Uroboros whitepaper

Summary

Uroboros is a wallet-security protocol. Its Sanctums run on Ethereum and on Base (chain 8453), and its token, $UROBOROS, lives on Base only. Fees buy back and burn the token, and that burn is the only thing the token promises. The product is the Sanctum, a wallet contract with hourly and daily caps, a six-hour queue for anything big, and a 24-hour freeze that only the owner's offline key can lift early.

Three pieces launch together: the Sanctum with owner-picked guardians, the token with its fee hook, and a public bounty Sanctum anyone may try to rob. A drainer firewall and a paid watcher market come later as separate releases. Section 8 describes both, and neither is deployed.

Security comes from time and from the owner's own keys. The token is only a way to pay for work, funded by real fees, and it secures nothing.

Principles

1. Time, not stake. Caps, queues and delays are enforced by the contract and cost nothing. No feature depends on token market cap.
2. Token pays for work. New tokens are minted only for confirmed alerts, adopted canary flags and bounty events.
3. Nothing on the site that is not on chain. Each piece ships with tests and a proof section before it is mentioned.
4. Price in USD, settle in ETH. Coverage, bonds and rewards are quoted in dollars through Chainlink ETH/USD on Base and paid in ETH (or USDC), so nothing breaks when the token moves tenfold.
5. A Sanctum never locks its own user out for non-payment. Unpaid means no watcher coverage; caps, queue, guardians and the cold key keep working forever.
6. Read the larp checklist first: team fully locked, no pre-buy, launch tax burned, liquidity locked and extended, admin handoff dated.

The Sanctum

A Sanctum is created in one transaction from the factory by the wallet that will be its hot key. The creator names a cold key, a separate wallet kept offline, and 0 to 5 guardians.

Rules

Default rules:

The hot key withdraws inside the caps at once. Anything larger joins the queue; after the wait, either key releases it in full, and the caps do not apply to it. A blacklisted destination is refused either way. From the hot key, rules can only get stricter, and a hot-key change waits at least 3 days; a panic cancels it. The cold key can set any rules at once, withdraw without the queue (but never past the caps), and replace either key.

The hourly limit is a fixed one-hour window, so up to 9.75% can leave within a few seconds across a window boundary. The binding guarantee is 10% per rolling 24 hours.

Freeze

The hot key, the cold key or any one guardian can call panic(). The Sanctum freezes for 24 hours: nothing leaves, and every transfer queued before the panic is void. Only the cold key can unfreeze early. A guardian can re-freeze only in the last hour of a running freeze, so freezes do not stack; after a cold unfreeze, guardians are muted for 24 hours, and anything queued in that window needs the cold key's approval before it can be sent.

Recovery

If the cold key is lost, guardians vote for a new one with proposeCold. When the threshold of distinct guardians has voted for the same address, a 7-day timer starts. The current cold key can cancel at any time; after 7 days anyone can execute it. Only one recovery runs at a time, and changing the guardian set or the cold key voids it. The default threshold is 2 with three or more guardians, otherwise all of them. Two colluding guardians can keep proposing; the cold key must cancel and shrink the set. The cold key can also switch recovery off with setRecoveryOff(true): guardians then cannot propose at all (they keep their panic), any running recovery is cancelled, and the cold key can switch it back on. New Sanctums start with recovery on. If the cold key is lost and the guardians collude, the Sanctum is lost. After a recovery the old hot key is still set; the new cold key must replace it.

Fees

Coverage costs $5 a month per Sanctum, paid in ETH at the Chainlink price (the feed must be fresher than 24 hours) or in USDC. Anyone may pay for any Sanctum and months stack. A new Sanctum with the default rules that holds at least $100 of ETH at creation gets 7 days free. Coverage is a public timestamp, coveredUntil, for watchers to read. The Sanctum itself never reads it, so the free week is a bookkeeping entry only: it gives no protection on chain, and coverage has no on-chain effect until the watcher market launches.

Queued transfers pay 0.25% of the amount when released, in the same asset, to the FeeRouter. Withdrawals inside the caps and cold-key withdrawals are free.

EIP-7702

Sanctum7702 is a delegate for a hot wallet. Once a wallet delegates to it and binds one Sanctum, the wallet's key can only call that Sanctum, and anyone can sweep ETH or tokens that land in the wallet into the Sanctum (0.01 ETH stays behind for gas). It is written and tested; the launch script does not deploy it, and the site shows it as not deployed until its address is published.

Raid the Sanctum

The bounty is a real Sanctum whose hot key is a public contract, BountySanctum. Anyone calls withdraw(token, to, amount) on it from their own wallet, exactly as a thief holding a stolen key would. Whatever the caps let out is theirs, no permission needed.

• Seeded with 0.5 ETH at launch and topped up with 10% of FeeRouter inflow.
• ETH only. A raid must send to an outside address: not the key contract, not the Sanctum. First come, first served; up to 1.99% can go in two transactions seconds apart across an hourly boundary.
• The Sanctum's cold key is BountyCold, a locker contract that deploys the game itself. Its owner (the admin, a Safe after day 30) can only freeze, unfreeze and choose guardians, and can renew a freeze indefinitely. It has no way to withdraw the prize, change the rules or replace the public key, so the prize leaves only through raids. Guardian recovery is switched off in the transaction that creates the game, and BountyCold has no way to switch it back on, so guardians can only freeze and the locker stays the cold key forever.
• Caps of 1% an hour and 2% per rolling 24 hours. The queue is off: anything above the caps reverts with "over cap" instead of queueing, so nobody can park a large transfer and force a freeze loop. The key contract has no way to release a queued transfer even if one existed.
• Guardians are chosen by the admin (the team's watcher and named watchers). They can freeze the game for 24 hours at a time and renew the freeze; watchers at large are switched off, so nobody with a bond can freeze it.
• Every raid emits an Attempt event; the leaderboard is built from them.

The daily cap is the guarantee to quote. The hourly cap is a fixed window that opens at the first withdrawal, so two hourly allowances can leave seconds apart across a window boundary. While building the bounty, a 48-hour simulated robber found that the inherited 24-hour window only remembered 23 to 24 hours; the window now keeps every outflow for at least 24 hours, which makes every Sanctum slightly stricter.

$UROBOROS

A plain ERC-20 with a 100,000,000 hard cap and no owner. 70,000,000 are minted at deploy. The remaining 30,000,000 can only be minted through MinterProxy, and only for confirmed work.

At a 2 ETH seed against 50,000,000 tokens the implied fully diluted value at launch is about 4 ETH.

The fee hook

The pool is Uniswap v4 on Base, ETH against UROBOROS, LP fee 0, tick spacing 60, with UroborosHook. The hook charges 3% of the ETH side of every buy and sell and sends it straight to the FeeRouter as ETH. No UROBOROS ever sits in a tax wallet. The rate is a constant with no setter, and there is no exemption list: the team pays it like anyone.

• Launch curve: at light() the fee is 60% and falls linearly to 3% over 60 seconds. Everything above 3% goes only to buyback and burn.
• Launch limits: for 30 minutes a buy is capped at 1,000,000 UROBOROS, and so is the net amount bought per sending wallet (counted by transaction origin).
• Hardening: only the seeder may add liquidity; only the locker may remove it, and only after its unlock date; exact-output swaps revert; donations revert; the hook is bound to one pool; a buy whose price limit stops it early reverts instead of paying a fee on what did not trade; a pool with no liquidity cannot be swapped.

Aggregators and the Uniswap app allowlist fee-taking hooks by hand, so routing may not exist for weeks. The site links the pool and lists the manual route through UniversalRouter 0x6ff5693b99212da76ad316178a184ab56d299b43.

Minting

The token's only minter is MinterProxy. The proxy mints only when called by its current target contract; attaching a target takes a proposal and 48 hours on chain, and a wallet can never be a target, but a target can be any contract, so read it when it is proposed. No target is attached at launch, so nothing can be minted until the watcher market's WorkRewards contract ships. Its planned rates: up to 200 UROBOROS per confirmed alert (scaled by the Sanctum's value), 500 per adopted canary flag, 300 per confirmed bounty freeze, with a daily cap of the lesser of 50,000 and twice the trailing 7-day buyback, floor 5,000, never rolled over.

FeeRouter

Every fee lands in one contract: the 3% swap fee, coverage payments and the 0.25% queued-transfer fee.

Splits move only inside the bands. The reward pool, bounty and backstop addresses are write-once: each is set a single time and then locked, and a share with no address yet stays in the FeeRouter (each unset slot is one future, permanent owner decision; the reward pool's waits for the watcher market). Only the team address can change, at once for the first 30 days after trading opens and 48 hours after it is proposed from then on. The most the owner can ever direct to an address of its choosing is therefore the team band, 25%.

USDC coverage payments and fees in tokens other than ETH are not split on chain. The owner moves them by hand, and every move is a TokenSwept event.

Buybacks

Each buyback spends at most 1% of the pool's ETH reserve, at least 10 minutes after the previous one, never inside the first 30 minutes of trading. For the first 30 days only the admin or an approved keeper may call it, unless nobody has for 7 days; after that anyone may. Tested against sandwiching: a front-runner loses money at every size tried, because they pay the 3% fee twice. A buyback pays the 3% fee too, so part of every buyback flows back through the splits.

Admin

The handoff date is deploy time plus 30 days, fixed when the contracts are deployed and counted down on the home page. Every handoff takes two steps: the dev wallet nominates the Safe and the Safe accepts. FeeRouter, MinterProxy, Blacklist and BountyCold hand over ownership that way; the liquidity and treasury lockers hand over their beneficiary with transferBeneficiary and acceptBeneficiary. The team vesting beneficiary is fixed in the contract and is never handed to the Safe. If the date slips, everyone can see it.

Not live yet

These are designed and some are partly written. None is deployed. They stay out of the token's pitch, and the site gives one a date only once that date is decided.

Drainer firewall

A second blacklist that carries a source and a reason for every flag, fed by the admin, by canaries (honeypot wallets funded with dust whose delegate reports any approval pull) and later by watchers with enough reputation. Firewall7702 is a light delegate for wallets that don't want a Sanctum: approvals and permits to a flagged spender revert, anyone may revoke an existing approval to a flagged spender, and the owner can optionally sweep into a linked Sanctum. Simulate-before-sign is an off-chain browser tool and comes after.

Watcher market

Anyone registers with a $50 bond in ETH and runs the open-source watcher. A watcher may freeze any Sanctum whose owner switched watchers on. Within 72 hours the owner's cold key either confirms the freeze, which pays the watcher from that Sanctum's own prepaid coverage (60% of its balance, at most $10), or rejects it, which slashes half the bond to the reward pool. Watcher rewards are paid from the subscription of the Sanctum they protected; the shared pool pays only for the bounty Sanctum and canaries. Freezes on Sanctums the watcher created or funded never count toward reputation, and the token mint per alert needs a Sanctum at least 30 days old, holding at least $500, with no rewarded freeze in the last 30 days. Uptime pay is a share of pool inflow, never a fixed figure.

Later

• A backstop pool, after 90 days of fee history.
• A Merkle-root blacklist posted by watchers.
• Sanctum7702 on other EVM chains.
• A competitive audit contest, once fees cover it.

Limits

In the same words as the spec.

• A 7702 delegate cannot stop a stolen key from re-delegating; funds are safe because they sit in the Sanctum, not because of the delegate.
• A freeze is 24h of time, not insurance. Nothing reimburses losses in v1; the backstop pool is roadmap and will show its coverage limit live when it exists.
• Watchers are paid per confirmed freeze; the cold key decides what counts. A Sanctum with no guardians, no watchers and a lost cold key is only as safe as its caps.
• No external audit at launch. The bounty Sanctum is the live test; a competitive review is scheduled when fees cover it, with no date committed.

Uroboros can't stop a key from being stolen. It limits what a stolen hot key can take from the Sanctum, and if the cold key is stolen as well, it can't help.

Audits and decisions

There is no external audit. Three internal rounds were run against the code and the market (AUDIT-1 on the design and the market, AUDIT-2 on the hook, token and FeeRouter, AUDIT-3 on the whole contract set and the deploy script before launch) and are published on the code page.

Applied

• Watcher rewards come from the protected Sanctum's own coverage, so an owner and a watcher cannot farm a shared pool.
• Bounty Sanctum as a leak meter: queue off, 1% and 2% caps, admin-chosen guardians.
• Mint cap tied to trailing buybacks; minting only through a delayed proxy with no target at launch.
• Hook hardening (section 5); buybacks clipped to 1% of the pool, with a cooldown and a keeper period; FeeRouter re-entrancy fixed; all five split bands enforced; destination changes delayed after day 30.
• The token has no owner. USDC accepted for coverage. Free week only for default-rule Sanctums holding at least $100.
• After AUDIT-3: the bounty's cold key became the BountyCold locker; raids are ETH-only and cannot loop back into the game; the reward pool, bounty and backstop fee addresses became write-once, capping what the owner can direct at the 25% team band; FeeRouter, MinterProxy and Blacklist moved to two-step ownership. Then a recovery on/off switch in the Sanctum, off for good on the bounty, closed the last gap; the fourth treasury locker unlocks at 365 days, as specified.

Declined, and kept on purpose

• The 60-second launch curve was kept. The audit called it the predecessor's headline risk for almost no revenue.
• The 3% fee and the 2 ETH seed were kept. The audit noted 3% is about three times the Base norm and that 2 ETH means a launch value near $11k, where a 1% wallet cap is about $114.
• The 7-day extend-only liquidity lock was kept. The audit recommended 365 days; 7 days is below every scanner's threshold. The plan is to extend in launch week, and every extension is listed.
• 30 days of a single admin wallet was kept. The audit recommended a Safe before deploy.

Shipped with disclosure

• The 30-minute wallet cap counts per transaction origin: one person with many wallets gets many caps, users behind one relayer share one.
• Buybacks pay the 3% fee to themselves.
• The free week can be restarted with the same $100 roughly every 6 hours under default caps.
• The owner sets each write-once fee address once; until then that share is held. Only the team address (at most 25%) can be changed later.
• Buybacks need the admin or a keeper for 30 days, with a public fallback after 7 idle days.