The smaller the trust surface, the smaller the failure surface.

Every deployed entry above is the live bytecode at the address as of mainnet block 25 512 495 (July 11, 2026); the LOSURIA Subscription is deployed at 0x11Eb592D…35052dcc, Sourcify-verified. The LOSURIA Subscription is Ownable with the owner set to the Ledger-controlled Operator Treasury, the cold operator address. The DEX-venue Token Factory is Ownable2Step to an operator EOA whose entire power is one bounded knob — the featured-slot fee, hard-capped on-chain between 0.005 and 1 ETH/day; the 1 % launch fee is a compile-time constant with no setter, and the LP lock is enforced by the factory itself. The Fee Collector DAI and the LSR token are issued without an owner role at all (any call to owner() reverts), so there is no admin key to renounce or compromise. The Fee Collector's destination (TREASURY), stablecoin (STABLE = DAI), wrapped-native (WETH) and DEX router (UNIV3_ROUTER) are all immutable Solidity slots set in the constructor, verified on-chain to be the Operator Treasury, DAI, canonical WETH and Uniswap V3 SwapRouter02 respectively. A compromised operator key cannot redirect fees, change the stablecoin or swap in a malicious router. The LOSURIA Subscription is non-custodial: each subscription payment transfers straight from the subscriber to the immutable Treasury, so the contract never holds user funds, and each tier price is bounded on-chain to a 50–200 % corridor of its deploy value. Every Ethereum swap and snipe settles through the owner-less, immutable Swap Forwarder (Base, Solana and Monad use the per-chain paths in the table above): it takes the fixed 1 % platform fee to the immutable treasury, routes the remainder through the best-quote DEX, and verifies your minimum-out before the tokens are released — the fee rate and the treasury address have no setter, so no operator key can raise or redirect them. Native sends on Ethereum settle the same way through the owner-less Send Forwarder (0.05 %). Snipes execute from a self-custodial session key: a dedicated address derived from your own wallet key, funded with exactly the amount you choose to risk. It cannot touch your main wallet, your worst case equals what you funded, disarm sweeps the whole position home, and you can re-derive the key from your passkey wallet and recover the funds yourself at any time — with or without LOSURIA. The KOL referral rev-share is integrated inside the LOSURIA Subscription contract itself: a self-funding split paid out of the subscription revenue it already holds (setKol via the referral manager, claimReferral bounded so a KOL can never claim more than was credited), so there is no separate payout contract to fund or trust. The Solidity source for every deployed address is one click away on Sourcify (exact_match).

Open the Token Factory lookup and you see the Solidity source side-by-side with the on-chain bytecode, no “trust the deployment notes” step in the middle. The LOSURIA Subscription is verified the same way, exact_match at 0x11Eb592D…35052dcc.

An Etherscan verification badge is the post-launch operator action; until it lands, Sourcify is the canonical trust signal. The bytecode-pinning table below makes the verification provider irrelevant, you can verify without trusting any third-party verifier.

For the spot-check from a terminal, the on-chain bytecode is one cast call away, no clone required:

cast code 0xD12C3efe64F9094a27918aCF79E83958A57bE94E \
  --rpc-url https://eth.llamarpc.com   # any mainnet RPC works
# The result is content-addressable, so future verifiers get the
# same bytes regardless of which RPC they ask.

For a deterministic spot-check, every contract's runtime-bytecode sha256 is pinned below. Each hash was taken at mainnet block 25 512 495 (July 11, 2026) from the operator's local Reth node; non-upgradeable contracts are immutable, so the hash matches forever. Pipe cast code into sha256sum and the digest must match this table, line-for-line.

# Verify any row deterministically:
cast code <ADDRESS> --rpc-url <ANY_RPC> \
  | tr -d $'\n' \
  | sha256sum

Full 64-character digests, no abbreviation, in table order: 4990c3c09abb896c84b42c0459da0ab4723aded98da8783f3de1bca7b9e21236 · 324e373938832be340143f46cb4bcd9293ccd7933cf7fc2a65f27c1ab559a608 · 0006b47982155ba8a7eddd0176c456b4b3617d6ba3d7a3f04a26790b93bebeda · 0d67e6705cb54b08a3f9043ff089da1cc2292c5f64096cccb879deeb3b66dc7a · 7d4df3a1390fdd0ad3379d85062b156ea7efcb0f94c7f8daed3b45fccd8d926d · db4ba781de10a3f28cf8368845b2a9cfdc93db58260a93347f36efe7340d9872 · acd8cf2c77a2c545d846b1ce0b89780a6d684901bcbf6bb37e608a47b5b70e3b.

If you find a source-vs-bytecode mismatch on any address above, that is a security incident. File it in-app under Settings · Support; the ticket is bound to your wallet, the reply lands as a push notification, and the operator reads every one.

A full source repository mirror is part of the post-launch transparency roadmap; until then the Sourcify exact-match record is the canonical third-party artifact.

/trades lists every executed swap, with the tx hash and Etherscan link. No selection, no curation. Includes the operator's own micro-swaps labelled [op-test]. /latency shows p50 / p95 / p99 per chain over the last hour, day, week, measured on the live execution path — Ethereum swaps through our own Reth node, snipe detect-to-submit on the RPC each session actually runs on — not a marketing claim. /architecture documents every component of the platform with its threat-model boundary and the test that proves it, updated whenever the stack changes.

A formal Tier-1 audit is funded post-revenue and the full report will be published in either direction. Until it lands, the source itself is the proof: read exactly what executes and verify it against the bytecode.