Security & trust

Guaranteed by the program

• No curve trade or launch without a valid, fresh ticket from an active verifier key, bound to your wallet, the token, the action, the amount and your trade counter. No calls from other programs.
• Cooldowns, caps, the opening window and the opening delay apply to every wallet, the creator included. The only exception is the creator’s first buy inside the creation transaction, which can never fill the curve.
• A token’s limits, creator fee, where its creator’s cut goes and its pool shape are written into it at creation and cannot change.
• Holder rewards can never pay out more than came in, and a round’s totals can only grow.
• Supply is fixed: the mint authority is revoked and there is no freeze authority. Name, symbol and metadata cannot change.
• After graduation the liquidity sits in one permanently locked position that nobody can withdraw.
• There is no instruction that lets the admin move traders’ funds, creators’ earnings or holders’ rewards. The admin can only withdraw the protocol’s own share, to the configured fee wallet.

Trusted to the operator

• Running the verifier. It decides whether to issue a ticket while a token is on the curve. The gate ends at graduation.
• Protocol-wide settings: the platform fee (at most 3%) for new tokens, the migration fee, the pool fee schedule, the anti-bot defaults and ranges for new tokens, and the verifier keys. Every change is an on-chain event. A token keeps the platform fee it was created with.
• The rewards key: it splits each holder round (the program bounds every round by what came in) and runs lock & drip buybacks with a slippage limit.
• Upgrading the program. Whoever holds the upgrade authority can replace the code; on mainnet this is to be a multisig.

Known limits

• Bot resistance is economic, not absolute. Someone who pays people to solve checks and uses residential connections can still trade, slowly and within the per-wallet caps.
• The program has not had an external audit yet. Mainnet waits for one.