SliceSecurity model
Some of this system is enforced by programs and signatures, and some of it rests on trusting the operator. This page draws the line between the two, key by key, without moving it in our favour.
What stays with you
- Your wallet’s keys. The launch transaction is built and signed in your browser. The server never sees a private key and never signs for you. Your wallet signs one message, which moves nothing, and one transaction, which you review first.
- The mint key. Generated in your browser for the new token, used to sign its create transaction, and never sent anywhere.
- Your X account. Signing in goes through X’s own consent screen with OAuth 2.0 and PKCE. We never see your password. X’s access token is used once, to read who signed in, and is not stored.
- Your payout wallet. We only ever send to it. Nothing we hold can take anything out of it.
The keys we hold
| Key | What it does | If it leaked | If it were lost |
|---|---|---|---|
| Treasury | Receives sweeps, pays payouts, buys and burns, sends platform withdrawals, pays every network fee. A hot key, because payouts are signed without a person in the loop | Everything in the treasury could be taken | Everything in the treasury would be stuck |
| Creator master seed | Derives every token’s creator key. A creator key signs only its token’s sweeps | Unswept fees in the vaults could be collected by someone else | Fees in the vaults could never be swept again. Backed up offline for that reason |
| Session secret | Signs the session cookie of every X sign-in | Sessions could be forged, so someone could claim a balance to their own wallet | Everyone signs in again. No money is affected |
| Admin key and passkeys | Open the console, in sessions that expire after 12 hours: pause jobs, change settings, hide a token from Explore, retry a failed payout, release a failed burn run, run a job now, withdraw the platform’s share | Those same actions. The only one that sends SOL where the caller chooses is a platform withdrawal, capped at the platform’s own balance and at what the treasury holds beyond its reserve and everything it owes | Replaced by the operator |
| Cron key | Lets the scheduler start the sweep, payout, burn, launch recovery and market jobs | Jobs could be started more often. Each is idempotent and holds a lease | Replaced by the operator |
The RPC provider key, the IPFS key and every secret above live in server environment variables. None of them is shipped to a browser: pages talk to Solana through our /api/rpc proxy, which answers only this site’s own pages, forwards only the methods the launch page uses, sends or simulates only transactions that call pump.fun’s program, and caps the size of every request as it reads it.
What the server checks before trusting anything
- A launch is listed only after the chain agrees. The server reads the confirmed create transaction and checks its mint, creator, metadata URI, name and ticker against the launch you prepared, and that it is priced in SOL with none of pump.fun’s other fee modes switched on.
- Metadata is what you signed. Your message signature is verified against your wallet, and the digest is recomputed from the uploaded image and details. A swapped picture or recipient does not match and is refused.
- Images are what they claim. The format is read from the file’s bytes, not its name or declared type, and only PNG, JPEG, GIF and WebP are accepted.
- Credits come from the sweep transaction. A sweep credits the amounts in pump.fun’s collect events of the confirmed transaction, plus fees somebody else had collected into the creator address, read from that same transaction’s balances. Nothing is credited from a balance read at another moment.
- Money routes take the X account from the session. A claim or a routing change applies to the X user id in your signed session cookie, never to anything in the request body.
- No double spending of a balance. A claim locks the account, checks the balance in the same transaction, and a database index allows one open payout per account. A sweep, a payout and a burn each save their signature before sending, so none can be applied twice.
- Payout addresses are real wallets. Only on-curve public keys that are unused or plain system accounts are accepted, and never the treasury or an address of a token launched here, so SOL cannot be sent where no one holds a key for it.
- Handle ownership fails closed. A handle that has been paid here is added to a new launch only once X confirms it still belongs to the same account. If X cannot be asked, the launch waits rather than guess.
- Public writes are rate limited, and the admin and cron surfaces answer 404 when their keys are not configured, so they do not advertise themselves.
What the operator can and cannot do
| Through the product, the operator can | It is outside the operator’s reach to |
|---|---|
| Pause launches, sweeps, payouts or burns | Sign anything with your wallet, or take anything out of it |
| Change the platform share for future launches, up to 50% | Change what a confirmed launch transaction says: mint, creator, metadata |
| Change the sweep, claim, autopay and burn thresholds | Edit a launch’s IPFS record, which is addressed by its own hash |
| Hide a token from Explore. It is still swept and its recipients still paid | Make pump.fun pay a token’s creator fee anywhere but its creator address |
| Publish the platform token and switch buyback on or off | Hide a sweep, a payout or a withdrawal: each is a public transaction on Solana |
| Withdraw the platform’s available share to a wallet | Withdraw from what recipients are owed through the console, which refuses any amount above the platform’s balance or the treasury’s surplus |
What rests on trusting us
The treasury key can move the treasury’s SOL anywhere, and nothing on chain prevents it. The database that holds the ledger is ours, and so is the secret that signs sessions. A dishonest or compromised operator could take the money in the treasury. The design cannot rule that out. It is built so that it would be seen quickly: the treasury balance against what it owes is public on the proof page, every sweep and payout is in the public ledger with its signature, and every token’s fees can be read on chain through its own vault.
Two smaller dependencies are worth naming. X handles are looked up through a public service, not X’s paid API, when a launch is prepared and again later for handles it could not resolve, and that lookup decides which X account a handle is pinned to. And the public API and the site read from our database, so where the API and the chain disagree, the chain is right. If you want less of your money resting on any of this, claim it, or turn on Autopay. See Risks.