LOSURIA
EN · DE Open app ↗
2026-06-09 · Engineering essay · 7-8 min read

Why we built LOSURIA — a non-custodial Ethereum sniper, in public, in 14 weeks

Update 2026-06-17: the access model is now a recurring on-chain subscription — two plans, the Pro plan and the Whale plan, priced in EUR and paid in DAI (settled to DAI) per 30-day period, non-custodial, cancel anytime. The paragraphs below have been updated to match; the core architecture (local Reth, four-builder bundle, passkey wallet) is unchanged.

The pain point that wouldn't go away

For two years we used the dominant server-side sniper: a Telegram bot that holds your keys, with layer after layer of trust-us between you and your own funds.

We watched that model cost real capital in 2025, when a server-side wallet was paused for nine days during a token event some users had armed. No reply, no post-mortem, funds returned eventually with no explanation. That is the failure mode of custody: structural, not accidental.

That was the last time we let a custodian hold private keys while users traded MEV.

We went looking for a non-custodial alternative. There wasn't one. The "non-custodial" snipers we found:

Nothing where the private key lived in hardware-bound secure enclave and never touched a server. Nothing with a local node so the operator couldn't see the user's arming signals before the chain did. Nothing where every contract was Sourcify-verified and the bytecode hash was pinned on a public audit page.

So we built it.

What it is, in one paragraph

LOSURIA is a non-custodial sniper + launchpad on Ethereum mainnet. Backend is Rust + tokio + axum, single binary behind Caddy. The hot path uses our own Reth node over local IPC — no third-party RPC dependency. Order submission goes through a 4-builder private bundle (Flashbots, Beaverbuild, Titan, Lightspeed), no public mempool. The wallet is an EOA derived from a WebAuthn PRF passkey + HKDF-SHA256 — keys never leave the device's secure enclave, there is no seed phrase, no server-side owner-key material, no recoverable backup. Access is an on-chain subscription: the Pro plan unlocks low-latency sniping and the launchpad; the Whale plan adds a priority execution lane (a higher priority-fee ceiling, not dedicated infrastructure), 1 governance vote, and a rolling-out programmatic API to the execution engine. Both are priced in EUR and paid in DAI (settled to DAI) per 30-day period, non-custodial, cancel anytime.

Every contract is on Sourcify with exact_match status. The audit page lists the live addresses with one-click Sourcify lookup. Bytecode sha256 is pinned. The Operator Treasury EOA is a Ledger hardware wallet. The fee-collector contract has no owner role at all (owner() reverts) — TREASURY, STABLE (DAI), WETH and UNIV3_ROUTER are immutable constructor-set slots. A compromised operator key cannot redirect fees, change the sink stablecoin, or swap in a malicious router — the destination and stablecoin are immutable slots with no setter.

Why local Reth, not a shared public RPC

In a MEV-sniper hot path, your read-side and your write-side cannot share fate with anyone outside your trust boundary. Any shared public RPC sees your eth_call and eth_getLogs traffic patterns before the chain does. It sees the contract you're about to interact with. It sees the value you're about to send. It sees the calldata you're about to sign.

Even the most expensive private RPC plans don't give cryptographic non-leakage guarantees, only contractual ones. In a sniper hot path, a contractual promise is not enough: we want the read-side observer eliminated entirely.

So we run our own Reth node. Local IPC socket. The hot path issues eth_calls over /host-tmp/reth.ipc — they hit no network at all. The submit path goes via private builder bundles to four different blockbuilders. The wallet's quote-and-sign cycle reads from our Reth, signs locally on the user's device, and submits to the bundle. There is no external RPC in the trade-critical loop.

What this means for the user: every trade decision lives on the user's device hardware secure enclave and inside our server. No third party gets a "preview" of a trade.

Why passkey-derived keys, not a seed phrase

The single largest UX failure in DeFi is "back up your seed phrase." Eighty percent of self-custody losses happen because of seed-phrase mismanagement, not protocol exploits. The other twenty percent are protocol-exploits where the user signed an eth_signTypedData for something they didn't understand.

Passkeys solve the first problem. A WebAuthn passkey lives in Apple Secure Enclave / Android Keystore / YubiKey. It cannot be extracted, exfiltrated, or backed up to plaintext. The passkey signs a deterministic challenge; we derive a 256-bit secret from the PRF extension (webauthn-rs v0.5); that secret seeds an HKDF-SHA256 derivation to produce the wallet key. The same passkey on the same device deterministically reproduces the same wallet. Cross-device: register a second passkey, derive a second sub-account.

There is no seed phrase to lose. Losing a device is survivable three ways, in the order you should prefer them: a second passkey registered beforehand; the encrypted account vault, which restores the whole wallet after signing in with your email and passphrase; or a private key you exported and stored yourself. If you have none of the three and the passkey itself is gone, the funds are gone — that is the honest cost of keys that never leave your hardware.

Why the contracts are Ownable to the same Ledger EOA

We split the trust model on purpose, and document exactly where an admin key exists and where it does not.

The Ownable contracts (Subscription, Token Factory V3, Treasury Sweeper V1) have owner = the Operator Treasury EOA = a Ledger hardware wallet under the operator's physical control. The Fee Collector (DAI) and the LSR Token are Ownable-less — owner() reverts on both. So the fee-flow path (where revenue lives) has no admin key at all, while the configuration-flow path (where the subscription price lives) is human-controllable for legitimate operational reasons.

What can the operator do?

What can the operator NOT do?

That's the trust model. Read the source on Sourcify. If anything we wrote here doesn't match the bytecode, please tell us.

Why a subscription, not a free open door

We considered a free door and a paid one. Free attracts everyone, including spam by bots and accounts that never trade. Net effect: noise drowns out the people who actually intend to use a non-custodial sniper, and governance becomes meaningless.

So access is a recurring on-chain subscription instead. The Pro plan is roughly €20 for a 30-day period — a low barrier that most active traders amortise on a single snipe, but high enough to keep out drive-by spam — and it unlocks both low-latency sniping and the launchpad. The Whale plan (roughly €200) adds a priority execution lane — Whale orders escalate to a higher priority-fee ceiling than Pro orders, so on a contested launch they outbid and land ahead; a software-side ordering preference, not dedicated infrastructure, not a consensus-level or block-position guarantee — 1 governance vote, and a rolling-out programmatic API to the <100 ms execution engine (rate-limited) for traders who want to build their own strategies on our infrastructure. Both plans are priced in EUR and paid in DAI (settled to DAI) per 30-day period, are non-custodial, and cancel anytime — no lock-in, no one-time sunk cost.

Governance is signed EIP-191 ballots in-app, with an active Whale-plan subscription as voting power at vote-time. It is not a JPEG. It is a working membership you keep only as long as you use it.

The 14-week build, transparently

We shipped lean. No outside capital. Subscription revenue funds the next quarter of infrastructure across every chain we run on.

What's next, and what we are committed to

The roadmap is funded by subscription revenue, not pre-sold. Concretely:

Update, July 2026: the Base and Solana execution engines are built and tested ahead of this schedule. They roll out in a bring-your-own-RPC phase first — you connect your own endpoint, non-custodial as everything else — and the own-node infrastructure above follows from revenue as planned. Current status is always on the roadmap.

What we are NOT committed to:

Where to look

If you want to read the bytecode before subscribing, you should. Open losuria.com/audit, click any contract, follow to Sourcify, read the Solidity. The whole point of this project is that you don't have to trust us. Verify.

— LOSURIA / Negentralgorhythms LLC
Published 2026-06-09. Last updated 2026-06-17.
← All essays