The human check

When you press Buy, Sell or Create token, a Cloudflare Turnstile check appears in the panel. Once you pass it, bang!’s verifier service signs a short-lived ticket for that one action. Your transaction carries the ticket, and the program checks it before anything moves.

Step by step

1. The check is bound to your action: its action name is trade-buy, trade-sell or create, and its custom data is a SHA-256 hash of your wallet, the token, the side and the exact amount.
2. The verifier confirms the result with Cloudflare and refuses a check token it has already seen.
3. It reads your wallet from your sign-in session (never from the request), applies its rate limits, and reads the token’s live state on-chain: it exists, it is still on the curve, trading opens within the ticket’s lifetime. It also pre-checks your cooldown and caps, so you do not pay for a transaction that would fail.
4. It signs a 145-byte ticket with its Ed25519 key. The ticket expires 150 slots (about a minute) later.
5. Your wallet signs one transaction: compute budget, an Ed25519 instruction carrying the ticket, then the buy, sell or create instruction right after it.

What the ticket binds

• The program and the network (a ticket for another network is rejected).
• The token, your wallet, and the action: create, buy or sell.
• The exact amount: the most SOL you will spend on a buy, the tokens you sell, or the first buy at creation.
• Your trade counter for this token. It goes up with every trade, so a ticket works once.
• An expiry slot.

What the program rejects

• A missing ticket, or an Ed25519 instruction that is not directly before the trade or not in the one fixed layout (one signature, all data inside the instruction).
• A ticket signed by a key that is not one of the active verifier keys.
• A ticket issued for another wallet, token, action, amount, network or counter value, including a used one.
• An expired ticket, or one that would stay valid longer than the configured window.
• A trade called from another program instead of directly from the transaction (routers, aggregators, bundler helpers).

One ticket at a time

The verifier keeps one open ticket per wallet and token. You get a new one once the previous one was used or expired, or after the app releases it, which it does when a trade fails.