Reference

Security and permissions

Contract identities and verifiable behavior are public integration requirements. Source publication makes inspection possible; it does not itself establish safety or an independent audit.

Signal v4: who can change what

Read from the release 4.2 contracts on HyperEVM on 12 October 2026.

No one, ever, for a launched pool

• The fee rates, the taxes and every launch rule. They are fixed at launch and the hook has no function to change them. (On a pool born with a module, the base rate moves only inside the band fixed at launch.)
• The liquidity. The launch supply's positions belong to the factory and the fee-funded bids belong to the hook. Neither contract has a path that removes one, and the hook reverts every add, removal or donation by anyone else (the factory adds only inside a launch).
• The supply. The token has no owner, no mint and no pause, and charges nothing on a transfer.
• The right to sell. No rule, window or module can block a sale. There is no switch that pauses a live pool.

The launcher of a token

• Can re-point where the pool's fee goes (the split and the co-recipients), each change announced on chain and activatable only after 24 hours, inside limits fixed at launch: the creator's part never above its share at launch, holders paid only by a holders token, a burn only with the buyback guard the pool was born with.
• Can change the token's name and symbol, at most once every 24 hours. The token keeps and exposes what it was born as. The address does not change.
• On a pool born with a module, can propose a new module implementation. A new implementation can activate only after an attestation by a key the factory's owner names and a 24-hour wait. That key is unset today, so no new module can activate. Switching a module off needs no attestation: 24 hours after the launcher proposes it, the pool pays its launch base rate, which is inside the same band fixed at launch.

The factory's owner

The 4.2 factory's owner() is a single externally owned account, 0x5164fea61d99c1eaf8c5591fd18928b8f61f0995: one key, with no timelock and no multisignature. Ownership moves in two steps (transferOwnership, acceptOwnership). It can:

• pause and unpause new launches (setPaused);
• admit, update or close a pair asset, and set its start price and bands, for future launches (setQuote);
• set Signal's share for future launches, up to a hard cap of 50% (setProtocolBps);
• approve or remove a router (setRouter). An approved router's word is believed about who a buy is for. Removing approval from Signal's router would stop buys through it during a launch's Signal-only or whale-cap window; it cannot stop a sale, and it cannot stop buys once those windows end;
• name the key that attests module changes (setProver).

Nothing the owner can do reaches a launched pool's rates, rules, liquidity or collected fees, with one narrow exception: an address the owner approves as a router is no longer paid as a co-recipient of any pool, and its share stays with that pool's creator. Signal's share of each pool is fixed in that pool's terms at launch and is paid to an address fixed in the hook when it was deployed.

Dependencies

• The canonical Uniswap v4 PoolManager holds the pools and the collected fees. Its correctness and availability are assumed.
• A pair asset is someone else's contract. It can pause, tax or block transfers under its own rules. A payout the asset refuses is recorded as owed and can be delivered later; it is not lost and it does not stop the pool.
• Dividing fees and delivering payouts needs someone to send a transaction (flush, push). Anyone can. Signal runs automation that does, with no guarantee of timing.
• HyperEVM itself: its availability, its gas limits and its finality.

Review status

The v4 contracts have been tested and reviewed internally, including rehearsals on a fork of the live chain. No independent audit has been published. These docs publish the contracts' interfaces, not their source. Do not read a passing test, a source-verification badge or this page as assurance against loss.

Other parts of Signal

• Protocol Echo is run by the Signal team's key, which can pause, redirect or withdraw any part of it at any time. See Echo.
• Relief and referral payments are sent by Signal. They are not claims enforced by a contract.
• A Signal wallet is an embedded wallet provided through Privy. Signal does not hold its key. Its availability depends on that provider and on your sign-in.
• Cross-chain orders go through Relay and inherit its risks.

Earlier launch types: different parts have different controls

The standard quote factory resolves its owner through the pad owner. Changing future quote settings does not rewrite a launched standard curve's snapshotted geometry and tax. That statement does not mean the entire Signal platform is immutable.

Perp infrastructure includes upgradeable components and policies that can permit an authorized owner to unwind a position. Review the chosen deployment's adapter, ledger terms, fee, profile and exit policy. Do not describe a 1× target, burned LP or a source-verification badge as protection against loss.

At HyperEVM block 46,523,088 on 21 September 2026, the upgrade authorities for the three reviewed perp ledgers reported upgradeDelay() = 0. Do not assume those deployments provide an upgrade notice period. This is an observation of those authorities at that block; check the actual ledger and its current admin before relying on a delay.

What verification means

• Source available: source inputs have been published.
• Source verified: a verifier reports a match to the deployed code under its verification process; inspect the actual record.
• Tested: particular tests passed under their stated conditions.
• Audited: a named independent review with a published scope and report. This documentation does not claim one merely from source or test availability.

The docs ABI bundle is compiled from a pinned public source archive. It does not independently re-verify runtime bytecode on chain. The read-only sample checks observed runtime hashes against the published manifest, which is useful identity evidence but remains dependent on that manifest and the RPC.

Report a vulnerability

Use the current support/contact route linked from Signal and request a private security channel. Send the affected chain and contracts, a description, reproduction steps and transaction evidence where safe. Avoid public exploit details before coordinated review. Never send a seed phrase, private key or wallet session.