Safety and audits

The core is Uniswap's, unmodified

The DualPool hook we deploy is byte for byte identical to Uniswap's upstream release, deployed through Uniswap's own AllowlistedFactory pattern. Uniswap audited the hook upstream. Anyone can diff our deployment against the published source and confirm the match.

The wrappers are open source and machine checked

Twofold's wrapper contracts (OperatorController, VaultAllowlist, Registry, StakingVault, TwofoldToken) are open source. Each went through a static-analysis battery of Slither, Aderyn, Halmos, and Mythril, plus mutation-tested test suites that prove the tests fail when the guards break. We claim no third-party audit of the wrappers; read the code and the analysis output yourself.

Structural guarantees

• ✓Vaults allowlisted by exact address. A pool can only rest capital in a vault the allowlist names.
• ✓Every pool verifiable. The Twofold factory creates every pool, and the on-chain Registry lets anyone check a pool live before trading it. It holds 29 listings today, and this page reads them from the chain rather than from a list we typed.
• ✓No pre-bootstrap swaps. Pool prices cannot be swapped before bootstrap.
• ✓Pause only makes pools safer. The emergency pause can stop activity. It cannot redirect funds.
• ✓Principal cannot be touched by operations. Opening a pool, recentering, pausing and harvesting the seed's own gain are the operator's calls, and none of them can reach LP principal.
• ✓Owner powers are protected. Ownership is moving behind a multisig and a timelock; see Who controls what.
• ✓Unstake cooldown. Prevents flash-in, flash-out capture of staking rewards.
• ✓Genesis liquidity locked forever. The TWO/WETH genesis position (Uniswap v4 position 1076283, all of its liquidity) sits in the PositionLocker contract. The locker has no transfer, no withdrawal and no burn path, and ownership cannot be renounced. The only thing anyone can do with it is claim the accrued swap fees, which any caller may trigger and which go to the fee wallet.