LaunchProof is an educational reference implementation. It has not been audited and is not production-ready.
The default administrator controls role membership through OpenZeppelin's delayed default-admin transfer rules. Deployment should assign this role to a carefully operated multisig. SALE_MANAGER_ROLE funds and finalizes/cancels, PAUSER_ROLE only controls purchases, BLOCKLIST_MANAGER_ROLE only controls new-purchase eligibility, and TREASURY_ROLE withdraws successful escrow or safe surplus.
Economic terms become timestamp-locked at saleStart; an administrator cannot extend the window or rewrite phases, allocation, soft cap, vesting, or payment feeds afterward.
Feeds are trusted external dependencies. Answers must be positive, updated, within staleness bounds and from a complete round. Feed decimals are normalized rather than assumed. Optional L2 sequencer validation rejects downtime and a post-recovery grace period. A valid oracle price can still lag a fast market, and stablecoins can depeg, freeze, blacklist, or upgrade. Contributions use observed purchase-time valuation; later price changes do not rewrite the soft-cap ledger.
V2's public Sepolia dUSDC and dUSDT are capped six-decimal LaunchProof demo tokens, not official Circle or Tether assets. Their MINTER_ROLE was granted to the V2 faucet and renounced by the deployment wallet before the sale opened. Public users, the deployer, and the sale cannot mint. The faucet can mint only within each immutable token cap and permits one fixed 1,000-token claim per account/token pair every 24 hours. Wallet splitting can bypass per-address limits, so this is an anti-abuse convenience rather than identity or Sybil resistance.
V2 stablecoin feeds permanently report exactly $1 at eight decimals. They have no setter, administrator, round mutation, proxy, or upgrade path. Their updatedAt tracks the current block only to keep the 30-day educational demo usable. They are synthetic denomination adapters—not market oracles—and must never be reused for real assets, collateral valuation, or production risk decisions. ETH pricing remains an external Chainlink Sepolia dependency.
Deployment finalization checks full LPF funding, zero unintended deployer LPF balance, faucet minter membership, and absence of deployer minter membership. Public artifacts begin as pending; a separate Etherscan API V2 query must return source, ABI, and expected contract metadata for every address before release validation accepts verified.
Checks-effects-interactions and ReentrancyGuard protect purchase, refund, claim and withdrawal paths. ERC-20 input balances are measured, so transfer-tax behavior is rejected. Failed/cancelled refunds delete the position before interaction and return the exact original asset amount. Successful treasury withdrawals are capped by per-asset escrow accounting.
The blocklist deliberately blocks only new purchases by either buyer or beneficiary. It can never trap refunds or vested claims. Pausing has the same narrow scope. This prioritizes user exit rights over post-purchase administrative control.
Sale-token recovery is limited to balance above outstanding entitlements. Supported payment tokens cannot use generic recovery. Native recovery excludes recorded escrow, including failed/cancelled reserves. Forced ETH can be recovered only as that arithmetic surplus.
Token output and linear vesting round down. Exact phase fills compute USD cost upward. Dust favors sale solvency. The contract supports standard ERC-20 behavior only and does not handle rebasing tokens, ERC-777 hooks, fee-on-transfer assets, oracle-free fallback pricing, sanctions adjudication, cross-chain settlement, governance, or upgradeability. Frontend role visibility is convenience only; contracts enforce every authorization.