#

Creation inputs#

createLaunch(LaunchParams p, FeeConfig fees) returns (token, pool, vault).

LaunchParams contains:

Contract metadata checks enforce byte lengths, not verified ownership of a name, website or social account. Names and symbols can be duplicated. The application may apply stricter formatting than the contract.

FeeConfig contains buyBps, sellBps, creatorBps, buybackBps, liquidityBps and creatorWallet. Each directional fee is 100–1,000 bps. The three allocation fields total 10,000 bps and apply to the 70% remaining after the protocol allocation. The creator wallet must not be a rejected system address.

Reads and setup#

An owner can transfer the factory owner role through the inherited two-step ownership flow. Renouncing ownership is disabled. After hook setup, that owner cannot change a launch’s fees, replace its hook or withdraw its principal. On updated pools it can request early graduation, subject to the pool’s eligibility, deposit and dead-transfer limits.

Pool API#

Trading and quoting#

quoteBuy, previewBuy, maxCurveBuy, quoteSell and quoteBuyback return zero once graduated. This is not a trading shutdown. Use the matching V4 Quoter and getPoolKey() after graduation.

For a V4 exact-input quote, use quoteExactInputSingle with the canonical key, input direction determined by its currency ordering, the amount in input base units and empty hook data. Verify that the Quoter’s poolManager() matches the pool’s manager. The application uses amounts below 2^127 for the signed V4 input-delta path.

Do not choose a quote path solely from an indexed graduated value. The application reads fresh canonical state at a pinned block, validates the pair, vault, manager and hook, and requotes after approvals. It never lowers the originally accepted absolute minimum. The contract makes the final routing decision using its state at execution.

Fees, budgets and guard reads#

executeBuyback, rebalanceFeeLiquidity and addFeeLiquidity are vault-only execution paths. buyFromFactory is factory-only. recordPrice is hook-only. unlockCallback is PoolManager-only and interprets the pool’s internally generated actions; it is not an arbitrary public router.

The graduated flag is permanent. After migration, tokenReserve and quoteReserve are cleared because custody has moved to V4. They are not a measure of V4 liquidity. Read the canonical V4 state alongside lockedLiquidity, migratedToken, migratedQuote, the locked remainder counters and deadTokenRemainder. The last field records the manual-graduation transfer; it is not a reduction in token totalSupply.

Manual graduation interface#

The caller cannot redirect assets or change fees. Only the accounted token remainder is transferred to 0x000000000000000000000000000000000000dEaD; donations, fee budgets and V4 deposits are excluded. This transfer does not invoke burn or reduce totalSupply. Any quote remainder stays locked. Automatic migration retains its small remainders in the pool.

Minimum deposits must be positive; maxDeadTokens may be zero to forbid any nonzero remainder transfer. Deposit shortfalls, a remainder above this cap or an expired deadline revert the whole migration. Accepted factory ownership transfers change this authority. Old immutable clones require a new deployment to support this method and its getters; manualGraduationEnabled() alone does not identify the extension.

Fee vault API#

Only the registered pool can call accrue, and only for the configured quote or token asset. Direct transfers to the vault are not automatically recognized as fees or spendable budgets. There is no general vault rescue function that turns unaccounted donations into withdrawable revenue.

No administrator is needed to call the three project-budget processing methods. Permissionless callers cannot choose their own destination or take the output. Processing can still fail because of an uninitialized price reference, the price guard, unbalanced amounts, output minima or token transfer restrictions.

Hook and canonical identity#

The hook’s required address flags are 0x2880: beforeInitialize, beforeAddLiquidity and beforeSwap. Its key uses the sorted token/quote addresses, dynamic-fee flag 0x800000, tick spacing 200 and the hook itself.

Only the factory can register a configuration, and an existing pool ID cannot be overwritten. Registration cross-checks the pool, vault and distribution hash. Only PoolManager can invoke the hook callbacks. Initialization and LP additions additionally require the registered RearctorPool as sender. Swaps through this key may come through other routers, but they still invoke the hook and its directional fee logic.

Canonical validation should start from a verified factory deployment and confirm isPool, the pool’s factory, token, quote, vault, manager, hook, full getPoolKey() and poolId(). A familiar symbol or a token pair alone is not sufficient.

Protocol treasury API and permissions#

The protocol treasury has its own two-step owner role, separate from the factory’s setup role. Renouncing that role is disabled.

The contract’s target binding validates a canonical pool; it does not enforce the name “Rearc,” the symbol, or launch index zero. The application’s official-token verification additionally checks the first registered launch and its treasury binding. Verify both layers before treating a token as official.

A curve-stage treasury purchase can spend less than requested when it completes graduation. The current treasury records actual USDC spent, preserves the refund and burns only the newly purchased tokens. It also verifies the corresponding supply reduction. The requested maximum must still fit the treasury’s available recorded USDC and applicable pool guard checks.

Useful accounting reads include availableProtocolUSDC, totalProtocolUSDCReceived, totalUSDCFromConversions, totalOperationsUSDCWithdrawn, totalBuybackUSDCSpent, totalRearctorBurned, buybackExecutions and the per-token received, available, converted and withdrawn counters.

Events and indexing semantics#

Use PoolManager’s Swap events filtered by the full canonical pool ID for complete V4 trade history and actual V4 fee fields. A pool’s post-graduation Trade event duplicates the corresponding swap when the pool acts as router; counting both doubles volume. External-router swaps can produce a canonical V4 Swap without a Rearctor Trade.

Similarly, the pool’s volume counter tracks its buy/sell routing paths and is not a complete count of all external-router V4 activity. Indexers need a clear graduation boundary, transaction/log identity, confirmed block coverage and reorganization handling. An external-router Swap.sender can be a router contract, not the ultimate wallet. Holder burns emit the ERC-20 burn transfer but do not increase a vault’s or treasury’s buyback counters.

Permission summary#

Users control their own trades and token burns. Anyone can create a valid launch, claim for a fixed beneficiary, collect V4 fees, execute eligible project budgets and collect protocol receipts. The factory owner establishes the initial hook, can transfer its role and can execute eligible early migration through manualGraduate. The treasury owner retains spending authority over treasury assets. No role can withdraw a project pool’s committed principal, rewrite its fee split, replace its canonical hook, mint extra project supply.

See Permissions and liquidity for contract roles and asset controls.

Adjustable minimum initial liquidity#

minimumSeed() starts at 1 USDC (1_000_000 base units). Only the current factory owner may call setMinimumSeed(uint256). The amount must be at least minimumSeedFloor() (1 USDC in the next deployment; the existing Testnet revision permits one base unit, 0.000001 USDC) and strictly below 5,042 USDC. MinimumSeedUpdated(previousMinimum,newMinimum) records each update. The deposit remains pool principal; this setting is not a protocol fee. Existing pools, fees, reserves and graduation thresholds are unaffected. Both launch previews use the current setting.