Pre-launch control sheet · 02 October 2026

What still has to freeze.

Five remaining freeze decisions, separated from the token economics that are already locked. Use the reference marks to test each call against Bankr’s verified fee mechanics and 2026 operating history.

A tick freezes a decision in this working session. It does not deploy a token, publish a post, sign a transaction, or move funds.

The source analyses are explicit: utility only, no return language, no custody, and counsel review before first client dollars. This board preserves those limits.

Remaining freeze decisions

Four open launch decisions plus one question for counsel.

Decision 01 · Metadata

Metadata package finalized

M1 · M4 · I3

Approve the public logo URL, website, social links, and description as one final package. Name, ticker, image, website, and socials are immutable after a Bankr launch.

Fee mechanics (M1): 1.75% total per trade; 0.665% to the creator fee recipient; 0.285% auto-compounds as permanently locked LP. Mechanics only—not an earnings promise.
Mechanics: Recheck every field before confirmation; no post-launch edit path is available.
2026 lesson: Treat X as an announcement surface, never the authoritative source. The official @bankrbot account was compromised in July. See I3.
Decision 02 · Wallet

Launch wallet readiness confirmed

M1 · M3 · I2

Confirm the launch wallet is at least 24 hours old, holds Bankr’s required minimum ETH on Base, and has the intended X, Farcaster, and Telegram links.

Fee mechanics (M1): 1.75% total per trade; 0.665% to the creator fee recipient; 0.285% auto-compounds as permanently locked LP. Mechanics only—not an earnings promise.
Mechanics: Web and CLI default to Base; natural-language launches do not. Use the web or CLI flow with Base explicitly selected.
2026 lesson: Fourteen Bankr-managed wallets were accessed in May. Keep strict launch-wallet hygiene and verify the recipient character by character. See I2.
Decision 03 · Simulation

Free Bankr simulation completed and verified

M1 · M3 · I1

Run a free simulation and verify its summary line by line: Base chain, token metadata, fee recipient, distribution, vesting, and launch settings.

Fee mechanics (M1): 1.75% total per trade; 0.665% to the creator fee recipient; 0.285% auto-compounds as permanently locked LP. Mechanics only—not an earnings promise.
Mechanics: Simulations are free, up to 20 per day, and do not consume one of the three rolling 24-hour launch attempts.
2026 lesson: A verified-account reply entered Bankr’s command chain in the May DRB incident. Simulate through the controlled web or CLI flow, not an X post. See I1.
Decision 04 · Demonstration

Controlled demonstration surface chosen

M1 · M2 · I3

Choose a surface WAVY controls for the demonstration. The partner remains illustrative; no partner name appears publicly until a signed agreement exists.

Fee mechanics (M1): 1.75% total per trade; 0.665% to the creator fee recipient; 0.285% auto-compounds as permanently locked LP. Mechanics only—not an earnings promise.
Mechanics: Show access and per-job fuel as utility. The ~$1–2 job fee is split 50% burn and 50% treasury; it is never framed as holder value accrual.
2026 lesson: Controlled channels matter because even an official X account can be compromised. See I3.
Open question · Counsel

Has licensed crypto counsel reviewed the classification and money-transmission framing?

M1 · I1

Specifically: does the user-directed design—user links sources, sets guardian rules, approves each plan, and the system never takes custody—support the intended utility framing in its actual transaction context?

Fee mechanics (M1): 1.75% total per trade; 0.665% to the creator fee recipient; 0.285% auto-compounds as permanently locked LP. Mechanics only—not an earnings promise.
Open until answered: Classification memo and Terms of Service are required before first client dollars. This item records a question for counsel, not a legal conclusion.
2026 lesson: The DRB event shows why permissions and instruction chains must be evaluated in operation, not just described in copy. See I1.
0

Unset tokenomics lines

The tokenomics file is marked “Final — all nine decisions frozen.” Supply, distribution, vesting, internal split, access tiers, job fee, fee split, fee recipient, partner status, and life-ops timing are therefore reference values—not open checkboxes.

Three incidents. Three operating lessons.

Verified public reporting from 2026, presented as operational history only. These summaries do not draw legal conclusions.

I1 · 04 May 2026

Grok / DRB prompt-injection heist

A Morse-code reply was decoded and reposted by Grok, tagging @bankrbot. Bankr’s command pipeline treated the reply as authoritative and transferred roughly 3 billion DRB—reported at about $150K–$175K. No private key was stolen and no smart contract was exploited. Roughly 80–88% of the value was reported returned.

Operational lesson: Never launch or issue commands through X natural-language posts. Use the controlled web or CLI flow with Base explicitly selected.

Sources named in research: SlowMist post-mortem; chainward bankr-hack-trace; Startup Fortune.

I2 · 20 May 2026

Bankr wallet exploit

A malicious actor accessed 14 Bankr-managed wallets. Reported user losses were around $150,000; three identified attacker addresses were reported holding about $440,000. Bankr disabled swaps, transfers, and deployments while investigating and committed to reimburse reported victim losses.

Operational lesson: Keep launch-wallet hygiene strict and re-verify the Safe address character by character. The self-custodied WAVY Safe is a different surface from Bankr-managed wallets.

Sources named in research: The Cryptonomist; Startup Fortune.

I3 · 25 July 2026

@bankrbot X account compromise

Attackers gained control of the official @bankrbot X account and posted fraudulent airdrop links, despite the account reportedly using an on-device passkey. The team publicly asked X to remove the posts and investigate.

Operational lesson: An official X account is still a spoofable command and announcement surface. Never treat an X post—even from a verified account—as an instruction.

Source named in research: CryptoNinjas.

Marks remain only in this open session. Downloading creates a dated plain-text record; nothing on this page saves, publishes, signs, deploys, or moves money.