Security feed

Case files

Real failure patterns from NFT and token launches, and the specific OriginPad mechanism that makes each one impossible.

RUG PULL2026-06-12

Liquidity rug pulls: the #1 way token launches steal funds

From Squid Game Token (2021) to countless memecoins since, the pattern is identical: the team controls the liquidity pool, waits for buy pressure, then withdraws the LP and leaves holders with a token that cannot be sold.

How OriginPad prevents this

On OriginPad the Uniswap V4 pool is created automatically by the contract when a collection mints out, and the liquidity is locked permanently: the contract that owns it has no function to remove it. Nobody, including the creator and the platform, can ever withdraw the liquidity. It is verifiable on-chain.

DUMP2026-06-12

Team allocations dumped on holders in week one

Many launches reserve 20-50% of supply for the team with no lockup. Evolved Apes (2021) and similar projects saw insiders dump everything within days, killing the chart and the community.

How OriginPad prevents this

OriginPad tokens have a fixed split: 50% goes into the locked liquidity pool, 50% is locked in the airdrop vault on a hard-coded schedule (day 1/7/14/28/56). Each epoch burns 9% of supply and routes 1% into a claim pool that trading losers can claim anytime. There is no discretionary team bag to dump.

SNIPING2026-06-12

Rarity sniping: bots minting the rares before you can

When rarity is assigned per mint or metadata is uploaded before reveal, bots read the chain or the IPFS folder and snipe exactly the rare token IDs, leaving regular minters with commons.

How OriginPad prevents this

OriginPad assigns no rarity during minting. The full distribution (46/30/15/5/1/3) is shuffled in a single transaction at sellout, seeded by block data that does not exist until that moment. There is nothing to snipe. Every mint has identical odds.

EXPLOIT2026-06-12

Allowlist bypasses and bot-flooded public mints

Poorly implemented presales have been bypassed by calling the contract directly, replaying signatures, or flooding the public phase with bot wallets that drain the supply in seconds.

How OriginPad prevents this

Phases on OriginPad are enforced on-chain with merkle proofs per wallet (TEAM / GTD / FCFS / PUBLIC), time windows, and per-wallet caps. A wallet that is not on the list cannot mint in that phase no matter how it calls the contract. We tested it with 50 wallets on every phase.

SCAM2026-06-12

Malicious marketplace approvals draining wallets

A classic NFT drain: users sign a marketplace approval (setApprovalForAll) on a fake or compromised site, and the attacker transfers every NFT out of the wallet.

How OriginPad prevents this

OriginPad's marketplace is built into the NFT contract itself. Listing, buying and offers happen inside the collection, with no external operator contract to approve, so the drain-by-approval attack surface simply does not exist.

RUG PULL2026-06-12

Mint proceeds vanishing before launch finishes

Frosties (2022) and many smaller mints ended with the deployer wallet draining mint proceeds mid-sale and abandoning the project. The classic soft rug.

How OriginPad prevents this

Mint ETH on OriginPad goes into the collection's bonding pool, not the creator's wallet. At sellout, 20% automatically seeds the locked liquidity pool. Pre-bonding exits by minters carry a 50% penalty so a half-finished mint can't be silently drained.