Architecture · v1.3 · 2026-07-12

From your device to a confirmed bundle, four hops.

Every key path, every node call, every cent of fee revenue, sourced from the deployed contracts and the running backend. On Ethereum the hot path reads exclusively from the operator's own Reth node over a local IPC socket, with no external RPC dependency in the trade-execution path. On Base, Solana, Monad and Bitcoin the execution path runs against the RPC endpoint you configure.

Smart-contract source open on sourcify.dev · verified source. The trading engine stays proprietary; protection comes from the on-chain footprint, not from secrecy. Read it before you fund anything.

Open the app Security page

01 · Hot-path

PWA, local Reth, multi-builder, on-chain.

Four physical hops between a Face ID confirm and a landed block. Each layer below maps to one hop.

+--------------------------------------------------------------------+
| L4   PWA shell                                                     |
|      React + Vite. Service Worker. iOS Safari / Android Chrome /   |
|      Desktop / Telegram WebApp. No app store, no extension.        |
+----+---------------------------------------------------------------+
     |  touch / Face ID / passkey ceremony
     v
+----+---------------------------------------------------------------+
| L3   Signing                                                       |
|      Your wallet is a passkey-derived EOA. The key materialises    |
|      in-browser via WebAuthn PRF, ~milliseconds between credential-get    |
|      and signed payload, then zeroed. Snipe auth is separate: a    |
|      self-custodial session key funded from your wallet - it can   |
|      spend only that balance; disarm sweeps it home.               |
+----+---------------------------------------------------------------+
     |  signed payload (no key material) over HTTPS
     v
+----+---------------------------------------------------------------+
| L2   Backend + local Reth                                          |
|      Rust (axum + tokio). Reads from a LOCAL Reth node over IPC    |
|      ( sub-1 ms RTT to the node ). No external RPC provider on     |
|      the hot path. Backend sees signed payloads,                   |
|      never key material.                                           |
+----+---------------------------------------------------------------+
     |  eth_sendRawTx ( 4-builder fan-out )
     v
+----+---------------------------------------------------------------+
| L1   Multi-builder relay  ( 4 destinations )                       |
|        flashbots.net                                               |
|        beaverbuild.org                                             |
|        titanbuilder.xyz                                            |
|        lightspeedbuilder.info                                      |
|      First inclusion wins; the rest are dropped.                   |
+----+---------------------------------------------------------------+
     |  block N confirmation
     v
+----+---------------------------------------------------------------+
| L0   Ethereum mainnet                                              |
|      LOSURIA DEX + the major Ethereum pools (best quote). Anti-rug |
|      LP-monitor on tokens you hold; trip -> auto-sell front-runs   |
|      the rug with an elevated priority tip; on Ethereum through the private bundle. A heuristic, not a guarantee.              |
+--------------------------------------------------------------------+

02 · Wallet

Passkey, wallet, snipe auth.

One ceremony per session. The keys live for milliseconds in the browser, then are zeroed. Snipes run on a self-custodial session key that can spend only the balance you fund it with — disarm any time and everything sweeps home.

Passkey owner

Your passkey lives in the device's Secure Enclave (iOS), TPM (Windows / Android), or a hardware security key. The private key signing transactions is a secp256k1 derived from the passkey via the WebAuthn PRF extension. Existence in memory: ~milliseconds between credentials.get() and the signed payload. After that: SubtleCrypto.deleteKey + zeroed buffers. LOSURIA never sees the raw key.

↓ authorises

Your wallet

The passkey-derived secp256k1 address is the wallet — a plain EOA you can re-derive from your passkey independently of LOSURIA. Funds, tokens and approvals live here. Every swap and native send routes through an immutable, owner-less forwarder contract that settles the platform fee (1 % swap · 0.05 % send) atomically inside the same transaction — no contract wrapper around your funds, no deployment step, the same model on Ethereum, Base and Monad.

↓ arms

Snipe authorisation

One custody rule: a signer spends only what it holds. Snipe session: a dedicated session key derived from your wallet key. You fund it with exactly the amount you are willing to deploy; it can never touch your main balance, and because it is derived — not random — you can re-create it from your passkey wallet and recover the funds at any time, with or without LOSURIA. API session: the programmatic API and first-block sniping run on the same model — a key derived behind your API credential that signs autonomously while your tab is closed, cannot authorise new keys, and cannot spend beyond what you funded. Disarm: one tap, sweeps the entire position — tokens and native — back to your wallet.

03 · Trust model

What you trust LOSURIA for vs. what is verifiable.

If a fact is on-chain you can prove it yourself; if it is operational we say so.

Verifiable on-chain · no operator trust required

Subscription is non-custodial, each payment transfers straight from your wallet to the immutable Treasury via LosuriaSubscription; the contract never holds funds and you can cancel anytime on-chain.
Subscription billed in DAI per 30-day period, Pro plan ≈€20, Whale plan ≈€200; each plan price is bounded on-chain to a 50–200 % corridor around its deploy value.
Fee destination: immutable per swap leg. The operator cannot redirect collected funds.
LSR token: 1B fixed supply, no mint(), no upgrade path, ERC20Votes wired.
Launchpad: the factory deploys the token, funds the LP and locks it, factory-enforced on Ethereum, Base and Monad — on those chains there is no window where the token trades without locked LP; the Solana path has no factory and no LP lock. The creator never holds the LP position.
Launchpad buy tax: creator-set 0–5 %, immutable post-deploy, sells tax-free, routed on every buy. Token contract has no mint(), no pause(), no admin and no blacklist.
Snipe-window: every EVM wizard launch routes through deployScheduled() with a 60-second minimum delay between TokenDeployed and PoolOpened, enforced by MIN_DELAY_SECS on the factory — subscribers get the pre-arm window on every scheduled launch.
Monad: swaps, snipes and launches execute on the LOSURIA DEX, our own immutable DEX — the 1 % platform fee is charged inside the pool's swap() itself, with no admin, no upgrade and no fee-free route around it.

Operator trust · what we ask you to take on our word

Local Reth is up and configured correctly, verifiable via /latency (operator-published) and via your own ping to the public surfaces.
Trading engine source is proprietary. Every routed swap is listed at /trades with its tx hash, so the route and the fee leg can be checked on-chain against any of them.
Backend sees signed payloads, never your wallet key. While a snipe session is armed it additionally holds the session key you funded — in memory only, never written to disk. That key can spend only its own funded balance: your wallet is never authorised, the worst case is capped at what you funded, and you can re-derive the same key from your passkey wallet and sweep it yourself at any time, with or without LOSURIA.
Operator treasury custody sits on a hardware-security device under the operator's physical control. Trust here is in operational discipline, not in code — and unlike the rest of this page, you cannot verify it from outside.
Rolling-out items (operator-run low-latency nodes for Base, Solana and Monad) ship when they ship, we never advertise them as live perks.

04 · Deployment

Addresses on Ethereum mainnet.

Every address points to a contract whose Solidity source is exact_match verified on the open Sourcify registry. Click any row for the Sourcify lookup; the /audit page has the deterministic bytecode sha256s.

LOSURIA Subscription0x11Eb592D…35052dcc ↗

Signed-Order Executor0x8D47a937…1c47F68f ↗

Spend-Swap Executor0xb6ab7256…69869693 ↗

Swap Forwarder · 1% fee0xa186b51B…4f172993 ↗

Send Forwarder · 0.05% fee0x87f4c561…2F22D313 ↗

LOSURIA DEX Factory0x43C27ccA…294c3cE7 ↗

LOSURIA DEX Router0x7076C08A…15060019 ↗

Token Factory · DEX venue0xD12C3efe…A57bE94E ↗

LSR governance token0xe9126022…b339db04 ↗

Source verificationsourcify.dev · verified source ↗

05 · Security posture

Every key path on the page.

If a key can sign for you, it appears in the table, with the holder and rotation path.

Key path

Scope

Holder

Rotation

User passkey

Everything your wallet holds

You · Secure Enclave / TPM / hardware key

Add backup passkey, revoke old

Snipe session key

Only the balance you fund it with — never your main wallet

Derived from your wallet key · in backend memory only while armed · re-derivable by you

1-tap disarm → full sweep home; recoverable without LOSURIA

Operator EOA

Pay gas for some snipe bundles (refunded)

Operator · hardware-security device

Operator-controlled hardware device

Whale-plan subscriber

Priority execution lane (a higher priority-fee ceiling, not dedicated infrastructure: Whale orders escalate to a higher priority-fee ceiling than Pro orders, so on a contested launch they outbid and land ahead, a software-side ordering preference, not a consensus-level or block-position guarantee) · 1 governance vote, resolved from currentTier(addr) · programmatic API to the execution engine, rate-limited

You · your passkey-derived wallet

Cancel anytime on-chain

Token Factory owner

Set the featured-slot fee (bounded) — the 1% launch fee is immutable

Operator EOA

Bounded by contract FEE_MIN/MAX

Fee Collector

Receive ETH · sweep to treasury

No admin · immutable

Impossible by design

LSR (governance token)

1B fixed supply · ERC20Votes

No mint() · supply fixed at deploy