Remus

DuoFactoryPons is not a token. It is the control plane for a launch system: each call to `launch` mints nothing itself but deploys a Pons V2 bonding-curve token through the Pons launcher, clones a `DuoVault` and a `DuoStaking` at addresses derived from `duoId` (creator address plus a chosen nonce), performs the opening buy with the sent value minus Pons's live `launchFee`, and splits the purchased tokens 30% to the staking bonus pot, 30% to the vault as parity inventory, 40% to the launcher, refunding any curve overflow. `predict` and `duoIdOf` let a creator reserve the same id on the other chain, which is a sensible anti-hijack design.

The important thing a holder cannot see from the token: the vault and staking clones read `operator`, `porter`, `scorer` and `treasury` live from this factory on every call. So whoever owns this factory indirectly controls, for every coin ever launched by it, who may trade vault inventory (`setOperator`), who may sign token releases out of any vault to any address via `portalIn` (`setPorter`), who receives the platform's tenth of all vault income (`setTreasury`), and who decides the weekly chain-war result (`setScorer`). Rotation is instant and applies retroactively to live coins. Ownership moves in two steps, which is good, but there is no timelock and nothing renounced. `setTerms` caps creator tax at 5% and only affects future launches; existing coins keep the tax Pons fixed at creation.

Two dependencies with no fallback: the bonus pot in staking only releases on a scorer signature, so an absent scorer leaves it locked indefinitely; and portal deposits, plus their refunds, both require a porter signature, so tokens handed to a vault via `portalOut` have no permissionless recovery path. Also note the opening buy is submitted with a minimum-out floor of one unit, so the launch purchase has effectively no slippage protection, and `unstake` permanently keeps 10% of any position.

Constructor-time: market, vault and staking implementations are immutable, but owner, operator, scorer, porter and treasury are all deployer-chosen and may be the same key.

Bottom line: the code cannot drain you, but one factory owner can rotate the keys that move every vault's token inventory and redirect the platform's fee stream at will.