The keys
Every power, in one table.
Most products of this kind describe their trust model in a paragraph you have to parse. This is the matrix: every party that holds a key, against every thing that could go wrong. A yes is a power. A no is a contract reverting.
| Can they | Whoever struck the coin | ROYALTY attester key | ROYALTY registry owner | pons | The builder |
|---|---|---|---|---|---|
| Move royalties out of a vault | no | no | no | no | yesonly the bound wallet, only what has accrued |
| Take back what has accrued | nothere is no recovery window, at the strike or ever | no | no | no | no |
| Redirect the fee route away from the vault | nothe press is the deployer of record | no | no | read the fine printpons's locker owner controls who may trigger collection, never where it goes; a future pons upgrade is pons's, not ours | no |
| Change the royalty rate | no | no | no | no | no |
| Say which wallet a GitHub login is | no | propose onlyone signature, 48 hours in public, then anyone finalises | nocannot propose, cannot bind | no | chooses the walletthe builder picks the address and posts it themselves |
| Cancel a pending binding | no | yesduring the 48 hours | yesduring the 48 hours; the only emergency brake | no | no |
| Change a binding once it is final | no | no | no | no | no |
| Rotate the attester key | no | no | yesafter a 48 hour public notice | no | no |
| Decide when fees become collectable | no | no | no | yespons sweeps liquidity positions on its own cadence; uncollected lags accrued | no |
| Sweep accrued fees into a vault | anyone | anyone | anyone | anyone | anyone |
Six stops
A person, one transaction
Someone strikes a coin
They name a builder by GitHub login or wallet, name the coin, and set the royalty, fifty to one hundred percent. The press launches the coin on pons in the same transaction, so the press, not the person, is the coin's deployer of record.
Enforced on-chain, sealed in the launch block
The fee route is sealed
pons lets a coin's deployer redirect creator fees at any time. Our press is that deployer, points the fees at the new vault, and ships no function that could ever point them anywhere else. There is no owner on the press and no owner on the vault.
pons, every trade
Fees accrue in the locked position
Every trade pays a creator fee into the coin's locked liquidity position on pons. pons sweeps those positions on its own cadence. Until a sweep the royalty has accrued but is not yet collectable, and the statement prints both numbers.
Enforced on-chain, permissionless
Anyone sweeps
Anyone can call the vault's sweep. It pulls what the position holds, splits it by the sealed rate, pays the remainder to whoever struck the coin, and books the builder's royalty. Nothing is trusted to an operator.
The builder, once
The name is bound to a wallet
A wallet coin skips this stop. A GitHub coin needs the login tied to one wallet: the builder signs in here, our attester signs the pair, the builder posts it, and it sits on the chain for 48 hours. Then anyone can finalise it, and it is permanent.
Enforced on-chain, only the bound wallet
They collect
The bound wallet collects, or directs the payment to an address of its choosing. Everything uncollected pays out as native ETH plus the coin's own fee share. If they never come, stop six never happens, and the coin keeps its royalties in public.
Wallet coin, GitHub coin
Wallet coin
- Struck for one address, fixed at the strike.
- Reads no registry, trusts no key of ours.
- If the builder loses that wallet, the royalties wait forever. That is the trade.
GitHub coin
- Struck for a login. The builder chooses the wallet later, once.
- Depends on our attester saying the login is that wallet. That is the one trusted thing here, and it is bounded: propose only, 48 hours in public, permanent after.
- If the builder's GitHub account is taken over inside those 48 hours, the registry owner can cancel the post. That is what the brake is for, and it is all the brake can do.