Contracts & security
Everything Qian does on-chain is open source, verified, and immutable. Source code, one repo per chain: robinhood-contracts · base-contracts · ethereum-contracts · arc-contracts.
Deployed contracts
The same stack runs on every chain, at the same addresses on every chain. All contracts are verified on their explorers.
| Contract | Address (Robinhood · Base · Ethereum · BSC) |
|---|---|
| QianLocker | 0x73Da198D58fFD43B5754a2d72D989cab1c9aF0ce |
| QianFactoryV3 | 0xaC83b491b76Dd686db516c0fE9152320c83618a7 |
| QianFactoryV4 | 0x750d0bc66baa12CF1710a8ba939B97DB4aD005c3 |
| QianFeeRouter | 0xDe598E5F0b428B38EFaA6e887458FEF70bFA9436 |
| QianSwapRouter | 0xEE540d2496cfFDf17E29a04bcd7b6dc795C61d66 |
| Create2Factory | 0x175ae2c5EC7edaD3eE88e892C677bBDE815A2803 |
| GuardHook | 0xa27D4eef437Ab754074c8C9E6bCbC55184dE2000 (BSC: 0x0090F05C65865049871E66EC1e213A72A6Eda000) |
Open any of them on the explorer for your chain: Blockscout (Robinhood, 4663) · Basescan (8453) · Etherscan (1) · BscScan (56). The same address on every chain, with one exception: GuardHook is placed by CREATE2 from code that embeds the chain's Uniswap PoolManager address, so it lands at its own address on BSC.
Why the addresses match
A contract's address comes from its deployer and that deployer's transaction count, nothing else. The whole stack was deployed from one fresh key at nonce 0 on each chain, in the same order, so every address came out the same everywhere. You can check it: the addresses are a fact about the deploy, not a claim you have to trust.
The WETH address and Uniswap periphery still differ per chain, because those are Uniswap's contracts, not ours. Machine-readable, with the full periphery: chains/ in the contracts repo.
Tokens launched before 16 July 2026
Older tokens run on the previous contract set and keep that behaviour forever. Contracts are immutable, so nothing about them changed. They still display on Qian and their creators still collect fees, through the contracts they launched against. They are not tradable through the current router.
QianPay
QianPay settles payment links and invoices: a fixed USDC amount, paid straight to the recipient's wallet in USDC or anything a Uniswap V3 path can turn into USDC. Stateless, no admin functions. Create a link at pay.qian.ag.
| Chain | Address |
|---|---|
| Base | 0xa3faE6c7e97506145c29f2E7a887b345f49Cf36B |
| Arc testnet | 0x73Da198D58fFD43B5754a2d72D989cab1c9aF0ce |
QianPay deploys after the core stack, so its address is per-chain rather than part of the matched set above.
QianSubscriptions handles recurring pulls for subscription offers: permissionless charge, cancel by either side, no owner, no held balances.
| Chain | Address |
|---|---|
| Base | 0xc3a89be96b8BDb1123d2Fa40f18000e3FB1A7aAf |
| Arc testnet | 0x79a7f337F1AFBecc32f862384F96128836daad2d |
Arc testnet
Qian runs on Arc, Circle's stablecoin-native L1, since its public testnet. Gas on Arc is USDC, so payments there settle without the payer ever holding a gas token. QianPay is live and verified on arcscan; source lives in arc-contracts. The rest of the stack follows when Arc reaches mainnet.
The security model
No proxies. Nothing upgradeable. The locker's immutability is the product; if it could be upgraded, "locked forever" would mean nothing. The platform can change pointers only: the treasury address, and which hooks new launches may use. It cannot touch any existing token or pool.
QianLocker has no withdrawal code. No code path exists, admin-gated or otherwise. The only external effect it permits is fee collection through the fee router, which pays creator fees. You can check this by reading about one screen of Solidity.
Tokens have no owner and no extra functions. owner() returns the zero address, hardcoded. Beyond a standard ERC20 with burn, a Qian token has exactly four things: the factory that made it, a record of who launched it, the fixed supply, and its metadata link, all immutable, none of them a lever. No mint, no pause, no blacklist, no transfer hooks, no max-tx games, not even an owner-only setter to remove. There is nothing to renounce because there was never anything to hold.
One hook, and it can't touch your trades. V4 pools use the GuardHook, whose only job is to stop someone front-running a launch by initializing the pool first. Every swap-time permission on it is off, so Uniswap never calls it when you trade, so it cannot take a fee, block a sale, or see your swap. A pool's hook is fixed at launch, forever.
The swap router is stateless. It holds no funds between transactions and has no privileged control over any pool. Worst case, you can ignore it and trade the pools on Uniswap.
The deploy fee can't be raised on you. A launch names the maximum fee it will pay; if the platform's fee is higher, the transaction reverts instead of charging more.
Verify it yourself
Every claim on this page is checkable: open any contract above on its explorer, read the verified source, and look for what isn't there. No onlyOwner mint, no withdraw, no upgradeTo. The repository includes fork-test suites you can run against the live chains.