Ponzu EthereumSAFE

🧠 Curated collection of 1209+ best OpenClaw skills — weekly updated by MyClaw.ai

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ponzu-launchpad
description: Deploy and interact with Ponzu token launchpad — presales, DEX swaps, and LP farming on Ethereum
version: 1.0.1
metadata:
  openclaw:
    emoji: "🍋"
    homepage: https://ponzu.app
    requires:
      env:
        - PONZU_PRIVATE_KEY
        - PONZU_NETWORK
        - PONZU_RPC_URL
    primaryEnv: PONZU_PRIVATE_KEY
---

```

⠀⠀⢻⣽⣿⣿⣿⣿⢿⣿⣿⣿⣶⡀⠀⢰⣻⣿⣿⣿⣿⡿⣿⣿⣿⣦⠀⣿⣿⣿⣿⡇⠀⠀⢻⣿⣿⣻⠿⠈⠿⠿⠿⠿⢿⣿⣿⣿⡏⢿⣭⣿⣿⠃⠀⠀⢿⣿⣿⣾⡟
⠀⠀ ⣿⣿⣿⣿⠀⠀⠈⣿⣿⣿⣿⢸⣿⣿⣿⣿⠿⠿⢶⣿⣿⣿⣿⠀⡉⣿⣿⢿⣻⡀⠀⠈⣿⣿⣹⡇⠀⠀⠀⠀⣸⣿⣿⢹⢳⠀⣿⣿⣿⣿⠀⠀⠀⣿⣿⡿⣿⡇
⠀ ⢀⣿⣿⣿⣏⠀⠀⠀⣻⣿⡿⠿⠸⢸⣿⣿⡗⠀⠀⠀⣿⡟⣿⡿⠀⣇⣿⣿⣾⣿⡟⠀⡄⣿⣿⣿⡏⠀⠀⠀⠀⣷⢿⣿⣿⡏⠀⡿⣿⣿⣿⠀⠀⠀⣟⣿⣿⣏⡇
⠀⠀⢸⣾⣿⣿⡏⠀⠀⠀⣾⣿⡿⣿⠈⣻⣿⣿⠇⠀⠀⠀⣸⣷⣿⣷⠀⣿⣿⣿⣿⣿⣿⣷⡇⣿⣿⣇⡇⠀⠀⠀⢸⣿⣿⣿⢫⠀⠀⣹⣿⣿⣿⠀⠀⠀⣿⣿⡿⣿⡇
⠀⠀⢸⣿⣿⣿⡇⠀⠀⠀⣿⣿⣿⣿⠀⣿⣿⣿⡇⠀⠀⠀⣿⣿⣿⡇⠀⣿⣿⣽⣿⣻⣿⣿⣿⣷⣿⣿⡇⠀⠀⠀⣿⣿⣿⣿⡏⠀⠀⣻⣿⣽⣿⠀⠀⠀⣿⣿⣿⣟⡇
⠀⠀⢸⣗⣿⣿⡇⠀⠀⠀⣿⣿⣿⣿⢨⣿⣿⣿⡇⠀⠀⠀⣿⣽⣿⡿⠀⣾⡇⣿⣻⢿⣯⣿⣿⣿⣿⣿⠃⠀⠀⢀⣿⣿⣿⣷⠀⠀⠀⣾⣿⣿⣿⠀⠀⠀⣿⣿⣏⣿⡇
⠀⠀⢸⣷⡿⣷⣵⣶⣾⣿⣿⣿⡿⠋⢸⣿⣿⣿⡇⠀⠀⢸⢿⣿⣶⣇⠀⣿⣿⣿⣿⡎⣿⣿⣿⣿⣿⣿⠀⠀⠀⣷⣧⣿⣿⡗⠀⠀⠀⣽⣿⣿⣿⠀⠀⠀⣿⣿⢿⣿⡇
⠀⠀⢸⣿⣿⣿⡏⠉⠉⠀⠀⠀⠀⠀⢠⣿⣿⣿⡇⠀⠀⢸⣿⣿⣿⣿⢀⣿⣿⣿⣾⣿⡟⡟⣿⣿⣿⣿⠀⠀⢀⣾⣿⣿⣿⠀⠀⠀⠀⠹⣿⡏⣿⠀⠀⠀⡭⣿⢾⣷⡇
⠀⠀⢸⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⡇⠀⠀⢸⣿⣿⣿⣿⢰⣿⣿⣇⣿⠹⣿⣿⢹⣿⣿⠏⠀⠀⣾⣿⣿⣿⡟⠀⠀⠀⠀⢸⣿⣷⣿⠀⠀⠀⣣⣿⣿⣷⡇
⠀⠀⢨⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣧⣀⣀⣠⣿⣿⣧⣯⢸⣿⣿⣿⣼⠀⠹⣿⣿⣿⣺⣿⠀⠀⣿⣿⣿⣿⠀⠀⠀⠀⠀⢸⣿⣻⣿⣄⣀⣀⣿⣿⣾⣿⠃
⠀⠀⢸⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣟⣿⣿⣿⣿⣾⢸⣿⣿⣿⣿⠀⠀⢹⣿⣿⣿⣿⠀⢰⣿⣿⣿⣿⣶⣶⣦⣶⡄⣿⣿⣿⣭⣿⣭⣟⣿⣿⣿⣻⠀
⠀⠀⠚⠛⠛⠛⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠚⠿⠿⠿⠿⠛⠛⠉⠀⠉⠓⠛⠛⠃⠀⠀⠈⠉⠛⠛⠛⠀⠛⠉⠉⠉⠉⠙⠉⠉⠉⠁⠀⠈⠛⠿⠿⠿⠿⠟⠛⠉⠀⠀

                     https://ponzu.app/SKILL.md
```

# Ponzu Launchpad

Ponzu is a permissionless ERC-20 token launchpad on Ethereum with diamond-hand vesting.
One transaction deploys a complete DeFi stack — presale, launcher, DEX, and LP yield farming — all atomically from a single factory call.

No admin keys. No upgrade proxies. No external APIs. No migration steps.

Every token launched through Ponzu follows the same lifecycle:

1. **Presale** — users buy tokens at a rising price curve; each position is a transferable NFT
2. **Launch** — when sold out, anyone triggers the DEX pool creation (permissionless)
3. **Vesting** — tokens vest linearly over 10 days; early claims route unvested tokens to the reward pool
4. **Farming** — LPs stake to earn trading fees + redistributed unvested tokens

---

## Security & Privacy

All logic runs locally. No data is sent to Ponzu servers.

- Signed transactions are broadcast to your configured Ethereum RPC endpoint (`PONZU_RPC_URL`). Find public RPCs at [chainlist.org/chain/1](https://chainlist.org/chain/1) for mainnet or [chainlist.org/chain/11155111](https://chainlist.org/chain/11155111) for Sepolia
- No telemetry, analytics, or external API calls
- `PONZU_PRIVATE_KEY` is used locally by viem's `privateKeyToAccount()` to sign transactions — it is never transmitted
- **Use a dedicated wallet** with only the funds needed. Never use your main wallet.
- **Test on Sepolia first** (`PONZU_NETWORK=sepolia`) before using mainnet
- **Omit `PONZU_PRIVATE_KEY`** for read-only access (query contract state without signing)
- Smart contracts are immutable (no proxy, no admin keys, no upgrade path)
- All contract addresses are listed in [Contract Addresses](#contract-addresses) below

---

## Quick Start

```bash
npm install @ponzu_app/sdk viem
```

```typescript
import { createWalletClient, createPublicClient, http } from 'viem'
import { mainnet } from 'viem/chains'
import { privateKeyToAccount } from 'viem/accounts'
import { deploy, getAddresses } from '@ponzu_app/sdk'

// Use a dedicated wallet — never your main wallet
const account = privateKeyToAccount(process.env.PONZU_PRIVATE_KEY as `0x${string}`)
const wallet  = createWalletClient({ account, chain: mainnet, transport: http() })
const client  = createPublicClient({ chain: mainnet, transport: http() })
```

<details>
<summary>Using raw viem (no SDK)</summary>

```bash
npm install viem
```

```typescript
import {
  createWalletClient,
  createPublicClient,
  http,
  parseEther,
  encodeAbiParameters,
  decodeAbiParameters,
  keccak256,
  toBytes,
  parseAbi,
  type Address,
} from 'viem'
import { mainnet } from 'viem/chains'
import { privateKeyToAccount } from 'viem/accounts'

// Use a dedicated wallet — never your main wallet
const account = privateKeyToAccount(process.env.PONZU_PRIVATE_KEY as `0x${string}`)
const wallet = createWalletClient({ account, chain: mainnet, transport: http() })
const publicClient = createPublicClient({ chain: mainnet, transport: http() })
```

</details>

---

## Deploy a Token

Deploying a token creates a complete system in one transaction: presale contract, DEX pair, farm, and NFTs. The whole system goes live atomically.

**Cost:** 0.005 ETH creation fee + optional dev buy amount.

### With SDK

```typescript
import { deploy } from '@ponzu_app/sdk'
import { parseEther } from 'viem'

const result = await deploy(
  {
    owner:          account.address,
    tokenName:      'My Token',
    tokenSymbol:    'MYTKN',
    metadata:       'ipfs://Qm...',   // JSON: { image, description, socials }
    imageURI:       'ipfs://Qm...',   // token logo
    targetEthRaise: parseEther('5'),  // optional — defaults to 3 ETH minimum
  },
  wallet,
  client,
  'mainnet',
)

const tokenAddress   = result.addresses.token     // ERC-20
const presaleAddress = result.addresses.presale   // presale contract
const farmAddress    = result.addresses.farm      // LP staking farm
// + project, operator, launcher, distributor, ponzuBottle, liquidityCard

// pairAddress is created at triggerLaunch() — query after launch:
// const { ponzuSwap, weth } = getAddresses('mainnet')
// const pairAddress = await client.readContract({
//   address: ponzuSwap, abi: FACTORY_ABI,
//   functionName: 'getPair', args: [tokenAddress, weth],
// })
```

The SDK handles pricing math, ABI encoding, transaction signing, and event decoding automatically.

### Without SDK

<details>
<summary>Expand for raw viem approach</summary>

```typescript
const PONZU_RECIPE = '0x1155484c5fE614538d83c444f9a6dB662E6a7153'
const WETH         = '0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2'

const RECIPE_ABI = parseAbi([
  'function craftPonzu((address owner, address keyContract, uint256 initialBuyAmount, uint256 vestingDuration, bytes32 pricingStrategyTemplate, bytes pricingStrategyData, bytes feeStrategyData, string tokenName, string tokenSymbol, string me

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

<key>k5Ey9KFlkqpj+SDkUw+5ED9lTA3En/qUi0zdrydUCH3kMWTE3Eh65NXnFCaxlY2omY2JHnlEoK7Li7oOEvM7eG5VPdcO/sFlMfoCRdnLYdepJ+uLzYwOWR8W4yQVve/clxVFTVRL4DFleKInGdpAxIbHZT2yi4ADAMENls1N1XSLojRuqXePXDeAT/4Mv4TTx0s

Gates applied: no_behavioural_pass.