Security by design
The PALMETTO token contract has a fixed maximum supply of 73,000,000 PALMETTO and contains no mechanism for future minting, token burning, transaction taxes, pausing, blacklisting, rebasing, administrative balance changes, or contract upgrades. There is no proxy through which replacement logic can be introduced. These limitations reduce the number of privileged functions and mutable components that could otherwise create technical or administrative risk.
Treasury release protection
The Treasury Release Vault holds the original 72,927,000 PALMETTO treasury allocation under forty scheduled release intervals. The contract cannot accelerate the schedule, increase a scheduled release, or redirect a release away from the permanently designated Treasury Wallet. The release function may be triggered by any caller after an interval becomes eligible, but the caller cannot receive the released PALMETTO. Delayed intervals accumulate according to the original schedule and cannot be claimed more than once.
Original liquidity protection
The Liquidity Lock holds the UNI-V2 liquidity provider tokens representing the original PALMETTO / USDC liquidity position. It has no owner, administrative override, early-withdrawal function, or beneficiary-change function. The locked balance cannot be released before August 28, 2036 at 23:08:53 UTC and, after expiration, can be transferred only to the permanently designated Treasury Wallet.
Internal security review
A post-deployment internal security review was performed on the PALMETTO token, Treasury Release Vault, Deployment Launcher, and Liquidity Lock. The review included manual source inspection, compilation with Solidity 0.8.24 and OpenZeppelin Contracts 5.6.1, comparison of compiled executable bytecode with the contracts deployed on Base, automated static analysis, and adversarial local testing of release timing, duplicate claims, vault reinitialization, unauthorized redirection, early liquidity withdrawal, release limits, and prohibited token capabilities.
The executable bytecode produced from the reviewed source matched the executable bytecode deployed at the published contract addresses. No exploitable vulnerability capable of unauthorized minting, premature release, duplicate release, beneficiary redirection, contract upgrading, or theft of PALMETTO was identified within the scope of the internal review. No modification or replacement of the deployed contracts was recommended.
Scope and remaining risks
The internal review is not an independent third-party security audit and does not guarantee that every possible vulnerability has been identified. Digital-asset activity remains subject to risks outside the Palmetto Token™ contracts, including wallet compromise, malicious signatures or approvals, phishing, copied contract addresses, price volatility, limited liquidity, transaction ordering, and vulnerabilities or disruptions affecting Base, Uniswap, USDC, wallet software, block explorers, or other third-party infrastructure.
Verify independently: Contract source and deployed activity can be inspected through the official BaseScan links published on the Transparency page. Always verify the complete contract address before interacting with PALMETTO.