GOWA and contracts
Contracts and security
The contracts GowaFun runs on, what the people running GowaFun can and cannot do, and what you are trusting when you use it.
Addresses
Current network: GIWA Sepolia (chain 91342). Once deployed, each contract is verified on the explorer so anyone can read the source.
GIWA Sepolia · chain 91342 · the network GowaFun runs onGIWA docsWhen GIWA mainnet opens, the contracts are deployed again there with new addresses. Testnet tokens do not move to mainnet.
Audit status
Not audited yet
The GowaFun contracts have not been audited by an outside firm. They are tested, and they run on testnet with test ETH only. We will publish an audit here before mainnet. Until then, assume bugs are possible.
What you are trusting
GowaFun is non-custodial: you sign every transaction yourself, and nobody else can move the tokens in your wallet. Some things still depend on people and systems we run. Here they are, plainly:
| Who | Can | Cannot |
|---|---|---|
| Owner (deployer wallet on testnet, a multisig on mainnet) | Pause buying and launching (selling always stays open). Change the fee router for future fees. Change curve settings for new tokens. Withdraw the 20% operations share. Manage operators. | Pause selling. Move your tokens. Take ETH from a curve or liquidity from a pool. Mint more of any token. Change the 1% fee. |
| Operator (GowaFun server) | Run the GOWA buyback. Set each pack tier’s token list. Set the GOWA address until it is locked. Open packs. | Choose what a pack picks. Spend the burn share on anything but GOWA. |
| GIWA sequencer (run by GIWA) | Order transactions and produce blocks, which is where pack randomness comes from. | Sign transactions for you. |
- Pack randomness comes from a future block hash. Nobody knows it when you pay, but the sequencer produces the blocks, so it is not perfect randomness.
- Rankings, prices and charts in the app come from the GowaFun indexer and API. The contracts are the source of truth.
- Hiding a token or post only affects GowaFun’s own pages. It does not touch the blockchain.
- The website could be attacked like any website. Check the contract address in your wallet before you sign.
Report a vulnerability
Found a bug? Email support@gowa.fun with the details and please don’t share it publicly until we have fixed it. We will reply and credit you if you want.