Security

Overview

YOSO has two security mechanisms that are independently verifiable:

1. Liquidity moved through Burn & Earn. The initial HyperSwap V3 LP NFT is no longer held by the deployer wallet.
2. Dev tokens vest over 3 years. The dev allocation is held by an OpenZeppelin VestingWallet-based contract with a 1-year cliff and 2-year linear vest.

Neither mechanism depends on a private promise. The relevant state is readable on HyperEVM.

LP security

What Burn & Earn changed

The YOSO/HYPE pool was seeded as a full-range HyperSwap V3 position. After seeding, LP NFT 173399 was moved through HyperSwap's Burn & Earn flow.

Some DEX burn flows transfer an NFT to the zero address. HyperSwap's Burn & Earn flow for this position transferred ownership to its Burn & Earn contract. The important checks are that the deployer no longer owns the LP NFT and the position still holds the seeded liquidity.

What it means for holders

The team cannot remove the seeded YOSO/HYPE principal from the pool through the original LP NFT. That NFT is no longer in the deployer wallet.

The position can still earn trading fees. Those fees are separate from the seeded principal.

How to verify

1. Open the HyperSwap V3 position manager: 0x6eda206207c09e5428f281761ddc0d300851fbc8.
2. Call ownerOf(173399).
3. Confirm the owner is 0x744C89B7b7F8Cb1E955B1Dcd842A5378d75c96Dc.
4. Call balanceOf(0xabcF9D3FA2D51ec1A48Ca880bc5df68add8B2290).
5. Confirm the deployer holds 0 LP NFTs.

Dev vesting

What it is

The dev allocation is held in VestingWalletCliff, a thin wrapper around OpenZeppelin VestingWallet.

The wrapper sets the OpenZeppelin start timestamp to the cliff end. Because OZ's vesting math returns 0 before start, the cliff comes from the standard VestingWallet schedule. There is no custom release curve.

What the owner can and cannot do

OpenZeppelin VestingWallet is Ownable. The owner is the beneficiary that receives released tokens. Ownership was transferred from the deployer to the dev wallet after funding.

The owner can receive vested tokens after they become releasable. The owner cannot accelerate the schedule, pause it, revoke it, or pull unvested tokens.

How to verify

Check vested amount at any time

Call vestedAmount(tokenAddress, timestamp) on the vesting contract.

Contract: 0x5E3be55Ee8Eed0a4260d38f63D8a4e76f6A21552
Function: vestedAmount(address token, uint64 timestamp)
Parameters: 0x4917afd9f67e314c97b413cC77f325E7F64eE33a, current timestamp
Returns: uint256, divide by 10^18 for YOSO

Check how much is currently claimable

Call releasable(tokenAddress).

Function: releasable(address token)
Expected during cliff: 0

Check the schedule parameters

start()                  -> 2027-04-16 20:33:45 UTC
duration()               -> 63115200 seconds
end()                    -> 2029-04-16 08:33:45 UTC
released(address token)  -> total already claimed
owner()                  -> 0xDb9e524ACD665a74788E6885739A4EF9E9C6AA10

Summary

Next steps

• Contracts: Addresses, txs, and verification script
• Tokenomics: Distribution and vesting table