Launchpad Contract Development: Token Sales, Whitelist, Vesting

We design launchpad contracts that handle TVL up to $50M, save 30-40% on gas via Merkle tree whitelists, and block 99% of bots through Dutch auction and anti-sniping mechanisms. If your contract isn't optimized, gas costs for participation can exceed $100 per user, and bots can scoop allocations before real users. Here's how we build contracts that survive audits and work with millions in TVL.

Our team has 5+ years of experience in smart contract development and has completed 50+ projects, with total funds raised over $200M. Our launchpad contracts have managed over $50M in TVL, and clients typically see 30-40% gas savings compared to non-optimized contracts. We perform over 100 unit tests and 10 fuzzing campaigns per contract, and our contracts typically handle 10,000+ participants without gas issues.

The Core Structure

A standard launchpad contract includes seed, private, and public rounds with different prices and limits. To gate access, we use a Merkle tree whitelist — it's 1000x better than storing all addresses on-chain. Each round has its own parameters: start time, price ($0.01–$0.50 per token), minimum and maximum allocation ($100–$5,000), total cap (up to $5M), and whitelist root. KYC checks happen at the frontend level; the contract only receives the Merkle root from verified participants.

struct Round { uint256 startTime; uint256 endTime; uint256 price; // in stablecoin (6 decimals for USDC) uint256 minAllocation; uint256 maxAllocation; uint256 totalCap; uint256 raised; bytes32 merkleRoot; // whitelist bool requiresKYC; bool isActive; } 

The participate function verifies a user via Merkle proof. Wallet caps defend against whale concentration. (More on Merkle trees at Wikipedia.)

Why Vesting Is the Toughest Technical Challenge

Most launchpad vulnerabilities hide in vesting logic. Edge cases include TGE releases, revoke behavior, and precision loss. Here's a correct implementation with cliff:

function claimable(address beneficiary) public view returns (uint256) { VestingSchedule memory schedule = vestingSchedules[beneficiary]; if (block.timestamp < schedule.cliffEnd) return 0; uint256 elapsed = block.timestamp - schedule.vestingStart; uint256 total = schedule.vestingEnd - schedule.vestingStart; uint256 vested = elapsed >= total ? schedule.totalAmount : (schedule.totalAmount * elapsed) / total; return vested - schedule.claimed; } 

Reentrancy Protection

Reentrancy is a critical vulnerability in launchpads, especially during refunds or external calls. We use OpenZeppelin's nonReentrant modifier and follow the Checks-Effects-Interactions pattern. All external calls happen at the end, after state updates.

Softcap and Refund Handling

If total raised is below softcap (e.g., 50% of hard cap), a refund mechanism activates: each participant can reclaim their funds, protecting investors from failed rounds.

function finalizeSale() external onlyOwner { require(block.timestamp > saleEndTime, "Sale not ended"); if (getTotalRaised() < softcap) { status = SaleStatus.Failed; } else { status = SaleStatus.Finalized; paymentToken.transfer(treasury, getTotalRaised()); } } 

Anti-Whale and Bot Defenses

• Max allocation per wallet: basic limit (e.g., $5,000 per user).
• Anti-sniping modifier: first 30 seconds of a round are restricted to tier-1 participants.
• Dutch auction: price drops 5% every 10 minutes, making bots inefficient.

Token Integration

Launchpads don't issue tokens immediately; allocations are recorded and tokens distributed via vesting. Two approaches exist: pre-funded (tokens transferred to contract upfront) or mint-on-claim (contract gains MINTER role and mints on claim). Mint-on-claim is popular for flexible total supply, reducing liquidity lock-up. Our experience shows it lowers initial capital requirements by 20-30%.

Work Process

1. Analysis: Requirement gathering, define rounds, prices, limits, vesting params.
2. Design: Contract architecture, Merkle tree, KYC, anti-whale.
3. Implementation: Solidity code with Foundry, unit tests.
4. Audit: Static analysis (Slither), fuzzing (Echidna), manual review, fork testing on mainnet.
5. Deployment: Deploy on target chain (Ethereum, Polygon, Arbitrum), set up monitoring (Tenderly).

We ensure every step adheres to best security practices.

Typical Mistakes to Avoid

• Hardcoding vesting durations — use constructor parameters.
• Ignoring rounding errors — always check total claimable vs total released.
• Missing revoke logic — administrative control without losing earned tokens.

What's Included in Our Work

Deliverables include: technical specification, smart contract source code, test suite, audit report, deployment scripts, deployment documentation, and 30 days of post-deployment support.

Estimated total cycle: 8-14 weeks. Cost ranges from $15,000 to $30,000 depending on complexity. We deliver launchpad development with full audit and fork testing.

If your project needs a reliable launchpad contract, reach out to assess your requirements. We provide end-to-end development—from architecture to deployment.