No owner. No admin. No pause. No setter. No upgrade path. The fee is written into the constructor and capped at 1% there, and the repository checks that claim against bytecode rather than against this sentence.
| TabGate | — |
| TabBook | — |
| TabIndex | — |
| operator | — |
| protocol fee | — |
| settlement asset | USDG 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 |
The payer signs a ReceiveWithAuthorization whose nonce is
keccak256(abi.encode(merchant, resourceHash, salt)), to the contract. Since
the authorization can only be executed by its payee, and the nonce commits to both the
merchant and the resource, a relayer cannot redirect it, reprice it, or spend it on
something else. The contract holds no dollars between transactions.
A voucher beyond the deposit is capped at the deposit. The payer picks the challenge
window when it opens the tab, between 5 minutes and 7 days, and nobody can shorten it
afterwards. withdraw is permissionless and always pays the payer;
claim is permissionless and always pays the merchant.
Merchants and their resources live in arrays, read back in pages. On this chain
eth_getLogs is capped at ten blocks on the free tier, the public RPC times
out on a wide range and both explorers sit behind a challenge — so a registry that
lives in logs is a registry nobody can enumerate.
| protocol | 69 unit, fuzz and invariant tests |
| protocol, on a fork of 4663 | 6 tests, including a real 0.01 USDG payment settled against the live token |
| $TAB launch | 26 unit and fuzz tests, 5 invariants over 8,192 random calls |
| $TAB, on a fork of 4663 | the whole cycle against the live v4 PoolManager: deploy, open, trade in all four swap shapes, sweep, claim, remove |
| bytecode walk | no DELEGATECALL, no CALLCODE, no SELFDESTRUCT; every admin selector refuses to dispatch |
One billion, fixed, created once in the constructor and handed to the deployer. No mint
function, no owner, no pause, no blocklist, no fee on transfer. burn() only
ever burns the caller’s own. The mark — the barcode — is an SVG held in
the token itself and served from contractURI().
Every swap on the pool pays a toll of 5% of its gross ETH leg to the operator,
and 19% for the first 120 seconds after the pool opens, on buys and sells alike.
The clock is the hook’s own pin; there is no setter and nothing can move it. The
toll accrues as ERC-6909 claims, never as a donate — a donate in v4 is
a public prize any just-in-time liquidity provider can take in one transaction.
The hook claims no liquidity permission at all, which is what makes a withdrawal impossible to block from it.
| token | — |
| name | — |
| supply | — |
| hook | — |
| toll in force | — |
| launch window ends | — |
| toll taken | — |
| pool | — |
| pool fee | 1%, to the launch position |