OVERVIEW / TRUST MODEL

Owner powers and trust

The list below is the set of onlyOwner functions in the source, not a summary of intentions. The v2 owner is powerful, and the contracts say so in their own comments. Read this before deciding what the word "immutable" is doing in anyone's marketing.

What the V2 factory owner can do

addLaunchConfig / updateLaunchConfig
Add a launch configuration, and replace an existing one. Tokens already launched are unaffected: every term they depend on was snapshotted at launch.
setPairTokenEconomics / setPairTokenApproved
Decide which ERC-20 quote assets may be used and the phantom reserve and threshold their launches price against, in that asset's own decimals. Approval requires real code at the address and a decimals report that matches the stated scale.
setLaunchFee, setLaunchEnabled, setWhitelistedLauncher
Change the native launch fee, open or close launching to the public, and whitelist addresses that may launch while it is closed.
setMaxCreatorTaxBps
Move the ceiling a creator's chosen tax is validated against, up to 10%. Launched tokens keep the rate they launched with.
setSnipeTaxStartBps / setSnipeTaxSeconds
Retune the snipe tax that future launches snapshot. A curve already trading keeps the terms it launched under.
setGraduationExecutor / setLaunchDeployer / setLaunchForwarder
The first two are one-time wiring and revert once set. The forwarder — the router trusted to name the initiating user of an atomic launch-and-buy — can be rotated at any time.
setCreatorFeeRecipient + executeCreatorFeeRecipientChange
Redirect any launch's creator fee recipient, behind a 3-day timelock and a 3-day execution window. Its motivating case is a creator who lost their wallet, but the source is explicit that the power is not conditioned on that, and that a creator's own transfer made while a proposal is pending does not cancel it.
rescueCurveFees, forceSweptGraduation, rescueSweptGraduation
The recovery paths for a quote asset that stops delivering. rescueSweptGraduation releases a stuck launch's swept reserves to one address, and only 7 days after the sweep. Seeding stays permissionless throughout that wait, so anyone can end the window early and permanently with one call to createGraduatedPool.

What the hook owner can do

setHookFeeBps
Set the per-swap fee for future launches, up to MAX_HOOK_FEE_BPS = 1,000 bps (10%). The constructor sets it to 100 bps (1%). Pools already registered keep their snapshotted rate.
setProtocolFeeShareBps
The protocol's share of that fee, up to half (MAX_PROTOCOL_FEE_SHARE_BPS = 5,000 bps). The constructor sets it to 3,000 bps (30%).
setProtocolFeeRecipient, setFeeSweepOperator
Set the protocol's recipient, and the trusted operator allowed to run conversions with explicit minimum outputs.
setFactory
One-time wiring on the hook and the locker. Reverts if called twice.
setBuybackVault, setBuybackBurnBps, setMaxInternalPriceImpactBps
Present in the contracts but unused: the AGI Launchpad never enables that path (the wizard always sends buybackEnabled = false), so these settings change nothing for any launch made here.

What nobody can do

  • Renounce ownership of the V2 stack. renounceOwnership() reverts with OwnershipCannotBeRenounced on AgiV2LaunchFactory, AgiV2MemeHook, AgiV2LaunchLocker and AgiV2BuybackVault. An ownerless stack could never rotate a fee sweep operator or recover a creator's recipient, and every live launch would still depend on those powers. Ownership can still be handed over, two-step, to a new owner.
  • Unlock liquidity. Neither locker exposes a withdraw, transfer, burn or arbitrary-call function. The position NFT stays where it is.
  • Take someone else's fees. AgiV2FeeEscrow is a pull ledger; claim() pays msg.sender and nobody else.
  • Mint, pause or blacklist a launch token. Both launch tokens are fixed-supply ERC-20s with no admin functions. Metadata is set in the constructor.
  • Upgrade anything. There are no proxies anywhere in either tree. A fix means a new deployment; the old one keeps running exactly as it is.
  • Change a launched token's economics. The curve receives its fee, tax, phantom reserve, threshold and fee policy as constructor immutables, and the factory snapshots the pool fee, tick spacing and fee policy per launch.
Model V1 can be left ownerless — and that is not a good thing

V1's factory and locker use OpenZeppelin's Ownable2Step as it comes, without the renounceOwnership() override that Model V2 applies to its own four contracts. A V1 owner therefore can renounce, which would permanently freeze the protocol fee recipient and the fee-collector whitelist on the locker, with no way to appoint anyone who could change them. Not renouncing is an operational rule we would be keeping, not a guarantee the code makes.

Trust does not stop at our contracts

Quote assets have their own issuers, who can pause or restrict them. Uniswap V4's PoolManager and PositionManager are third-party singletons. Robinhood Chain is an L2 with its own sequencer. None of that is under the control of these contracts; the rescue paths exist precisely because it is not.