Every key path, every node call, every cent of fee revenue — sourced from the deployed contracts and the running backend. The hot-path reads exclusively from the operator's own Reth node over a local IPC socket; there is no external RPC dependency in the trade-execution path. Read it before you fund anything.
Smart-contract source open at etherscan.io · verified source. The trading engine stays proprietary — protection comes from the on-chain footprint, not from secrecy.
+--------------------------------------------------------------------+
| L4 PWA shell |
| React + Vite. Service Worker. iOS Safari / Android Chrome / |
| Desktop / Telegram WebApp. No app store, no extension. |
+----+---------------------------------------------------------------+
| touch / Face ID / passkey ceremony
v
+----+---------------------------------------------------------------+
| L3 Signing |
| Coinbase Smart Wallet. Owner = passkey, derived in-browser |
| via WebAuthn PRF. Lifetime ~12 ms between credential-get and |
| signed payload, then zeroed. Session keys are separate: |
| 90-day TTL, per-token spend cap, scoped calldata. |
+----+---------------------------------------------------------------+
| signed payload (no key material) over HTTPS
v
+----+---------------------------------------------------------------+
| L2 Backend + local Reth |
| Rust (axum + tokio). Reads from a LOCAL Reth node over IPC |
| ( sub-1 ms RTT to the node ). No external RPC provider on |
| the hot path. Backend sees signed payloads, |
| never key material. |
+----+---------------------------------------------------------------+
| eth_sendBundle ( fan-out, parallel )
v
+----+---------------------------------------------------------------+
| L1 Multi-builder relay ( 4 destinations ) |
| flashbots.net |
| beaverbuild.org |
| titanbuilder.xyz |
| lightspeedbuilder.info |
| First inclusion wins; the rest are dropped. |
+----+---------------------------------------------------------------+
| block N confirmation
v
+----+---------------------------------------------------------------+
| L0 Ethereum mainnet |
| Uniswap V2 / V3 multi-hop + Curve where deeper. Anti-rug |
| LP-monitor on tokens you hold; trip -> auto-sell front-runs |
| the rug in the SAME block with a higher MEV tip. |
+--------------------------------------------------------------------+
credentials.get() and the signed payload. After that: SubtleCrypto.deleteKey + zeroed buffers. LOSURIA never sees the raw key.executeBatch([refill_eoa, op]) — no bundler, no operator float, no user-visible funding step beyond the one-time bootstrap.SessionKey.deauthorize(keyAddr).MAX_TOTAL_CAP=1500 ceiling immutable but unreachable in practice: operator never raises phaseCap above 500.mint(), no upgrade path, ERC20Votes wired.mint(), no pause(), no admin and no blacklist.deployScheduled() with a 60-second minimum delay between TokenDeployed and PoolOpened. Atomic-launch path is removed in factory v3 — seat-holders ALWAYS get the pre-arm window. Enforced by MIN_DELAY_SECS on the factory.exact_match verified on the open Sourcify registry. Click any row for the Etherscan view; follow the /audit page for the Sourcify lookup.| Key path | Scope | Holder | Rotation |
|---|---|---|---|
| User passkey | Everything the smart wallet owns | You · Secure Enclave / TPM / hardware key | Add backup passkey, revoke old |
| Session key | 1 token, ETH cap, TTL ≤ 90d | You · in-memory secp256k1 on device | 1-tap deauthorise, on-chain |
| Operator EOA | Pay gas for some snipe bundles (refunded) | Operator · hardware-security device | Rotation per Operating Agreement Art. V |
| Founders Pass owner | Set mint price (50–200 % corridor) · pause | Operator · Ledger Nano-X (cold) | Renounce after the 500th mint |
| Token Factory owner | Set launch / featured fee (bounded) | Operator · Ledger Nano-X (cold) | Bounded by contract FEE_MIN/MAX |
| Fee Collector | Receive ETH · sweep to treasury | No admin · immutable | Impossible by design |
| LSR (governance token) | 1B fixed supply · ERC20Votes | No mint() · supply fixed at deploy | Impossible by design |
Every owner-key path on the operator side uses a hardware-security device. The keys never touch a connected machine — every signing op is wallet-app verified on-device, per Operating Agreement Art. V.