How we launched our own token on Base (testnet): every step we took

Before we ask crypto founders to trust us with their launch, we ran our own. This is the exact process behind $MNTK, the token that pays for Mintmark services: the contract, the tests, the deployment, the source verification and the on-chain vesting. It is currently live on Base Sepolia, Base's test network.

If you are preparing a token launch, you can follow the same steps. If you are evaluating a token, this is also the checklist of what to verify.

1. Decide what the contract must not be able to do

Most rug pulls are not clever hacks. They are admin powers that were in the contract from day one: a hidden mint(), an owner who can pause transfers, a tax that can be switched to 99%.

So we started with a list of things our contract would never be able to do:

• Mint new tokens after launch
• Have an owner or admin key
• Freeze or blacklist wallets
• Charge a transfer tax

What it can do is short: transfer, approve, let holders burn their own tokens (for a revenue-funded buyback), and support signature approvals (permit).

2. Write it with audited building blocks

We did not write token logic from scratch. The contract extends OpenZeppelin v5.1, the most widely audited Solidity library:

contract MintmarkToken is ERC20, ERC20Burnable, ERC20Permit {
    constructor(address initialHolder, uint256 totalSupply_)
        ERC20("Mintmark", "MNTK")
        ERC20Permit("Mintmark")
    {
        if (initialHolder == address(0)) revert ZeroAddress();
        if (totalSupply_ == 0) revert ZeroSupply();
        _mint(initialHolder, totalSupply_);
    }
}

The entire supply, 1,000,000,000 MNTK, is minted once in the constructor. There is no other path to _mint.

3. Test the promises, not just the features

We used Foundry. Beyond the usual "transfers work" tests, we wrote tests for each promise from step 1:

• test_NoMintFunction: calling mint(address,uint256) fails and supply stays fixed
• test_NoOwner: calling owner() fails, because there is none
• test_CannotBurnOthersWithoutAllowance: nobody can burn someone else's tokens
• A fuzz test that runs 256 random transfer amounts and checks total supply never changes

Result: 10 of 10 passing. A promise without a test is marketing.

4. Deploy to testnet first

Base Sepolia costs nothing and behaves like mainnet. We created an encrypted keystore instead of pasting a private key into an environment variable:

cast wallet import mntk-test --interactive
forge script script/Deploy.s.sol --rpc-url base_sepolia --account mntk-test --broadcast

Deployment cost: 0.0000061 test ETH. On Base mainnet, fees are in the same low range, so cost is not an excuse to skip testnet.

5. Verify the source code

An unverified contract is a black box: explorers only show bytecode. We verified on both Basescan and Sourcify with one command:

forge verify-contract <ADDRESS> src/MintmarkToken.sol:MintmarkToken \
  --chain base-sepolia --constructor-args <ENCODED_ARGS> --watch

Now anyone can open the contract on Basescan, read the code and call its functions directly. You can check ours here: 0x7164…60D8 on Basescan.

6. Lock the team tokens with code, not a promise

"Team tokens are locked" is one of the most repeated and least verifiable sentences in crypto. We enforced it on-chain with OpenZeppelin's VestingWallet:

The whole distribution ran in a single block, and a test proves the team contract releases zero tokens in the first year:

cast call <TEAM_VESTING> "releasable(address)(uint256)" <TOKEN> --rpc-url base_sepolia
# 0

7. What is still left before mainnet

We are not done, and we will not pretend otherwise:

• Independent audit. Our tests are not a substitute for an external review.
• Legal review of the utility and buyback model.
• Treasury multisig with separate signers.
• Liquidity lock for the DEX pool.

The checklist, in short

If you are launching, or buying, check these five things:

1. Is the source code verified on the explorer?
2. Does the contract have an owner, a mint function or a tax switch?
3. Are team tokens in a vesting contract you can query, or just "locked" in a tweet?
4. Was it tested on testnet first?
5. Is there an independent audit?

Want us to run this checklist on your project, together with your site, search presence and tracking? Request a free audit: three concrete issues and how to fix them, within 48 hours.