Locked liquidity

The position that holds a coin's entire float is owned by a contract with no way to give it back. What you get: a coin that cannot be rugged — not by its creator, not by us, not by anyone who steals a key.

Locked by absence, not by promise

Most "locked liquidity" is a timelock: a withdrawal function that refuses until a date. The function exists. Somebody holds the key. The date arrives.

PermanentLockerV3 takes a different approach. It holds the position NFT and simply has no function that could move it. It never calls any of these on the position manager, except inside the fenced bond described below:

decreaseLiquidity    burn    transferFrom    approve    setApprovalForAll

There is no execution path — for the creator, for the protocol owner, for us, for a compromised key — that withdraws that liquidity. Not "requires N signatures". Not "after 12 months". There is no path.

You do not have to trust this. Read the verified source of PermanentLockerV3 on Arc's explorer — its address is listed in Architecture once the Arc deployment is live — and look for those calls.

What the locker can do

Three things, and they are the whole surface:

Function	Who	Effect
`collectFees`	anyone	sweeps swap fees out of the position and books them 70/30
`claimCreatorFees`	the creator only	sends the creator's booked share to the creator
`claimProtocolFees`	anyone	pushes the protocol's share to an immutable treasury address

None of them touches principal. Fees are earnings sitting on top of the position; the liquidity underneath never moves.

The locker also refuses position NFTs from anywhere but the Uniswap position manager, so nothing can be parked in it by mistake.

The one exception, and its guard rails

There is exactly one operation that moves a position: the bond, which withdraws from the USDC pool and redeposits into the tracker pool in the same transaction. It is the only reason the locker can call decreaseLiquidity at all, and it is fenced accordingly:

callable only by the launcher, never directly;
once per coin, ever — the flag is set before anything moves, so a re-entrant attempt finds it already set;
only onto that coin's own tracker, fixed at launch;
and the whole transaction reverts unless essentially everything withdrawn goes back in. The tolerance is MIGRATION_DUST = 1e12 — a millionth of a millionth of the supply, the few wei Uniswap's rounding always leaves behind.

A migration that would strand liquidity does not strand it. It fails.

See The bond.

What this does not cover

The lock is about the coin's pool. The USDC a bonded coin's tracker sends to the venue to hold its hedge is a different thing: it leaves Arc, sits on edgeX in an account held by the protocol's hedge wallet, and comes back through that wallet's key. Risks & security says plainly what that means.