Welcome to MoonVault.
Transparency
Every figure here is read from PulseChain when the page opens. Where there is nothing yet, it says so rather than filling the space.
Reading the chain…
Owner powers: who can do what
Every access-restricted function in the PulseChain launch contracts: who holds it at launch, what it can do, and whether it still works after the launch freeze. Base is not deployed and is not listed.
- No proxies and no upgrades: the contract code cannot be changed.
- No general pause switch in any contract. Exits (seal, terminate, rescue withdraw) have no owner gate.
- No timelocks on PulseChain: a still-live power takes effect immediately.
- The freezes are one-way. At launch the owner sends six freezes (runbook step R12) and a check script fails unless all six are set.
- The owner can never move vault principal, change fee splits or penalties, or block terminate or rescue withdraw.
Holders at launch
| 0xc78C…60e0 | Owner wallet (browser-signed, no key on any server) |
| 0xa70a…910d | Keeper (automated server wallet) |
| 0x268c…b05 | Backup keeper (price feeder, added after launch) |
| 0x69C3…57DE | BoosterGuard (sets Identity dividend boosts). Its only operator is the Booster wallet 0x6B8e…c4, which the owner can revoke or pause at any time |
| 0x8CBF…f8C | Identity relayer (gift bindings only) |
| 0xDDFB…a28 | Identity treasurer (assigns commission pools) |
| — | Identity settler: unset at launch (Phase 2) |
| 0x41FC…F742 | Deployer: owns contracts only during the deploy run, then holds no role |
Treasury 0x6211…895F, Referral pool 0xf647…309C and Root #001 0x6241…8DBC only receive funds. They are fixed in the contracts (immutable or frozen): only a redeploy could move them.
MoonVaultEngine · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| wire | Owner | Frozen | Set the core connections (oracle, shares, fee router, swap router). |
| setPositions | Owner | Frozen | Set the position NFT that decides who holds each vault. |
| finalizeWiring | Owner | The freeze switch (one-way) | Freeze the wiring above for good. |
| wireContributionPool | Owner | Used at deploy, now dead | Set the contribution pool once. Already set at deploy. |
| setAssetListed | Owner | Still live | Allow or stop new vaults in an asset. Delisting never blocks exits. |
| setSlippageOverride | Owner | Still live | Set an asset's sale price floor between 3% and 20% (MOONX 15%). Existing vaults keep the value from their mint. |
| setBonusHooks | Owner | Still live | Point the referral share bonus at a source. Zero (off) at launch; bonuses are capped at 15%. |
| rescueProtocolTake | Owner | Still live | Only after 30 days with no oracle price: send the protocol's own fee share to the treasury. Never principal. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner (not to zero). |
| onPositionTransfer | Position NFT | Contract-to-contract only | Called by the position NFT when a vault position changes hands. |
Cannot move vault principal, change fees, the profit ladder, penalties or delays, or block terminate and rescue withdraw.
GuardedOracle · held by Owner wallet · no freeze
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setFeeder | Owner | Still live | Add or remove a price feeder. |
| setGuards | Owner | Still live | Set the staleness limit (1 min to 1 day) and the largest price step (up to 50%). Default 30 min and 20%. |
| setMinInterval | Owner | Still live | Set the minimum time between pushes (at least 1 minute). |
| seed | Owner | Still live | Set the first price of a new asset, once per asset, with no step limit. |
| push | Keeper | Still live | Keeper and backup keeper post prices: one per block, spaced by the interval, within the step limit. |
| transferOwnership | Owner | Still live | Hand the oracle to a new owner. |
No freeze: every power here stays with the owner. A feeder cannot change guards or add feeders.
PulseXSwapRouter · held by Owner wallet · no freeze
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setVenue | Owner | Still live | Choose the swap venue per asset. The venue address is not validated. |
| setPath | Owner | Still live | Set the sale route from an asset to the stablecoin (2 to 4 hops). |
| setBuyPath | Owner | Still live | Set the route used to buy MOONX for burns and stakers. |
| sweep | Owner | Still live | Move stray tokens to the owner. The router holds no float. |
| transferOwnership | Owner | Still live | Hand the router to a new owner. |
No freeze. A bad route can cost a vault up to its sale price floor or make seals revert; it cannot take principal outside a sale.
FeeRouter · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| wire | Owner | Frozen | Set where dividends and the referral lane go. |
| finalizeWiring | Owner | The freeze switch (one-way) | Freeze those destinations for good. |
| wireContributionPool | Owner | Used at deploy, now dead | Set the contribution pool once. Already set at deploy. |
| transferOwnership | Owner | Still live | Hand the wiring role to a new wallet. |
| legDividends | The contract itself | Contract-to-contract only | Internal step of distribute. |
| legContribution | The contract itself | Contract-to-contract only | Internal step of distribute. |
| legBurn | The contract itself | Contract-to-contract only | Internal step of distribute. |
| legStakers | The contract itself | Contract-to-contract only | Internal step of distribute. |
Cannot sweep, rescue, change the fee splits (constants) or redirect money already held. distribute is open to anyone.
MVShares · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| wire | Owner | Frozen | Set the engine (mints and burns shares) and the dividend funder. |
| setBonusMinter | Owner | Frozen | Set who may mint capped bonus shares. |
| setBooster | Owner | Frozen | Set the booster (BoosterGuard at launch). |
| finalizeWiring | Owner | The freeze switch (one-way) | Freeze the three settings above for good. |
| setBoost | Booster or owner | Still live | Booster or owner set a holder's dividend boost between 1.0x and 1.5x. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner. |
| mintFor | Vault engine | Contract-to-contract only | Engine mints shares when a vault opens. |
| mintBonus | Bonus minter (off) or engine | Contract-to-contract only | Bonus shares, capped at 15% of engine-minted shares. |
| burnFrom | Vault engine | Contract-to-contract only | Engine burns shares when a vault closes. |
| moveShares | Vault engine | Contract-to-contract only | Engine moves shares when a position changes hands. |
| raiseRate | Vault engine | Contract-to-contract only | Share rate only goes up, at most 1% per call. |
| fundDividends | Fee router | Contract-to-contract only | Fee router pays USDC dividends in. |
Nobody can withdraw the dividend reserve: only holders claim their own dividends.
MoonStaking · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| wire | Owner | Frozen | Set the fee router as the main reward funder. |
| finalizeWiring | Owner | The freeze switch (one-way) | Freeze that setting for good. |
| setEmissionFunder | Owner | Still live | Set or clear the second reward funder (the emission reservoir). Live by design. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner. |
| fundRewards | Fee router | Contract-to-contract only | Fee router or emission funder pay MOONX rewards in. |
Cannot touch staked principal or earned rewards. Stake, claim and unstake have no owner gate.
ContributionRewards · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| wire | Owner | Frozen | Set the engine and the funder. |
| finalizeWiring | Owner | The freeze switch (one-way) | Freeze that setting for good. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner. |
| notifyContribution | Vault engine | Contract-to-contract only | Engine records a contribution. |
| fund | Fee router | Contract-to-contract only | Funder pays rewards in. |
After the freeze the owner can only transfer ownership. Expired rewards go only to the fixed treasury.
VaultPositions · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setHost | Owner | Frozen | Set the engine as the only contract that mints and burns positions. |
| finalizeHost | Owner | The freeze switch (one-way) | Freeze the host for good. Must land at launch (R12). |
| setMarket | Owner | Still live | Set the market contract, or zero to stop secondary sales. Exits are unaffected. |
| finalizeMarket | Owner | Still live | Freeze the market for good. Deliberately not called at launch. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner. |
| mint | Vault engine | Contract-to-contract only | Engine mints a position when a vault opens. |
| burn | Vault engine | Contract-to-contract only | Engine burns a position when a vault closes. |
Positions move only through the market with the holder's approval.
EmissionReservoir · held by Owner wallet · no freeze
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setStaking | Owner | Still live | Set which staking contract receives the scheduled MOONX emissions. |
| transferOwnership | Owner | Still live | Hand the contract to a new owner. |
Cannot withdraw or release MOONX faster than the fixed schedule. drip is open to anyone.
MoonVaultIdentity · held by Owner wallet · no freeze
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setRelayer | Owner | Still live | Appoint or remove the relayer. Owner, relayer, treasurer and settler must all be different. |
| setTreasurer | Owner | Still live | Appoint or remove the treasurer. |
| setSettler | Owner | Still live | Appoint or remove the settler. Unset at launch. |
| grantPromotional | Owner | Still live | Give a free Identity to an address without one. Its commission stays escrowed until it upgrades. |
| sweep | Owner | Still live | Move tokens out, but never what is owed to earners (escrow and commission pools). |
| releaseUnclaimedDifferential | Owner | Still live | Release the unclaimed rank-differential pool: MOONX is burned, stablecoins go to the fixed treasury. |
| transferOwnership | Owner | Still live | Propose a new owner (two-step). |
| acceptOwnership | Proposed owner | Still live | The proposed owner accepts. |
| markGiftBinding | Relayer | Still live | Mark whether a gift makes the gifter the recipient's introducer. Moves no funds. |
| clearGiftBinding | Relayer | Still live | Clear a gift binding that lost a race to an existing sponsor. Moves no funds. |
| mintFor | Settler (unset) | Still live | Mint an Identity paid on another chain, once per payment. Commission stays pending until funded. |
| assignVaultCommission | Treasurer | Still live | Assign USDC vault commission from its pool to Identity holders' escrow, up to 100 at a time. |
| assignDifferential | Treasurer | Still live | Assign a rank differential from its pool to an Identity holder. |
No freeze; roles are replaceable. Cannot take other holders' escrowed commission. Identities are soulbound.
PositionMarket · held by Owner wallet
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| setIdentityGate | Owner | Still live | Require an Identity to list or buy (never to cancel). Open at launch. |
| transferOwnership | Owner | Still live | Hand the market to a new owner. |
Cannot move listed positions, payments or fees. The fee is a constant; fees go only to the fee router.
ClaimPool · held by Keeper · no freeze
| Function | Who | After the freeze | What it can do |
|---|---|---|---|
| publishRoot | Keeper | Still live | Publish the MOONX claims list (Merkle root). Each account's cumulative amount is paid once. |
| withdraw | Keeper | Still live | Withdraw any amount of the pool's MOONX. Deliberate, so a mistake can be recovered. |
| transferOwnership | Keeper | Still live | Only the keeper can hand it on; the owner wallet cannot take it back. |
Owned by the keeper so claims publish automatically. To limit what a keeper leak could take, the pool holds only about one week of expected claims and is topped up weekly from the Rewards wallet.
If the owner key were stolen: the worst it could still do
- List a fake asset with an invented price and mint vault shares against it, diluting everyone's USDC dividends while those vaults stay open. This is the largest remaining owner power.
- Loosen the oracle guards and add a feeder that walks prices, or route sales through a bad pool, costing vaults up to their sale price floor.
- Point future MOONX emissions at another address, or appoint an Identity treasurer that assigns the commission pools to itself.
- Stop secondary sales of positions, or stop new vaults in an asset. Exits keep working.
Our contracts have not had an independent external audit.