Locked liquidity

The position that holds a coin's entire float is owned by a contract with no way to give it back.

Locked by absence, not by promise

Most "locked liquidity" is a timelock: a withdrawal function that refuses until a date. The function exists. Somebody holds the key. The date arrives.

PermanentLockerV3 takes a different approach. It holds the position NFT and simply has no function that could move it. These are not present in its bytecode:

decreaseLiquidity    burn    transferFrom    approve    setApprovalForAll

There is no execution path — for the creator, for the protocol owner, for us, for a compromised key — that withdraws that liquidity. Not "requires N signatures". Not "after 12 months". There is no path.

You do not have to trust this. Read the deployed bytecode and look for the selectors.

What the locker can do

Three things, and they are the whole surface:

None of them touches principal. Fees are earnings sitting on top of the position; the liquidity underneath never moves.

The one exception, and its guard rails

There is exactly one operation that moves a position: the bond, which withdraws from the USDG pool and redeposits into the tracker pool in the same transaction. It is the only reason the locker can call decreaseLiquidity at all, and it is fenced accordingly:

• callable only by the launcher, never directly;
• once per coin, ever — the flag is set before anything moves, so a re-entrant attempt finds it already set;
• only onto that coin's own tracker, fixed at launch;
• and the whole transaction reverts unless essentially everything withdrawn goes back in. The tolerance is MIGRATION_DUST = 1e12 — a millionth of a millionth of the supply, the few wei Uniswap's rounding always leaves behind.

A migration that would strand liquidity does not strand it. It fails.

See The bond.