EticaHub Whitepaper

Version 1.5 — Research Markets Edition

Abstract

EticaHub is a community-built application layer on the Etica blockchain. It introduces ETX (ticker ETX, name EticaHub, supply 100,000,000, fixed), a hub-and-spoke decentralized exchange where every pair shares ETX as its reserve asset, a research subscription and tipping layer that reads Etica's native proposal contract, and a pre-designed (but not yet deployed) proposal-gated token launchpad that, when activated, will require every new token to open both a token/ETX and a token/ETI pool — structurally funnelling demand to both assets.

Since the v1 genesis launch, EticaHub has shipped several additional surfaces — all of them non-custodial, non-dilutive to the fixed ETX supply, and built on the same hub-and-spoke invariant: a UniswapX-style Trading Stack (limit, stop, DCA, bounded grid, Infinity Bot), an ERC-4626 liquid staking vault (stETX), the EticaStableSwap V3 pool — a rate-aware Curve-style AMM (Phase 0) for stETX↔ETX with a 10-year-locked treasury seed and a live admin-fee adapter that flows back into the harvester, an on-chain Treasury Harvester that redistributes treasury LP-fee accruals via a deterministic 10/10/40/40 split with a permanent Protocol-Owned-Liquidity (POL) burn, an ETXFarms non-emissive LP-staking surface, a skinny on-chain explorer with Sourcify-backed contract verification, a public market-data API, a community buy bot that posts DEX swaps to Telegram, EticaLabs — an AI-native molecular intelligence workstation with a continuously-running autopilot research loop — and EticaResearchMarkets (§15), a permissionless launchpad for science-funding ERC-20s where every market trades against the shared 5M-ETX-seeded singleton on an internal constant-product curve with an 80/10/0/10 fee split, no withdrawable LP, a permanent floor-pull property, and auto-Sourcify verification of every minted token. All hosted on free-tier infrastructure. The Phase 3 cross-chain bridge stack — twelve audited-pattern contracts implementing an optimistic-veto design on Hyperlane rails, a 10M ETX insurance backstop, three custom ISMs, a free GitHub-Actions watcher, and the /bridge UI — is contract-complete in the repo and pending the live deploy of Hyperlane on Etica (Phase H). A frontend-only good-faith jurisdictional gate on /stake and /farms mirrors the same posture adopted by Uniswap and Aave; the underlying contracts remain permissionless.

This document describes what EticaHub is, what it is not, how the v1 mainnet launch works, what has shipped since, and what remains explicitly deferred to later phases.

1. Independence from the Etica Protocol Core Team

EticaHub is not affiliated with, endorsed by, controlled by, or otherwise operated by the Etica Protocol core team.

The relationship is purely that of any third-party application interacting with a public blockchain:

• EticaHub is a community-built, independent project.
• EticaHub consumes Etica's public smart contracts (ETI, EGAZ, proposal contracts) in the same way any other dapp could — by reading public state and posting transactions. There is no special access, shared multisig, shared treasury, shared roadmap, or shared branding.
• ETX is EticaHub's own asset, not an Etica Protocol asset. It is a separate ERC-20 deployed by the EticaHub team for EticaHub's own governance and fee economics.
• EticaHub's treasury, upgrade authority, and all operational decisions are independent.
• Nothing in this paper, in the EticaHub UI, or in EticaHub's contracts should be interpreted as a statement, commitment, or plan of the Etica Protocol core team.

If you are evaluating EticaHub, evaluate it on its own merits as a community-built dapp. Do not assume any guarantees inherited from the Etica Protocol itself.

2. Design Goals

1. Make ETI more useful. Etica's native asset is ETI. We build tools (a DEX, a research hub, a bridge, and eventually a launchpad) whose cash flows and demand vectors grow ETI's utility as a byproduct.
2. Introduce a reward / coordination token (ETX) without diluting ETI. ETX is a separate asset for EticaHub-specific cash flow capture: swap fees, pool-creation fees, and (later) launchpad fees. It does not replace, fork, or compete with ETI.
3. Hub-and-spoke liquidity. Rather than fragment liquidity across arbitrary pairs, the DEX enforces that every pair shares a common reserve (ETX). This turns ETX into the unit of DEX-wide convertibility.
4. Fair launch, no presale, no allocation. ETX is seeded entirely via on-chain AMM pools opened by the EticaHub treasury with its own capital. There is no private round, public round, airdrop, team allocation, advisor allocation, vesting cliff, or unlock schedule for ETX supply.
5. No new emissions, ever. Every redistribution surface (stETX yield, Harvester, farms, buybacks) must be funded from existing DEX cash flows — LP fees, swap protocol fees, subscription revenue — and never by minting more ETX.
6. Defer complexity with safety margins. Features that materially touch user funds (launchpad, bridge) are contract-complete but deliberately not activated until there is organic depth and demand. Features that touch only the treasury's own capital (Harvester, POL burns, stETX yield) ship earlier because the blast radius is internal.

3. ETX Token

Canonical identity:

ETX is a standard ERC-20 with EIP-2612 permit support. There is no privileged mint authority, no proxy, no pause switch, no blacklist. Once deployed, the contract cannot be modified, and no additional ETX can ever be created.

Initial distribution (at genesis):

From that wallet, a small fraction is immediately used to seed the two launch pools on EticaSwap (see §5). The remainder stays in treasury.

There is no presale, no IDO, no private round, no airdrop, and no public sale of ETX. The only way to acquire ETX post-launch is to swap for it on EticaSwap against ETI or EGAZ.

4. EticaSwap: Hub-and-Spoke DEX

EticaSwap is a Uniswap V2–style automated market maker adapted to enforce a single structural invariant: every pair must include ETX on one side. Users who want to trade, e.g., ETI ↔ EGAZ route through the ETX hub in two hops.

4.1 Contracts

4.2 Fees

The pool-creation fee is charged in ETX, paid by the caller at the moment a new pair is created, and routed to feeTo (the treasury). Key properties:

• The fee is skipped when feeTo == 0x0, so the factory can bootstrap before the treasury wallet is wired. This was used during launch day: the first two pools (ETI/ETX, EGAZ/ETX) were seeded free, then treasury wiring activated the fee for all subsequent pools.
• Addresses in the trustedCreators allow-list are exempt from the fee. This exists so the future launchpad (§16) does not double-charge its creators, since the launchpad already collects its own 250 ETX + 250 ETI fee per launch.
• The fee is adjustable by the feeToSetter governance key via setPairCreationFee(uint256). It may be raised, lowered, or set to zero.
• The router transparently forwards the fee on first-time pair creation: users simply approve a slightly larger ETX budget to the router, no extra transaction is required.

4.3 Hub-and-spoke rationale

A typical AMM allows any token pair, which fragments liquidity across N² potential pairs for N assets. EticaSwap instead forces every asset to share a common quote (ETX). For N assets, this creates exactly N pools and guarantees every asset is reachable from every other asset through the ETX hub. The resulting ETX pool is, by construction, the DEX's deepest and most consequential market, aligning ETX with overall DEX health.

5. Launch Parameters (v1 Mainnet — Executed)

5.1 Economic parameters

5.2 Initial liquidity (treasury-provided)

5.3 What "fair launch" means here

• No private sale. Zero ETX sold to anyone before mainnet.
• No public sale / presale / IDO / IEO. Zero ETX sold to anyone during launch.
• No airdrop. Zero ETX distributed for free.
• No team/advisor allocation. 100% of supply is in a single treasury wallet at genesis.
• No vesting schedule. No cliff, no unlock events, no emissions. The full 100M supply exists from block 0; there are no future "unlocks."
• The only way to acquire ETX post-launch is to swap for it on EticaSwap against ETI or EGAZ, at whatever price the AMM quotes at the moment of the trade.

This structure is chosen deliberately to minimize the set of plausible securities-law narratives around ETX. ETX is launched openly, at a small FDV, and the team acquires no special allocation.

5.4 Vercel-hosted UI

The full EticaHub frontend lives at https://eticahub.com, hosted on Vercel out of apps/web. The v1 genesis was executed via three operator-only deploy pages:

1. /deploy/etx — one-click MetaMask deploy of ETXToken. Minted 100M to the connected treasury wallet.
2. /deploy/swap — three-click deploy of WEGAZ, EticaSwapFactory(etx), EticaSwapRouter(factory, wegaz).
3. /seed/pools — four-step MetaMask flow (approve ETI, approve ETX, addLiquidity ETI/ETX, addLiquidityEGAZ ETX) that opened both launch pools.

Deploy pages are gated behind NEXT_PUBLIC_OPERATOR_UI=true and are not part of the public navigation. They are kept in the repo so that the full launch path is reproducible from source. Deployment artifacts (bytecode + ABI) are committed to the repo.

The public pages — /swap, /pool, /trade, /stake, /bridge, /research, /explorer, /status, /whitepaper — run against live mainnet contracts addressed from packages/shared/src/addresses.ts (canonical) and mirrored in Appendix A.

6. Research Hub

Etica's native proposal contract (EticaCoreProposals) tracks medical-research proposals and their authors on-chain. EticaHub exposes these proposals through a reader UI at /research/proposals (shipped with Phase 2), and adds two auxiliary primitives:

• Tipping. Visitors can tip a proposal author directly, in ETI or EGAZ, through a hosted contract that forwards to the author address recorded on-chain.
• Subscription. A ResearchSubscription contract sells monthly subscriptions in ETI that grant access to gated content via a simple isActive(subscriber) view. Subscriptions are paid upfront, extensible, and non-transferable.

The Research Hub is live today, independent of the DEX, and does not require ETX to function. It is the first concrete revenue surface for EticaHub's treasury (subscription payments flow to treasury as ETI).

7. Trading Stack (Live)

EticaSwap's Market tab handles immediate one-shot swaps against the AMM. Everything beyond that — limit orders, stop-losses, dollar-cost averaging, grid bots, and Infinity Bot — lives in the Trading Stack, exposed at /trade/[token]. The stack is non-custodial, modelled on UniswapX, and uses contracts audited independently of anything EticaHub wrote.

7.1 Components

Full design and the case against each alternative (on-chain order book, custodial bot, etc.) lives in docs/TRADING.md.

7.2 Order types

7.3 Why the Infinity Bot exists

A bounded grid is brittle for a chain whose price can drift meaningfully over months. Once price walks past the user's high or low, the grid is dead until the user comes back and re-signs. The Infinity Bot replaces that fragility with geometric (percent-based) spacing around a reference price — R · (1 ± p)^k. The level structure is scale-invariant, the level count per side is tunable independently, and when price walks past the outermost signed level the user signs one more batch re-centred on the new price instead of re-authoring the whole strategy.

Guardrails baked into the builder:

• ≤ 50 levels per batch. Wallet UX degrades past ~30 signatures in one popup; 50 is a practical hard cap.
• Step < 50%. Geometric progressions with p ≥ 50% collapse to zero or diverge within a handful of levels.
• 7-day batch validity. Same expiry window as the bounded grid.
• Shared gridBatchId. Every level of one batch carries one batch id so the orders dashboard and any future cancel-whole-batch flow can address them as a unit.

The full Infinity Bot spec — including the math, the risk table, the deliberate non-goals, and the re-sign policy — lives in docs/INFINITY_BOT.md.

7.4 Non-custodial guarantees

The guarantees EticaHub makes about every order type in the Trading Stack — Market, Limit, Stop, DCA, Grid, Infinity — are identical to those of the core DEX:

• EticaHub never holds user tokens or signing keys.
• Every fill is atomic: Permit2 pulls exactly the signed input, the Reactor swaps it, and the output lands in the user's wallet in the same transaction. There is no intermediate custody.
• Users can hard-cancel any signed order by submitting a Permit2 nonce increment on-chain from /trade/orders.
• If EticaHub's order book goes offline, every signed order remains valid until its own deadline; users can submit directly to the Reactor or run their own keeper from apps/keeper. The on-chain OrderRegistry at 0xA6f3e48Cf31DcE3a8d36659f5bC6a61785c404a9 serves as the canonical backup data source.

7.5 Protocol fee posture

EticaHub charges two structurally distinct fees, on two different trade surfaces. They do not stack on the same trade.

A trade sent to /swap pays the AMM fee. A trade sent to /trade pays the UniswapX fee. Both fee streams are denominated in economically sensible units: LP fees settle in the pair's native tokens (so LPs keep the mix they signed up for), and the UniswapX protocol fee settles in ETX (every pool is ETX-paired, so one leg of every trade is already ETX — no extra swap hop is needed to collect the fee).

The EticaProtocolFeeController owner (treasury wallet, rotating to the community multisig on the same schedule as feeToSetter in §4) can raise or lower the fee within a hard on-chain cap of 100 BPS (1%). It cannot exceed that cap under any circumstance. There is no owner path that can drain already-collected fees — the controller only decides what future fees are, not where existing balances go.

7.6 Keeper workflow

A reference keeper (apps/keeper) runs as a GitHub Actions cron (.github/workflows/keeper.yml) in dry-run mode by default. It reads open orders from the order book API (or the on-chain OrderRegistry as a fallback), simulates each fill locally against the live router, and — in "live" mode, which is not enabled by default — submits the winning fill transaction. The keeper is unprivileged: anyone can run a competing keeper, and the reactor accepts fills from any filler. The reference implementation exists so the system has a baseline liveness guarantee independent of any specific operator.

8. Liquid Staking (stETX) — Live

StakedETX is a minimal ERC-4626 vault for ETX deposits. It accepts ETX, issues stETX shares at a variable exchange rate, and redistributes a share of the treasury's LP-fee accruals to depositors — without minting any new ETX.

8.1 Design

8.2 Yield mechanics

stETX is a pure redistribution vault, not an emitter. The flow is:

1. Treasury LP positions (ETI/ETX, EGAZ/ETX) accrue swap fees continuously as 0.30% of every trade.
2. The off-chain keeper ("Harvester", §9) periodically collects a tranche of those accrued fees, converts them to ETX on the DEX, and calls StakedETX.distributeRewards(amount) with the stETX share of the harvest.
3. The vault's totalAssets() increases by amount, raising the exchange rate stETX → ETX. Every existing stETX holder's balance, denominated in ETX, grows pro-rata.

There is no emissions contract, no inflation schedule, no minting, and no new ETX supply. If LP fees stall, stETX yield stalls. If LP fees grow, stETX yield grows. The APY is a function of observed harvested yield over the trailing 7 days, rendered on /stake.

8.3 UI (/stake)

The /stake page provides:

• Deposit / Withdraw. Standard ERC-4626 flow. Withdrawals are instant and full-liquid.
• 7-day trailing APY. Computed from the exchange-rate trajectory (not advertised forward yield).
• Exchange-rate chart. The stETX/ETX ratio over time, visualizing accrual.
• Vault stats. totalAssets, totalSupply, number of depositors.

8.4 Non-custodial guarantees

• There is no owner key. The vault has no Ownable inheritance, no admin role, no pause function, no upgradeability. The only state-changing external entry points are the ERC-4626 deposit/withdraw paths and distributeRewards.
• distributeRewards is fully permissionless: any wallet may call it. Calling it with zero amount reverts with ZeroAmount(); a nonzero call requires the caller to have approved the vault for the full amount and transfers that ETX into the vault in the same transaction — shares are never minted, only the exchange rate ticks up.
• Withdrawals are not rate-limited, not paused, not subject to any cooldown.

8.5 Treasury commitment (stETX + LP)

The EticaHub treasury is the single largest committer of capital to the protocol. As of v1.2, the on-chain footprint across stETX and LP positions is approximately:

These figures are read live from chain and will drift block-to-block as fees accrue, public LPs come and go, and the harvester redistributes; the structure is what is fixed, not the exact numbers. Concrete implications:

• Real floor on TVL. The /stake page does not open with an empty vault, and the V2 + stableswap pools do not open with empty books. APY math, exchange-rate history, and routing depth all have a meaningful denominator from the first block.
• Skin-in-the-game signal. The treasury is the largest stETX holder, the dominant LP on every ETX-paired pool, and the only LP on the stableswap. Every design decision about these venues applies to the treasury first — there is no separate "team pool" on better terms.
• No special privileges. Treasury stETX shares and treasury LP tokens are identical to any other holder's. Treasury cannot front-run distributions, cannot block withdrawals, cannot mint extra shares, and cannot pull anyone else's liquidity. The distributeRewards path is permissionless and capped by the fees the harvester actually collected.
• Dilutive to treasury by design. As outside stakers deposit and outside LPs join, treasury's proportional claim on the 10% harvest bucket and on swap fees falls. This is the intended direction: the seed exists to bootstrap credibility, not to lock in a permanent treasury revenue line. The 40% treasury bucket and the 40% POL burn (see §9) are unaffected by participation rate.
• Stableswap LP is locked, the rest is liquid. Only the treasury's stableswap LP shares are locked (10 years, principal only — fees stream out continuously via StableSwapHarvesterAdapter; see §10.2). The stETX position and the V2 LP positions are fully liquid under ERC-4626 / ERC-20. Any intent to unwind would be fully visible on-chain as Redeem / Burn events. Public LPs are unaffected by any of these treasury decisions.

9. Treasury Harvester & POL Flywheel

TreasuryHarvester is an on-chain delegation contract that formalizes how the treasury's own LP-fee accruals are redistributed. It exists so the keeper that performs the redistribution can run as a thin, inexpensive EOA with narrowly scoped authority, rather than as the treasury wallet itself.

9.1 Why a delegation contract

Before the Harvester, redistributing LP fees required the treasury EOA to sign a sequence of removeLiquidity → swap → transfer → distributeRewards transactions. That forced the treasury key to be online whenever a harvest was due, which is both operationally fragile and a key-compromise hazard.

The Harvester inverts this: the treasury one-time-approves the Harvester for ETX + both LP tokens, after which harvest() is permissionless — any wallet can call it, gated only by a 1-day cooldown and a small caller-tip incentive (PR #109). The original keeper-EOA design has been retired. The contract still cannot touch treasury ETX for anything except the 10/10/40/40 split encoded in it.

9.2 10/10/40/40 split

Every successful harvest() call partitions the freshly-collected fee tranche (in ETX-equivalent) into four destinations:

9.3 The POL burn is the flywheel

The 40% POL burn is the mechanism that makes every swap structurally accretive to pool depth forever. The fees leave the treasury, buy LP tokens, and burn them — depth stays in the pool and can never be withdrawn. Three consequences:

1. Slippage curves improve monotonically. Each harvest deepens the ETI/ETX and EGAZ/ETX pools, reducing slippage for every future trade.
2. Depth is independent of any operator. Because the LP tokens are burned, not held, no future EticaHub key rotation, key loss, or governance action can ever remove the burned depth.
3. Volume begets depth begets volume. Higher depth supports larger trades, larger trades generate more fees, more fees feed more harvests, more harvests burn more POL. The loop is self-reinforcing and requires no emissions to sustain.

9.4 Status

The Harvester is deployed, wired, and live on Etica mainnet at 0x5d8B1138559fADc3Bb90e8317eB16922eAa076f5. The keeper role was retired in favour of a permissionless v2 (PR #109) — any wallet may now call harvest(), gated only by a 1-day cooldown and a small caller-tip incentive. The daily GitHub Actions workflow (.github/workflows/harvest-live.yml) calls it on a 24h cadence; if it is ever down, anyone can poke the contract directly. There is also a manual "Harvest now" button on /admin/harvester for the treasury operator.

A second fee feed was added in §10 (Phase 0 — EticaStableSwap): the stableswap pool's admin-fee slice flows through StableSwapHarvesterAdapter, which redeems the stETX leg into ETX via the vault and forwards a pure ETX lump into TreasuryHarvester.harvestExternal(amount). Same 10/10/40/40 split applies. The two feeds (V2 LP-burn and stableswap admin-fee) compose seamlessly because both terminate in the same harvester.

9.5 Cron + manual fallback

harvest() runs on three independent triggers, in priority order: (i) the daily GitHub Actions workflow harvest-live.yml, which calls a small EGAZ-funded EOA to invoke harvest() once the cooldown elapses; (ii) any third party wallet, who pays gas and pockets the small caller-tip; (iii) a manual "Harvest now" button on /admin/harvester that the treasury operator can fire ad-hoc. None of the callers hold ETX/ETI/LP tokens — harvest() is bounded by the on-chain 10/10/40/40 split, so a compromised cron key can only burn gas, not steal funds.

9.6 ETXFarms — the farms-bucket consumer

The 10% "farms" slice of every harvest cycle is consumed by the ETXFarms contract (packages/contracts/src/etx/ETXFarms.sol, 25 unit tests in test/etx/ETXFarms.t.sol, all green). ETXFarms is an accumulator-style LP staking contract — the MasterChef pattern, but without emissions. It only distributes ETX that the Harvester actively pushes in.

Architecture — pull-based, no vesting. The Harvester calls farms.distributeRewards(amount) at the end of each cycle (permissionless entry point, symmetric with StakedETX.distributeRewards). Rewards are written directly into the per-pool accRewardPerShare accumulator with no drip/vesting window. Stakers see rewards spike on harvest days and flat between them. This is deliberate: it matches the cadence the Harvester actually emits at, and avoids the timing-attack surface that linear-drip models like Synthetix's StakingRewards carry (jump in before a big notify, jump out after).

Pool set at launch. Two pools, both seeded with the treasury's genesis LPs:

Weights are allocPoint values (sum = 10,000 by convention). The owner can addPool(lp, allocPoint) to register new pools, or setAllocPoint(pid, newAllocPoint) to retune weights. The sum of weights is capped so no pool can starve the others permanently.

Reward split math. Every distributeRewards(amount) call loops over pools: poolShare = amount * pool.allocPoint / totalAllocPoint. If a pool has zero staked LP at the moment of distribution, its share is routed to the fallback recipient (treasury, by default) rather than sitting idle forever. If a pool has stakers, pool.accRewardPerShare += poolShare * 1e18 / pool.totalStaked, the standard MasterChef formula, so a late joiner cannot claim a pro-rata share of rewards distributed before their deposit.

User surface — no lockup, no penalty.

• deposit(pid, amount) — auto-harvests any pending rewards into the user's ETX balance, then credits amount LP to their stake.
• withdraw(pid, amount) — same auto-harvest, then returns amount LP.
• harvest(pid) — claim pending rewards without touching the LP position.
• emergencyWithdraw(pid) — panic exit that returns all staked LP and forfeits pending rewards. Exists so a user can always get their LP back even if reward-accounting is somehow stuck.
• No deposit fee, no withdrawal fee, no cooldown. Matches the rest of the stack's "non-custodial by default" posture.

No emissions, ever. ETXFarms holds no mint authority on ETX (ETX is a fixed-supply ERC-20 with no minter). It can only distribute ETX that was transferred into the contract and then accounted for via distributeRewards. The total supply cap at 100M ETX is unaffected by farms going live — farms redistribute existing protocol fees, they do not create new supply.

Owner scope. The contract owner can register new pools, retune weights, and set the fallback recipient. The owner cannot steal staked LP (rescueToken is explicitly guarded against rescuing any registered LP token or the reward token ETX). The owner cannot pause withdrawals. The owner cannot change reward semantics retroactively. Owner will be rotated to the same multisig that holds feeToSetter and TreasuryHarvester.owner as part of the near-term multisig migration (§20).

Audit posture. Forge unit tests cover: metadata and shape, owner-only gates, deposit/withdraw mechanics, accumulator math for the solo-staker and two-staker-pro-rata cases, multi-harvest sequencing, late-joiner protection, empty-pool fallback routing, emergency withdrawal, rescue guards, and permissionless distributeRewards parity. No external audit has been commissioned for v1.1 — same posture as stETX and the Harvester. External review will be scoped once the broader v1.1 surface stabilizes.

Deployment. Operators deploy via /deploy/farms (browser-based, signs from the connected wallet). Post-deploy: paste the address into packages/shared/src/addresses.ts → DEPLOYMENTS[61803].etxFarms, call addPool(ETI/ETX LP, 5000) and addPool(EGAZ/ETX LP, 5000), then call TreasuryHarvester.setFarms(etxFarms) to route the 10% farms bucket. /farms will light up the moment the address is non-zero.

10. EticaStableSwap (Phase 0 — the V3 pool)

Naming note: EticaSwap V1 was the original Etica-side AMM; EticaSwap V2 is the hub-and-spoke constant-product DEX described in §4 (still the venue for ETI/ETX, EGAZ/ETX, etc.); EticaStableSwap is the protocol's V3 pool — a separate, rate-aware Curve-style AMM dedicated to correlated assets (today stETX↔ETX, Phase 1 adds wETI/ETX). Where this paper says "V3 pool," it means EticaStableSwap.

EticaStableSwap is a rate-aware, Curve-style AMM purpose-built for stETX↔ETX. It exists because a constant-product V2 pool quotes the wrong price the moment stETX's NAV drifts above 1.0 ETX, and a naïve Curve pool would drift out of range as the vault accrues yield. EticaStableSwap reads stETX.convertToAssets(1e18) directly on every swap so the curve auto-tracks NAV forever — no manual rebalancing, no LP rotation, no stale parameters.

It also closes a strategic gap: stETX↔ETX is the canonical exit highway for the protocol's liquid-staking surface (§8). Routing it through the deepest, lowest-slippage venue keeps stETX's peg credible.

10.1 Architecture

Three contracts working together:

The AMM contract is final, ownerless from a fund-custody perspective (the only owner-gated functions are parameter knobs: rampA, setSwapFee, setAdminFee, setAdminFeeRecipient), and source-public under MIT (packages/contracts/src/stableswap/EticaStableSwap.sol).

10.2 Treasury seed: 30M ETX, locked 10 years

The pool is seeded with 15,000,000 ETX + 15,000,000 stETX (~30M ETX-equivalent at NAV) drawn from the treasury. The seed is irrevocable: the resulting LP shares are minted directly to LiquidityTimelock10y, which has no early-unlock path. The unlock timestamp is 2036-05-01 08:17:29 UTC.

Key asymmetry: the lock is on the treasury, not on public LPs. Anyone can deposit on /pool and withdraw any time. The treasury chose to immobilize its own seed for 10 years; nobody else has to. This is the inverse of a typical "team unlock" schedule — the protocol's primary liquidity is the most locked, not the least.

The seed is also not counted in circulating supply for market-cap purposes (§19 / /api/v1/tokens): the locked-LP wrapper + treasury holdings are subtracted, in line with CoinGecko/CMC convention.

10.3 Fees and flywheel

Every swap pays a 4 bps fee (0.04%, Curve-standard for stable pairs). Of that fee, 50% is retained in the pool (grows LP share value for everyone, including the locked treasury seed) and 50% is the admin slice (streams permissionlessly to StableSwapHarvesterAdapter).

     ┌───────── EticaStableSwap (stETX/ETX, A=200, 4 bps fee) ─────────┐
     │                                                                  │
     │ 50% of fee → grows LP value (incl. 10y-locked treasury shares)   │
     │ 50% of fee → admin accumulator                                   │
     │                       │                                          │
     └───────────────────────│──────────────────────────────────────────┘
                             ▼
             StableSwapHarvesterAdapter (permissionless claim)
                             │
                             ▼  redeem stETX → ETX via vault (1:1 NAV)
             TreasuryHarvester.harvestExternal(etxAmount)
                             │
                             ▼  10/10/40/40 split (§9)
              stETX vault │ ETXFarms │ POL burn │ treasury

The locked LP shares and the admin fees are two separate value streams: locking the principal does not lock the fees. The treasury can claim the admin slice continuously while the seed itself stays immobilized. Public LPs are not entitled to admin fees — they earn from the LP-retained 50% (and from stETX NAV drift on the stETX-leg side of the pool).

10.4 Why a separate AMM

The two AMMs cohabit on /swap: stETX↔ETX direct routes through the stableswap; everything else goes through V2. The router checks getDy() on the stableswap when applicable and falls back to V2 if the stableswap is not deployed or the requested pair is not supported.

10.5 Public LPs (/pool)

/pool shows two cards: the V2 add/remove-liquidity flow (existing) and a public stableswap card (new). Public LPs deposit ETX + stETX, receive LP shares directly to their wallet, and can withdraw at any time via removeLiquidity (pro-rata, both legs) or removeLiquidityOneCoin (single-asset, with curve-derived slippage). No emissions on this pool — public LPs earn from fees and stETX NAV drift only. (Phase 1 will introduce farm emissions on the wETI/ETX pool where volume justifies them.)

10.6 Status surface

/status exposes live stableswap data via /api/v1/tvl (TVL = reserveEtx + reserveStEtx · getRate / 1e18) and /api/v1/liquidity-flow (counts AddLiquidity/RemoveLiquidity/RemoveLiquidityOne events as a separate per-pool entry alongside the V2 Mint/Burn flow). The 30M ETX seed appears in both endpoints. /admin/stableswap is the operator panel for permissionless claimAdminFees/harvest and owner-gated rampA/setSwapFee/setAdminFee/setAdminFeeRecipient/lockedWithdraw (only fires after 2036).

11. EticaHub Explorer

A skinny on-chain explorer lives at /explorer, powered by the same JSON-RPC node the rest of the site uses plus a lightweight JSONL indexer (see §11.3). It exists so that a user clicking a tx hash from /swap, /trade, or the Telegram buy bot (§13) lands on a first-party page under the EticaHub domain rather than an off-site explorer.

11.1 Pages

11.2 Sourcify-backed verification

Contract source verification uses Sourcify as the canonical source of truth. Users (or operators) submit a compilation artifact + sources at /explorer/verify/[addr]; the explorer pushes them to Sourcify, which publishes a verified metadata record. The explorer then reads back the verified ABI + sources to decode calldata and events on the tx and contract pages. There is no EticaHub-owned verification registry — we rely on Sourcify so verifications are portable to any other explorer that reads from Sourcify. See docs/SOURCIFY_CHAIN_ADD.md for how chain 61803 was added.

11.3 On-chain + JSONL indexer

The explorer reads from two data sources, in order of preference:

1. Gzipped JSONL shards produced by a GitHub Actions cron at .github/workflows/explorer-indexer.yml. The indexer walks Swap and ERC-20 Transfer logs in block-range batches, writes them to size-capped JSONL shards (apps/indexer/data/*.jsonl.gz), and commits the shards back to the repo. This makes address + token pages fast for historical data without hammering the RPC.
2. Live RPC fallback. If a shard is missing or malformed, the reader falls back to eth_getLogs on the live RPC. The fallback is silent to the user and intentionally conservative (narrow block ranges, bounded retries) so a bad shard never breaks a page.

12. Public Market Data API

/api/v1/* is a small public read-only HTTP API that exposes the same data the UI uses, in a format aggregators (CoinGecko, CMC, DEX Screener, GeckoTerminal) can ingest directly. No auth, JSON only, CORS-enabled.

Submission briefs for the major aggregators are in docs/aggregators/ — one markdown file per listing process (CoinGecko, CMC, DEX Screener, GeckoTerminal) with the exact payload each service expects.

13. Community Buy Bot

A Vercel-cron-hosted Telegram bot posts every swap on every ETX pair to the EticaHub community group. It is a downstream consumer of the same RPC + indexer layer as the explorer; it does not touch user funds and has no privileged access.

13.1 Architecture

The bot lives as a single Next.js route (apps/web/src/app/api/cron/buybot/route.ts) invoked by Vercel's cron scheduler at 1-minute cadence. Each invocation:

1. Reads the last-scanned block cursor from Vercel KV.
2. Calls eth_getLogs for every Swap event on every ETX pair between lastScannedBlock + 1 and latest.
3. Snapshots each pool's post-swap reserves + relevant token metadata (name, symbol, supply).
4. Pulls USD anchors from NonKYC's public API (ETI/USDT, EGAZ/USDT spot).
5. Derives ETX/USD from the first pool in the window that pairs ETX with ETI or EGAZ.
6. For each swap, renders a message with the side bought, amounts in and out, ETX + USD prices, market caps of both tokens, and links to the /explorer/tx/[hash] and /explorer/block/[n] pages.
7. POSTs to api.telegram.org/bot<token>/sendMessage.
8. Writes the new block cursor.

13.2 Safety rails

• Per-swap dedup. Every posted swap is claimed in KV by (txHash, logIndex) with a 24-hour TTL. A pre-check skips any swap that was already claimed, even if the block cursor rewinds. The claim is written after a successful Telegram send, never before, so a failed send never locks a swap out of retries. Transient KV failures (read or write) are swallowed; the worst case is one duplicate post once KV recovers.
• Min-USD floor. Swaps below a configurable USD notional are skipped to avoid spam on dust trades.
• No private keys. The bot holds no funds, signs no transactions, has no on-chain authority.
• Failure mode: silent. A missing env var, a dead RPC, a Telegram rate-limit, or an indexer stall all degrade to "no messages posted this minute". The cron simply re-runs on the next tick and catches up.

13.3 Why Vercel cron instead of a long-lived WebSocket

A WebSocket listener is the canonical architecture for a buy bot and is ~30s faster, but it requires always-on hosting (Fly, a VPS, etc.) and its own monitoring. Vercel cron is $0, redeploys on every git push alongside the rest of the site, and logs every invocation in the Vercel dashboard. The ~60s lag is acceptable for a community ticker.

14. EticaLabs — AI Molecular Intelligence Workstation

EticaLabs (/labs) is a community-built molecular-design surface that turns a plain-English research goal into a folded 3D structure, an AI structural analysis, and a continuously-running research loop. It is built entirely on free infrastructure (Groq free tier, NVIDIA NIM free tier, Upstash Redis free tier, GitHub Actions free tier, Vercel free tier) and ships zero new emissions, zero treasury cost, and zero gated content — every surface is fully public.

14.1 The pipeline

prompt
  │
  ▼
Groq llama-3.1-8b-instant ─── plan (hypothesis, approach,
  │                            success criteria, risks,
  │                            3 candidate sequences,
  │                            references)
  ▼
Engine cascade ─── ESMFold (HF) → ESMFold (NVIDIA) → Chai-1 → Boltz
  │              (Auto picks first available; user can pin one)
  ▼
PDB ─── 3Dmol.js (browser WebGL) → user view, mutate, export, share
  │
  ▼
Groq analysis ─── secondary structure, residue patterns,
                  predicted function, stability

Each step is its own free API call. No paid services. No long-running infra.

14.2 Research planning layer

Before any fold runs, /api/labs/plan fetches PubMed (NCBI E-utilities, free, no auth) and RCSB PDB (free public search) for the top-5 most relevant papers and solved structures. Both are passed into Groq's planning prompt so each candidate sequence cites prior work by [N] index and explicitly differentiates itself from cited references rather than inventing in a vacuum. The /labs UI surfaces both as a clickable Related research panel.

14.3 Engine roster

The fold endpoint reports an engine trace on every call (which engines were tried, their status, their duration) so users can see exactly where the cascade landed.

14.4 EticaLabs Autopilot — public research feed

/labs exposes a "Run continuously on EticaLabs" submit panel alongside the direct-fold and create-plan buttons. Submissions land in a Redis-backed queue (labs:queue:pending list, labs:feed sorted set, labs:job:<id> blobs with 30-day TTL). A GitHub Actions cron — .github/workflows/labs-autopilot.yml, every 10 minutes, free tier — wakes the worker, pops the oldest pending job, runs plan → fold → analyse → mutate for N iterations (1-5, user-selected), and writes results back to Redis. The worker endpoints (POST /api/labs/queue/pop, POST /api/labs/queue/[id]/update) are gated by a shared-secret bearer token (LABS_AUTOPILOT_TOKEN, constant-time compared).

Submissions are fully open — no auth, no payment, no whitelist. Per-IP rate limit (5 submissions/hour) and a 400-character prompt cap keep abuse bounded. Content safety is delegated to Groq's existing safety prompt at planning time; jobs whose plans fail safety simply error out and are visible as such on the public feed.

14.5 Why "run continuously" is the point

The direct-fold UX (/labs → "Generate molecule") gives the user one folded structure per click. The autopilot loop turns the same prompt into N rounds of plan → fold → analyse → mutate, each iteration seeded from the previous round's top scorer. Mutations are score-blended (Groq structural fit 60% / pLDDT confidence 40%) with iteration early-stop when no further improvement is found. The result is a small ranked log of what the agent tried, persisted publicly for 30 days, so the lab feels alive — users coming back to /labs/feed see real work product, not a stale demo.

14.6 Cost profile

Per autopilot run (3 iterations, 3 candidates per iteration):

Steady-state capacity at zero cost is roughly ~10-15 user submissions per day before any free tier saturates — plenty of headroom for community-driven exploration, and the limits scale linearly with paid tiers if demand ever justifies it.

14.7 Non-custodial / non-financial posture

EticaLabs touches no user funds and creates no on-chain transactions. It is a pure research surface — Groq calls, ESMFold calls, public reads from PubMed/RCSB, and a Redis-backed queue. Nothing in EticaLabs interacts with ETX, stETX, the DEX, the harvester, or any treasury surface. It exists because EticaHub is community-built and the community wanted a research workstation; it stays free because the architecture is built on free tiers from day one.

15. EticaResearchMarkets — Permanent Floor Pull via Locked POL

EticaResearchMarkets is a permissionless, singleton-based launchpad for ERC-20 tokens that fund scientific research. Each token represents a research project; supporters buy in to fund the work; the price is discovered automatically on an internal constant-product bonding curve against ETX; the researcher receives a share of trading fees; and a permanent, non-withdrawable share of every trade compounds the curve's ETX-backed floor forever. This section describes the contract design, the fee split, the graduation flow, the sunset flow, the auto-Sourcify property, and how the launchpad slots into the rest of EticaHub without altering any existing surface.

15.1 Why a separate launchpad for research

The deferred launchpad described in §16 (ProposalTokenFactory) is a curated surface — only the proposer of an Etica Protocol research proposal can launch a token, the supply is split across token/ETX and token/ETI pools, and there is a 250 ETX + 250 ETI launch fee. That model is appropriate for established proposals with author identity and on-chain provenance, but it is not appropriate for the long tail of small, exploratory, or independent research efforts. EticaResearchMarkets is the complement to that design: permissionless launch, evidence-required at deploy time, singleton liquidity, no LP positions for anyone to extract, and a fee split engineered so the curve's floor only rises.

The two coexist. ProposalTokenFactory (§16) remains the on-chain author-attested launch path when it activates. EticaResearchMarkets is the open path that lives alongside it.

15.2 Architecture — one singleton, many markets

There are exactly two contracts in the launchpad: EticaResearchMarkets (the singleton) and ResearchToken (the per-launch ERC-20 template). All liquidity, all accounting, and all routing live in the singleton. There are no per-token pools, no LP tokens, and no external AMM positions to manage.

Because ResearchToken is a fixed template with no varying logic — only the constructor strings differ across launches — its bytecode is deterministic across every launch. This is the property that makes auto-Sourcify verification (§15.5) feasible.

15.3 The bonding curve and per-token solvency

Each market keeps its own pair of virtual reserves: (etxReserve_i, tokenReserve_i) with k_i = etxReserve_i * tokenReserve_i. A buy adds ETX to etxReserve_i and mints the constant-product delta of ResearchToken_i to the buyer; a sell burns tokens from the seller and pays out the constant-product delta of ETX from etxReserve_i. The math is identical to a Uniswap V2 pair, but there is no LP token, there is no external pool contract, and every market's reserves are physically scoped to that market in the singleton's storage.

This gives per-token solvency: at any block, the ETX a market can pay out to its sellers is bounded above by the ETX that market has received from its buyers (plus the in-curve fee accrual described in §15.4). No market can drain another market. The shared 5M-ETX free pool is a discovery backstop (§15.6), not a cross-collateral source.

A market enforces three additional bounds at the curve layer:

• Per-tx 5% cap: no single trade can move more than 5% of the curve's ETX reserve in either direction.
• TWAP deviation guard: a single trade's executed price cannot deviate by more than a configured threshold from the curve's recent EMA. This makes the curve resistant to flash-loan-style instantaneous wicks.
• EOA-only first 100 blocks: the first 100 blocks after launch are restricted to tx.origin == msg.sender, which blocks contract-funded sniping bots without preventing real users from interacting via wallets.

15.4 Fee split — C-with-lock, 80 / 10 / 0 / 10

Every trade pays a 1% fee in ETX. The fee is split at trade time:

The critical property is the 80% slice. There is no admin function on the singleton that can remove ETX from etxReserve_i. Sells pay out from this reserve, buys add to it, and the 80% fee slice compounds on top. The curve's floor — the ETX price a holder receives if they sell back to the curve — is therefore monotonically non-decreasing in the absence of net sell pressure, and structurally rising in the presence of any trading activity at all. This is what "permanent POL lock" means in a singleton architecture: there is no LP token to burn, because there is no LP token at all; the lock is enforced by the contract not having a withdrawal path.

The 10% ETI LP burn ties launchpad activity to ETI's market in the same way TreasuryHarvester (§9) ties DEX activity to ETI's market. Every research-market trade structurally deepens ETI's liquidity. There is no scenario where launchpad volume strengthens spoke tokens at ETI's expense.

15.5 Auto-Sourcify verification on every launch

Research tokens are funding instruments. Buyers are trusting that the token they hold has no hidden mint, pause, transfer tax, blacklist, or upgrade hook. The most reliable way to demonstrate that — short of a per-token audit — is to:

1. Freeze ResearchToken behind a single, audited template (done — see §15.2), and
2. Have an independent third party confirm that every on-chain token's bytecode is an exact match of that template.

EticaHub does (2) automatically. A canonical Sourcify standard-input.json for ResearchToken is committed at packages/contracts/sourcify-bundles/ResearchToken/. A stateless GitHub Actions cron at apps/research-markets-sourcify/ runs every 10 minutes: it reads Launched events from the singleton, asks the Sourcify server which tokens are already verified, and POSTs the canonical bundle for any token that isn't. The worker is fully idempotent — Sourcify itself is the deduplication source, so partial failures and retries are safe. Researchers do nothing.

Until chain 61803 is added to the public Sourcify server (argotorg/sourcify#2758), the cron logs the expected 400/422/501 response and exits clean, and the launchpad UI shows Chain pending Sourcify support. The existing manifest-based explorer at eticahub.com/explorer continues to show source for every verified contract via the same bundle. The Sourcify pipeline is strictly additive — a second, independent verification surface that activates the moment upstream support lands.

This is an explicit anti-MEV property. Unverified tokens can quietly include backdoor mint, transfer-block, or pause hooks that drain liquidity once price discovery starts. Bytecode-equivalence with the verified template makes that class of attack impossible to hide. Full design lives in docs/RESEARCH_MARKETS_SOURCIFY.md.

15.6 The 5M ETX seed and the free-pool backstop

The EticaHub treasury seeds the singleton with 5M ETX at deployment. This seed sits inside the singleton as a free pool — it is not collateral underneath any individual market, but it serves as a discovery backstop. New markets bootstrap pricing against the free pool; over time the per-market curves grow their own etxReserve_i from buyer ETX and from the 80% in-curve fee slice; if a market sunsets (§15.8), whatever ETX it represented is recycled back to the free pool.

The seed is not the upper bound on launchpad TVL — that bound is total ETX in circulation. As activity accumulates, the launchpad's total ETX (free pool plus all per-market reserves) can rise indefinitely, capped only by the 100M ETX fixed supply at the protocol level. There is no path by which the seed shrinks below the 5M deposited amount in steady state, because:

• The 80% in-curve fee slice compounds inside the per-market reserves, not the free pool, but none of it ever leaves the singleton.
• Sunset returns recycle dormant ETX to the free pool, not away from it.
• The only outflow from the singleton is sellers being paid the constant-product delta from their market's own reserve.

15.7 Graduation — UI only, no migration, no LP

When a market's etxReserve_i crosses 100,000 ETX, the singleton emits Graduated(token) and the launchpad UI tags the market as graduated. There is no contract migration. No LP gets created, no liquidity is moved, no token state changes. The curve remains the only venue for the token, and the singleton remains the only venue for routing.

What changes is purely user-surface:

• The graduated token is listed in /swap's token picker.
• /trade/[address] resolves the graduated token's curve price via the singleton's quoter view and posts DutchOrder fills that the keeper executes against the curve. The same UniswapX-style trading-stack surfaces (Market, Limit, Stop, DCA, Grid) become available against the graduated token.
• The launchpad detail page tags the token with a Graduated badge and adds a View in /swap link.

This design — UI-only graduation against a singleton bonding curve — preserves the per-token-solvency, no-LP-position, and floor-pull properties of the launchpad while extending the trading surface for tokens that have crossed the activity threshold. Mechanically, a graduated token is the same as a pre-graduation token; only the surfaces that show it differ.

15.8 Sunset — recycle to free pool, no token effects

If a market goes 30 days with no trades and has not graduated, the singleton emits Sunset(token) and the launchpad UI removes the market from the active list. The ResearchToken itself is unaffected — holders retain their balances, and the singleton's sell path remains open at the curve's posted price, so any holder can always exit back to ETX. What changes is that the dormant ETX in the market's etxReserve_i is reclassified as free-pool ETX for the purpose of internal accounting, available to backstop discovery on new launches.

No holder loses anything at sunset; the launchpad UI simply stops surfacing the market.

15.9 Metadata — image, socials, evidence — on-chain forever

Launch metadata is stored on the deployed ResearchToken as constructor immutables:

• name, symbol — required
• image — IPFS or HTTPS URI of the project image, required
• description — required
• website, telegram, x — optional social links
• evidenceURI — required, must link to one of: PubMed DOI, arXiv preprint, RCSB PDB structure ID, EticaLabs Autopilot run, IPFS-pinned preprint, or ORCID-signed researcher attestation

Because this metadata is in the contract constructor (and therefore in the deployed bytecode + Sourcify-verified standard-input.json), it is retrievable forever from chain alone, with no dependence on EticaHub's frontend or any centralized indexer. The launchpad UI surfaces this metadata on /research-markets/[token]; aggregators and other dapps can read it directly from the contract.

Image upload in the launch wizard goes through a server-side Pinata proxy at /api/research-markets/upload-image (the API JWT is kept off the browser). If Pinata is not configured, the wizard falls back to a paste-URI input — a researcher can pin to any IPFS gateway of their choice.

15.10 What EticaResearchMarkets does not do

• It is not a 1:1 ETX wrapper. Tokens are priced on a constant-product curve, not redeemed at parity. A 1:1 wrapper would have no price discovery, no upside for early supporters, and no launchpad utility.
• It does not migrate to an external pool at graduation. Graduation is UI-only (§15.7).
• It does not retire or alter the ProposalTokenFactory design (§16). The two launchpads coexist.
• It does not give the protocol operator a withdrawal authority. There is no admin function that can pull ETX out of any curve or out of the free pool. The 5M ETX seed and every accrued ETX is locked behind the contract's deliberate absence of a withdrawal path.
• It does not pay the treasury. The 0% treasury slice is deliberate. The launchpad pays researchers and pays the ETI LP burn; treasury revenue from this surface would conflict with the floor-pull property and the no-protocol-cut posture for science funding.

15.11 Deployment status

• EticaResearchMarkets singleton: deployed via the operator-only /deploy/research-markets browser deployer, with the 80/10/0/10 fee split pre-filled (PR #203). Treasury transfers the 5M ETX seed post-deploy and updates packages/shared/src/addresses.ts.
• /research-markets (launchpad UI): live with tabbed views (Live / Pending graduation / Graduated / Sunset), /research-markets/launch (token launch wizard), /research-markets/[token] (detail page with buy/sell card, provenance + Sourcify badge, permanent-floor-pull explainer).
• /swap and /trade wired to surface graduated tokens automatically (PR #202).
• Auto-Sourcify cron + canonical bundle + status badge (PR #204).
• The 5M ETX seed is held by the treasury and transferred in the same operator session as the singleton deploy.

16. Launchpad (Design Preview, Deferred to v2)

A creator-gated token launchpad (ProposalTokenFactory) is designed, implemented, and unit-tested in the repo, but deliberately not deployed on mainnet as part of v1. It will be activated as v2, once the base DEX and ETX have established a reliable price and sufficient liquidity depth.

16.1 Why

A launchpad is most useful once (a) the ETX pool has real depth, (b) the ETI/ETX pool has real depth, and (c) the DEX has seen meaningful organic volume. Launching the launchpad simultaneously with ETX itself would create paper-thin pools for every proposal token and serve no one well. We ship base infrastructure first.

16.2 Design summary (for v2 reference)

16.3 Why dual-pairing (token/ETX + token/ETI)

An earlier single-hub design (ETX-only) was rejected by the community on the grounds that every launched token would concentrate demand onto ETX at ETI's expense. The dual-pairing requirement makes every launch an ETI demand sink: each launch must supply at least 50 ETI plus a 250 ETI fee, and a token/ETI pool is opened alongside the token/ETX pool. The launchpad is structurally accretive to both ETX and ETI, not a dilutive substitute for ETI.

16.4 v1 does not include

• /deploy/launchpad page (operator-only)
• /launch/token author-facing UI
• Any mainnet deploy of ProposalTokenFactory, ProposalToken, or ProposalTokenVesting
• Any factory.setTrustedCreator(launchpad, true) call

All of the above are deferred. When activated, a separate announcement and documentation update will precede it.

17. Bridge (Phase 3 — Contract-Complete, Deploy Gated on Hyperlane-on-Etica)

The Phase 3 cross-chain bridge is contract-complete in the repo (PRs #157–#173, twelve contracts plus the supporting Hyperlane-on-Etica infrastructure-as-code bundle) and pending only the live deploy of Hyperlane on the Etica L1 (Phase H — community-funded validator + relayer on a small VPS, see docs/HYPERLANE_ON_ETICA.md). Once the Hyperlane mailbox is live on Etica, deploys follow docs/BRIDGE_DEPLOY_WALKTHROUGH.md.

The bridge supersedes the earlier multisig-validator design (PR #5) entirely. The new architecture replaces a trusted k-of-n validator set with an optimistic-veto model on Hyperlane's already-deployed validator/relayer rails: any honest party can submit a claim, the protocol operator (or any community member with a Merkle proof) has a 48-hour challenge window to veto a fraudulent claim before it mints, and a 10M ETX insurance fund underwrites the worst case.

17.1 Architecture

Messages move on Hyperlane (industry-standard interchain message protocol). Asset custody and minting live in EticaHub-authored contracts that consume Hyperlane as transport:

17.2 Optimistic-veto flow

1. Deposit. A user calls BridgeVault.deposit(amount, destinationChain, recipient) on Etica. The vault locks the ETX, computes a claimId, and dispatches a Hyperlane message to the destination BridgeMinter.
2. Claim open. Hyperlane relays the message. BridgeMinter.submitClaim() opens a claim with a 48-hour challengeEnd timestamp.
3. Challenge window. During the 48h window, anyone can submit a veto via OptimisticVetoModule.veto() (operator key) or FraudProverModule.veto() (community Merkle proof against Etica state at the deposit block).
4. Execute. After the window passes with no veto, anyone (including the recipient) calls BridgeMinter.executeClaim() to mint WrappedETX to the recipient. Up to that moment, the funds remain locked on Etica and recoverable.
5. Round-trip. To return, the user burns WrappedETX on Eth/BSC via BridgeMinter.burn(). The minter dispatches a Hyperlane message back to Etica, the vault validates it, and the user (or any keeper) calls executeWithdraw() after the symmetric 48h window.

17.3 Bond, fees, and insurance

• Submitter bond: 25% of the claim notional, in ETX. Slashed on a successful veto (50% goes to the veto submitter, 25% goes to the insurance fund, 25% is burned). Returned on successful execution.
• Bridge fee: 0.1% of the claim notional, in ETX, routed through FeeRouter (20% insurance, 80% harvester).
• Per-day cap: RateLimitISM defaults to 1M ETX/chain/day, ramped from 100k → 1M → 10M over a 30/60/90-day post-launch schedule.
• Insurance fund: seeded with 10M ETX from the treasury, top-able via BridgeInsuranceFund.deposit() or via the FeeRouter's 20% slice. Per-veto payout cap = 5% of fund balance; per-day payout cap = 1% of fund balance.
• Heartbeat cadence: operator signs an on-chain heartbeat every 15min (free GitHub Actions cron in apps/bridge-watcher). After 4h of silence the bridge auto-pauses; after 90 days of continuous silence the heartbeat key can be rotated via the successor-key recovery path.

17.4 Watcher (free, runs on GitHub Actions)

apps/bridge-watcher/ ships three independent GitHub Actions workflows that together replace the paid "$20/mo VPS bot" most bridges run:

• Heartbeat (15min cadence) — signs the on-chain heartbeat on each remote chain.
• Monitor (5min cadence) — pulls fresh ClaimSubmitted events, runs sanity checks against the Etica RPC, posts to Telegram on any suspicious claim. Alert-only. Manual veto stays on the operator's hardware wallet — the bot never holds the veto key.
• Auto-execute (30min cadence) — calls executeClaim() on matured legitimate claims so recipients don't have to pay destination-chain gas.

All three workflows skip cleanly when bridge contract addresses are unset, so CI is green from day-zero through deploy day. Operational cost: $0/mo.

17.5 Custom ISMs

Hyperlane lets each recipient contract specify its own Interchain Security Module. The bridge stacks three custom ISMs in AGGREGATION mode on top of the standard MultisigISM:

• HeartbeatISM — blocks message validation if the operator hasn't pinged in 4h.
• TVLCapISM — blocks message validation if executing the claim would exceed the per-chain wrapped supply cap.
• RateLimitISM — blocks message validation if today's running total + this claim would exceed the per-day cap.

All three are stateless to the relayer (they read on-chain state, sign nothing) and ship with timelocked parameter knobs so a compromised admin can't widen caps without warning.

17.6 /bridge UI

apps/web/src/app/bridge/page.tsx ships a read-only baseline today (status banner, address book, locked parameters, the "how a deposit moves" explainer) and the same components automatically light up with live TVL, pending claims, and heartbeat status the moment addresses populate in packages/shared/src/addresses.ts. The page is non-custodial — no signing flows are wired until the contracts are live, and even then every flow routes through the user's wallet (Permit2 on Etica, WrappedETX.permit on Eth/BSC).

17.7 Status

Contracts are deployment-ready. Operational dependencies for the live deploy:

• Hyperlane mailbox on Etica — requires Phase H (validator + relayer on a community-funded VPS). Plan in docs/HYPERLANE_ON_ETICA.md. Estimated cost ~$5-10/mo recurring, ~$5-10 one-time gas. Funded from the harvester's 80% treasury slice once live.
• Bond + insurance seed — 10M ETX from treasury to BridgeInsuranceFund at deploy time.
• Operator hardware wallet — owns BridgeMinter on each remote chain, owns OptimisticVetoModule. Multisig migration is a post-launch task.
• Audit. Sherlock contest scoped after Phase H lands. Estimated 3–4 weeks of lead time.

18. Governance and Treasury

18.1 Treasury wallet

The EticaHub treasury is an EOA at 0xB2B4bC9d02970A55efF64C2D84c622c87967C19D. It holds:

• Essentially all of the ETX supply at genesis (minus the amount seeded into pools).
• LP tokens for the initial ETI/ETX and EGAZ/ETX pools (less whatever fraction has been moved through the future TreasuryHarvester POL-burn path, which permanently locks LP tokens to the burn sink).
• Any subscription revenue, swap protocol fees (after feeTo is set), and pool-creation fees.
• Any undistributed portion of the 10% farm bucket from the Harvester (parked in treasury until ETXFarms is live).

18.2 Administrative keys

The feeToSetter key is intentionally low-ceremony at launch (EOA) to minimize operational risk during the first few weeks. It will be migrated to a multi-signature wallet as a follow-up, announced separately.

18.3 On-chain authority of ETX

ETX itself has no admin — no pause, no mint, no blacklist, no upgrade. Governance in the "change the token" sense is impossible because the contract has no mutable configuration. All governance discretion is exercised over the DEX and treasury, not over ETX.

19. Security

• Foundry test coverage: 500+ tests across swap, research, launchpad, UniswapX reactor wiring, stETX, TreasuryHarvester, ETXFarms, EticaStableSwap, and the full Phase 3 bridge stack (vault, minter, insurance fund, fee router, optimistic-veto, fraud-prover, custom ISMs, cross-chain top-up). All passing in CI; aggregated across packages/contracts and packages/trading-contracts.
• Pinned dependencies: OpenZeppelin v5.1.0 (pinned specifically to avoid Cancun-only mcopy on Etica's Paris-EVM).
• No upgradeability / no proxies: Every contract is deployed at its final implementation. There is no upgrade path that could silently change logic.
• No admin mints: ETX supply is fixed at deploy. stETX shares can only be minted in exchange for ETX deposits.
• No custody paths: StakedETX has no owner at all — distributeRewards is permissionless and can only increase the exchange rate. Harvester keeper can only perform the 10/10/40/40 redistribution. Reactor owner can only toggle a capped protocol fee. No key in the system can unilaterally drain user funds.
• No external audits at launch. v1 ships without a third-party audit. Users should size their exposure accordingly. Audits are on the roadmap (§20) and will be announced once scoped.

20. Roadmap

Timeline is indicative, not committed.

Shipped

• v1 — ETX genesis: ETX deployed, EticaSwap deployed, ETI/ETX and EGAZ/ETX pools seeded, hub-and-spoke invariant active, pool-creation fee switch activated by setting feeTo. eticahub.com routes swaps through the new contracts.
• v1 — Research Hub: /research/proposals reader, tipping, subscription contract.
• v1.1 — Trading Stack: Permit2 + UniswapX DutchOrderReactor + EticaProtocolFeeController + OrderRegistry + off-chain order book + reference keeper. Market, Limit, Stop, DCA, bounded Grid, and Infinity Bot modes all live on /trade/[token].
• v1.1 — Explorer: /explorer with blocks, txs, addresses, ERC-20 token pages, gas tracker, Sourcify-backed verification, JSONL indexer.
• v1.1 — Market Data API: /api/v1/* pools, pairs, candles, tokens, health endpoints. Aggregator submission briefs.
• v1.1 — Staking (stETX): ERC-4626 liquid staking vault, /stake UI with deposit, withdraw, 7d APY, exchange-rate chart.
• v1.1 — TreasuryHarvester: 10/10/40/40 split + POL burn. Permissionless v2 (PR #109) deployed and live at 0x5d8B…76f5; daily GitHub Actions cron + manual /admin/harvester button; first live harvest executed.
• v1.1 — Community Buy Bot: Vercel-cron Telegram posts for all ETX-pair swaps with KV-based dedup. Circulating-supply MC registry (PR #151) anchors ETX market cap to CoinGecko/CMC convention; redundant stETX MC line dropped.
• v1.1 — ETXFarms: non-emissive LP-staking contract live at 0xEBAf…c6aD; /farms UI shipped, three-pool weighted emissions wired (60/25/15).
• v1.1 — Mobile wallet UX: MetaMask deep-link + WalletConnect v2 connector.
• v1.1 — Addresses & docs: deployed addresses wired into packages/shared/src/addresses.ts; launch parameters and harvester runbook frozen in docs/.
• v1.2 — EticaLabs: /labs AI molecular workstation with Groq plan → engine-cascade fold (HF ESMFold / NVIDIA NIM ESMFold / Chai-1 / Boltz) → Groq structural analysis → mutate + export + share. Research-aware planner pulls PubMed + RCSB PDB references. EticaLabs Autopilot — /labs/feed public research feed backed by a Redis queue + GitHub Actions worker on a 10-minute cron — runs plan → fold → analyse → mutate for N iterations on every public submission. Built entirely on free tiers.
• v1.2 — EticaStableSwap (Phase 0): rate-aware AMM live at 0xbbf5…036E; 30M ETX-equivalent treasury seed locked 10y in LiquidityTimelock10y (0xFdf9…d739, unlocks 2036-05-01); StableSwapHarvesterAdapter (0x9Adc…Be76) bridges admin fees into the existing 10/10/40/40 flywheel; /swap auto-routes direct stETX↔ETX through the pool; public LP card on /pool; live /api/v1/tvl and /api/v1/liquidity-flow count the seed.
• v1.3 — EticaResearchMarkets: singleton launchpad live (PR #199), /deploy/research-markets browser deployer (PR #200), /research-markets launchpad UI with tabbed Live / Pending / Graduated / Sunset views and per-market detail pages with buy/sell card + IPFS image upload (PR #201), graduated tokens wired into /swap and /trade/[address] (PR #202), singleton upgraded to 80/10/0/10 fee split with permanent floor pull (PR #203), auto-Sourcify cron + canonical bundle + live status badge (PR #204). Treasury seeds the singleton with 5M ETX as the free-pool backstop. See §15.

Near-term

• Phase 1 — wETI/ETX rate-aware (or concentrated-liquidity) pool. Reuses the same AMM contract and harvester adapter pattern; this is the actual volume engine of the protocol. Once depth justifies it, ETXFarms emissions on the wETI/ETX pool are a candidate to attract public LPs.
• Multisig treasury migration: feeToSetter, DutchOrderReactor owner, EticaProtocolFeeController owner, TreasuryHarvester owner, EticaStableSwap owner, LiquidityTimelock10y owner, and StableSwapHarvesterAdapter owner all rotated from the launch EOA to a multi-sig. (StakedETX has no owner — nothing to rotate.)
• Aggregator listings: CoinGecko / CMC / DEX Screener / GeckoTerminal submissions reflecting the deeper Phase 0 TVL and the corrected circulating supply.

Mid-term

• Launchpad activation (v2): ProposalTokenFactory deployed to mainnet, factory.setTrustedCreator(launchpad, true) wired, /launch/token UI shipped. Dependent on ETX establishing meaningful depth and community signal.
• Bridge activation (v3 — contract-complete, see §17): the twelve-contract optimistic-veto bridge stack is repo-complete and CI-green. The remaining work is operational, not architectural: Phase H (deploy Hyperlane on Etica — community-funded validator + relayer on a small VPS), then the bridge deploy walkthrough proper, then a Sherlock contest before the per-chain rate-limit ramp. /bridge UI is already shipped in read-only mode and lights up the moment addresses are wired.
• External audits: Sherlock contest scoped for the bridge stack post-Phase-H. Earlier surfaces (stETX, harvester, farms, stableswap) audited next as TVL justifies it.

21. Risks

This section is non-exhaustive. ETX and EticaHub are experimental software and exposure should be sized accordingly.

• Liquidity risk. The launch pools were intentionally small (~$6 total at NonKYC reference prices). Trades of even a few dollars move price substantially. Depth grows only as organic volume, LPs, and (future) POL-burn harvests arrive.

• Smart-contract risk. v1 ships without a third-party audit. Every surface (DEX, Trading Stack, stETX, Harvester, ETXFarms, EticaStableSwap + Timelock + adapter) is tested but unaudited.

• Regulatory risk. Despite the fair-launch structure (no sale, no allocation, no vesting, no promises), any token that has a market value is subject to interpretation by various regulators in various jurisdictions. ETX is not offered for sale anywhere; users who acquire it on EticaSwap do so at their own risk and on their own legal assessment. stETX is likewise not sold; it is minted 1:1 against deposited ETX. Two layered frontend access policies are applied as a good-faith gesture mirroring the posture adopted by Uniswap, Aave, and similar Western DeFi frontends:

  1. Comprehensively sanctioned jurisdictions (KP / SY / CU / IR). The entire EticaHub frontend is rewritten to a compliance notice for visitors whose IP geolocates to North Korea, Syria, Cuba, or Iran. Every path on the site (including /swap, /pool, /trade, /bridge, /explorer, /whitepaper) is unavailable.
  2. United States. The stETX-related surfaces are suppressed: /stake and /farms rewrite to the compliance notice; on /swap stETX is removed from both pickers; on /pool the stETX/ETX stableswap LP card is hidden, stETX is rejected as a custom ERC20 in the V2 pair selector, and any user-held LP position whose underlying tokens include stETX is filtered out of the positions list. There is no exit affordance — the gate is a single uniform suppression of stETX from the frontend rather than a "no new entry, free exit" posture.

  The underlying smart contracts remain permissionless, open-source, and reachable on-chain regardless of jurisdiction; both layers are frontend access policies, not protocol-level restrictions. See apps/web/src/lib/geoBlock.ts, apps/web/src/lib/geoBlockServer.ts, and apps/web/src/middleware.ts.

• Operator risk. The keeper EOAs (Trading Stack reference keeper, future Harvester keeper) are hot and can be compromised. The system is designed so that a compromise of any keeper cannot drain user funds — the worst case is failed or delayed redistribution — but operational degradation is possible.

• Oracle risk. USD prices in the UI and the buy bot are derived from NonKYC's public API for ETI/USDT and EGAZ/USDT. A NonKYC outage or a manipulated quote would surface as wrong USD labels, not as wrong on-chain math (which is always denominated in the asset itself).

• Chain risk. The Etica blockchain itself is an independent L1 with its own validator set, its own client software, and its own operational history. EticaHub inherits all of Etica L1's risks (consensus, liveness, RPC availability, chain reorgs).

• Team risk. EticaHub is a small community-built project. There is no institutional backer and no formal legal entity.

22. FAQ

Is ETX the same as ETI? No. ETI is Etica Protocol's native asset. ETX is EticaHub's own ERC-20, unrelated at the token level. They are connected only by the fact that EticaSwap trades them as the first-opened pool.

Is EticaHub officially endorsed by the Etica Protocol core team? No. See §1.

Can I buy ETX from the team? No. The team does not sell ETX. The only market is EticaSwap.

Why such a small FDV? Small FDV + low LP depth keeps the initial unit price small ($0.00001/ETX) and reflects that real distribution happens post-launch as volume arrives, not at genesis. We explicitly do not want to open at a large implied FDV with no capital behind it.

Does stETX mint new ETX? No. stETX is a pure redistribution vault. Every stETX yield dollar comes from LP fees the treasury already earned and redistributed. If fees stall, yield stalls. There is no emissions schedule and no new ETX can ever be created.

What is the POL burn? Every Harvester cycle permanently locks 40% of the harvested fee tranche (paired with ETI/EGAZ) as LP in the ETI/ETX and EGAZ/ETX pools, then sends the resulting LP tokens to the burn sink. The depth stays in the pool forever and can never be withdrawn. See §9.3.

When does the launchpad open? Not v1. See §16 and §20. No date committed.

When does the bridge open? The twelve-contract bridge stack is feature-complete in the repo and CI-green. What remains is operational: deploy Hyperlane on Etica (Phase H — a small community-funded validator + relayer VPS), then the bridge deploy walkthrough, then a Sherlock contest before raising the per-chain rate-limit caps. See §17 and docs/BRIDGE_DEPLOY_WALKTHROUGH.md.

Why is stETX hidden if I'm in the US? Frontend good-faith gesture. Same posture as Uniswap and Aave. For visitors geolocating to the United States the EticaHub website suppresses every stETX-related surface uniformly: /stake and /farms rewrite to a compliance notice, stETX is removed from /swap pickers, the stETX/ETX stableswap LP card is hidden on /pool, stETX is rejected as a custom ERC20 in the /pool pair selector, and stETX-containing positions are filtered out of the /pool positions list. The underlying smart contracts remain permissionless and reachable on-chain; this is a frontend access policy, not a protocol-level restriction. See §21 (Risks → Regulatory).

Why is the entire site unavailable in my region? If you are visiting from North Korea, Syria, Cuba, or Iran (the comprehensive-sanctions list) the EticaHub frontend is unavailable site-wide as a good-faith compliance measure. The underlying smart contracts remain permissionless on the Etica network; this is a frontend access policy, not a protocol-level restriction. See §21 (Risks → Regulatory).

Is the buy bot official? Is it custodial? Yes, operated by EticaHub. Non-custodial: the bot reads on-chain Swap logs and posts messages. It holds no funds, signs no transactions, and has no privileged access. See §13.

How do I verify a contract? Submit source + metadata at /explorer/verify/[addr]; we push to Sourcify. Once Sourcify acks, the explorer reads back the verified ABI + sources on every tx and contract page. See §11.2.

Where is the code? https://github.com/iamdexx/etica-hub — monorepo, MIT-licensed.

Appendix A — Canonical addresses

Etica mainnet (chain id 61803). Canonical source: packages/shared/src/addresses.ts.

Appendix B — Chain parameters

EticaHub is an independent, community-built project. This document describes EticaHub's own design and contracts. It does not speak for, commit, or represent the Etica Protocol core team in any capacity.