plaza.fun logo

The Plaza Brief

Part 0: A 5-minute overview of plaza.fun — what we built, why Polkadot Hub, how it's secured, and what the rest of this series covers.

Cover Image for The Plaza Brief

Building on Polkadot Hub: A Builder's Journal — Part 0

We built a token launchpad on Polkadot Hub. This series documents how — the architecture, the bugs, and what we learned along the way.

This post is the overview. If you read nothing else, read this.

What We Built

plaza.fun is a set of EVM smart contracts on Polkadot Hub that let anyone create a native asset with built-in price discovery, automatic liquidity, and permanent creator economics.

Here's how it works:

A creator pays 6.28 DOT and launches a token. The token is a pallet_assets native asset — not an ERC-20 contract. It trades on a bonding curve with a 1% fee on every trade. When the curve fills (6,280 DOT in volume), the token automatically graduates to PlazaSwap, our Uniswap V2 fork built specifically for this.

At graduation, 90% of the liquidity pool tokens are burned permanently. Nobody — not the creator, not us — can pull that liquidity. The remaining 10% is locked in a vault, and the creator receives a FeeKeyNFT: an ERC-721 token representing the right to harvest yield from that locked LP position.

Creators earn 25% of every bonding curve trade. After graduation, their FeeKeyNFT can earn from the 10% locked LP harvest. PlazaSwap protocol fees are a separate treasury route.

One contract creates the token. Another prices it. Another graduates it. Another handles the DEX. Another distributes fees. They're all verified on Blockscout — you can read every line.

Why Polkadot Hub

This couldn't be built anywhere else.

Polkadot Hub has three things no other chain combines:

  1. pallet_assets — a runtime-level native asset system. Tokens created here aren't smart contracts. They're first-class citizens of the chain, with lower gas costs, better security properties, and XCM cross-chain capability built in.
  2. EVM compatibility — via pallet-revive, Hub runs Solidity smart contracts. We get mature tooling (Hardhat, Foundry, wagmi) and the entire EVM developer ecosystem.
  3. Precompiles as the bridge — ERC-20 precompiles expose native assets to Solidity code. Our contracts call transfer() on what looks like an ERC-20, but under the hood it's moving a runtime-native asset.

Business logic in EVM. Assets in the runtime. Precompiles connecting them. That architecture is unique to Hub.

Or to put it simply: pump.fun creates SPL tokens. plaza.fun activates Polkadot native assets. Not the same category.

How It's Secured

Every upgradeable contract is owned by a TimelockController. All upgrades require a minimum delay — anyone can see a pending upgrade on-chain and verify what it does before it executes.

For emergencies, a Guardian role can pause the bonding curve instantly. Slow governance for upgrades, fast response for incidents.

The fee collection contract is immutable by design. No admin key, no upgrade path, no rescueToken function. Funds flow to the vault and nowhere else.

We've run multiple rounds of internal security review. The bugs we found were real — a sandwich attack vector on LP harvesting, a state reset issue that allowed double-claiming, slippage gaps in the DEX adapter. All fixed. Part 5 of this series covers the full attack surface map and what we learned.

The Series

Each part goes deep on one aspect of the system. Pick what interests you:

Part 1: Why We Built on Polkadot Hub The architecture decision — why Hub, why not a parachain, and what "two wallets, one platform" means in practice.

Part 2: The Bonding Curve Token creation, the pricing formula, and how a single create call mints a native asset through an EVM contract.

Part 3: The Fee Engine Where the money flows — the 1% trading fee, creator earnings, and how fees work differently before and after graduation.

Part 4: The Token Lifecycle The full journey: bonding curve fills → automatic graduation → DEX listing → 90% LP burn → locked-LP harvest rights via FeeKeyNFT.

Part 5: Security & Governance Real bugs we found, the attack surface map, and the governance architecture (TimelockController + Guardian).

Part 6: Lessons & What's Next What we'd do differently, what surprised us, and where we're going.

Try It Now

plaza.fun is live on Passet Hub testnet. You can create a token, trade on the bonding curve, and see the whole lifecycle in action — right now.

  1. Connect your wallet at plaza.fun
  2. Get testnet DOT from the faucet
  3. Create a token for 6.28 DOT
  4. Watch it trade on the bonding curve

Everything described in this series is running. Every contract is verified on Blockscout. Try the product, break things, tell us what's broken.

Follow @plaza_fun for updates. · Discord