Trustpad

How a bond works

The dev of a coin posts SOL behind it. The dev's own coins sit in the program until the bond matures. Sell early, or below the promised floor, and the SOL is paid to the people holding the coin.

IOverview

On a normal pump.fun launch the dev buys first and can sell into the first buyers a minute later. On Trustpad the dev still buys at launch, but the coins are bought by the program into an escrow that only the program controls. They can leave only through release, and a release is judged: after maturity, with the market cap held at or above the floor, it is clean and the bond goes back to the dev. Any other release breaks the bond and the bond belongs to the holders.

A bond does not make a coin go up. It makes an early exit expensive for the dev, by an amount the dev chose and everyone can read. Every rule on this page is enforced by one program: program.

IILifecycle

Trust only goes up. While a bond is active the dev can add SOL (top_up) or push the lock further out (extend, at most 365 days from now). Nothing can lower the bond, shorten the lock or move the floor.

IIIClean or broken

A release is clean when all of these hold at that moment:

1. the lock is over (now is at or after the maturity time);
2. the bond has at least 6 observations;
3. the last 6 observations are all at or above the floor;
4. they form a fresh, unbroken series: the newest is at most 2 intervals old and no two neighbours are more than 2 intervals apart.

A clean release sends the coins to the dev. When the escrow is empty the bond goes back to the dev and the bond is Kept. A partial clean release leaves the bond active.

A release that is not clean is refused unless the dev passes allow_break. With it, the coins still go to the dev, and in the same instruction the bond becomes Broken: the whole bond stays in the program as the holders' pool. The break reason is recorded on chain:

The site never breaks a bond by surprise: the release button of a bond that would break opens a warning that names the reason and the SOL forfeited, and asks for a tick before it sends allow_break.

IVObservations

observe writes the coin's spot market cap into a ring of 6 on the bond account. Anyone can send it, at most once per interval (1 hour). Before graduation it reads the pump.fun bonding curve: supply x virtual SOL / virtual tokens. After graduation it reads the coin's canonical PumpSwap pool: (quote + virtual quote) x supply / base; the pool address is checked against the one pump.fun's migration creates, so nobody can point it at a thin pool.

An observation must be the only program instruction of its transaction (compute budget aside), so a trade cannot lift the price and take the sample in one step. The keeper observes every active bond each hour; when it is late, the certificate shows a Take an observation button and any wallet can do it.

VThe launch transaction

Issuing a bond is one Trustpad launch instruction, signed by the dev and by a fresh mint key. In order:

1. The bond goes from the dev to the BondVault (plus its rent minimum the first time).
2. The Fees address is funded with its rent minimum. It becomes the coin's creator on pump.fun.
3. The dev funds the Escrow with the dev buy, its rent minimum and a rent margin (the rent of 512 bytes).
4. The dev pays the platform fee, 2.5% of the dev buy (launch_fee_bps), to the treasury in the config. It is on top of the dev buy; the bond is never charged.
5. pump.fun create_v2 creates the coin: payer the dev, creator the Fees address, mint the fresh key.
6. The Escrow's Token-2022 account for the coin is created.
7. pump.fun buy_exact_sol_in spends exactly the dev buy (pump fees included). The buyer is the Escrow, so the bag lands in the Escrow's account.
8. What pump.fun did not take from the margin goes back to the dev. The Escrow ends at exactly its rent minimum.
9. The bond account records the dev, bond, maturity, floor, dev buy and the tokens bought, and emits Launched.

The certificate then reads: Payable to the holders if the developer sells before (launch + 30 days) or below 40 SOL. Its trust score is 48. If any step fails, the whole transaction fails and nothing is spent.

VIThe holders' drop

When a bond breaks, the bond's drop authority (our keeper) takes the last hourly holder snapshot from before the break (the escrow, the bonding curve, the pool and the dev's wallet are left out), splits the pool pro rata: amount = pool x balance / sum of balances, builds a merkle tree and posts its root with post_drop. Only the drop authority recorded on the bond at launch can post it; a later change of the config's drop authority does not reach bonds that already exist. The chain checks that the total is at most the pool and that the snapshot slot is not after the break slot, so nobody can buy in after the dump to farm the bond.

Leaves are sha256(0x00 | index u32 LE | wallet | amount u64 LE), nodes sha256(0x01 | smaller | larger). Every drop is published at /drops/<mint>.json with each wallet's balance, amount and proof; the Claim button in Forfeits reads that file and checks its root against the chain before sending claim_drop.

Anyone can send a claim, but the SOL always goes to the wallet named in the leaf, once. Claims stay open for 30 days from the post. After that sweep_drop sends what is left to the treasury and closes the claim map. If no drop is ever posted, the pool stays in the vault.

VIICreator fees

Platform fees. Launch: 2.5% of the dev buy, charged by the program in the issue transaction, paid to the platform vault. Trading: 30% of the creator fees while the bond stands (70% after a break goes to the holders' pool, the rest to the treasury), and unclaimed holder-drop SOL after the window.

The coin's creator on pump.fun is the bond's Fees address, a program address. collect_fees pulls pump.fun's creator fee into it and sync_fees books every new lamport:

Fees follow the state at the moment they are booked, so the site books pending fees before a breaking release: fees earned while the bond was clean stay the dev's. claim_dev_fees and collect_treasury can be sent by anyone and pay only the dev and the treasury. After graduation, PumpSwap's permissionless transfer_creator_fees_to_pump first moves the pool's creator fees to pump.fun. Anyone can also collect PumpSwap creator fees straight to the Fees address as WSOL; unwrap_fees, which anyone can send, unwraps that WSOL into the Fees PDA so sync_fees can book it. The Unwrap + book fees button in My bonds does both.

VIIITrust score

The number printed on every certificate: trust = 100 x log10(1 + bond in SOL x lock in days) / log10(1 + 36,500), capped at 100. 100 SOL locked for 365 days is 100; 5 SOL for 30 days is 48; 0.5 SOL for 7 days is 14. The lock counts from launch to maturity, so an extension raises it, and a top-up raises it. It is computed by the site from the bond account; the program does not store it.

The medallion is engraved from the same two numbers: its guilloche is seeded by the mint address, and more trust means more rings and denser lines. The same bond always gets the same medallion; a broken bond is shown cracked, under the forfeit stamp.

IXParameters

Every bond copies these rules when it launches. Changing the config never changes a bond that already exists; each certificate is judged by the rules printed on it.

XProgram reference

Drop proofs can also fail with 7200 BadProof, 7201 AlreadyClaimed and 7202 IndexOutOfRange. The full interface is the IDL (Anchor 0.31).

XIVerify on chain

1. The program. Open it in any explorer: an executable account of the BPF Upgradeable Loader. Its history is every bond, observation, release and claim.
2. The bond. ["bond", mint] under the program. It holds the bond, maturity, floor and the last 6 observations the certificate prints.
3. The vault. ["bvault", bond] holds its rent minimum plus the bond while active; the rent minimum only once kept; rent minimum + pool - claimed - swept once broken. It has no private key.
4. The bag. The Escrow's Token-2022 account for the mint holds exactly the tokens the bond account says are in escrow.
5. The launch. Inside one Trustpad launch you see pump.fun create_v2 and buy_exact_sol_in, and the buyer is the Escrow.
6. The creator. The coin's bonding curve on pump.fun (["bonding-curve", mint]) names the bond's Fees address as creator.
7. The drop. Rebuild the root from /drops/<mint>.json with the leaf and node rules above and compare it with the root on the bond account.

XIIAdmin powers

The drop authority is copied into each bond at launch and chooses that bond's drop leaves. The chain checks the total and the snapshot slot, not who is in it; snapshots and trees are published so anyone can recompute them. Upgrades: the program is upgradeable by the project wallet; an upgrade could change any rule here, and every upgrade is public on chain.

XIIIRisks

• A bond covers the dev buy made at launch through the program. It does not cover coins the dev buys later from other wallets.
• Observations are spot prices. Whoever observes first in an interval picks the moment; a bundle of buy, observe, sell can lift one sample for the round-trip fees, and a clean release needs 6 such samples in a row. Holders can do the reverse to delay a clean exit, never to break a bond: only the dev can break it.
• The drop root is trusted to the bond's drop authority (see Admin powers). No posted drop means the pool stays in the vault.
• pump.fun can reassign a coin's creator (admin_cto, set_creator) and can change its program; observe relies on pump.fun keeping the curve account after migration.
• The program is tested end to end against byte-exact copies of mainnet pump.fun and PumpSwap, and it has not had an external audit. Post-migration fee collection was not exercised locally.
• Memecoins go to zero. A kept bond means the dev held; it does not mean the coin is worth anything.

XIVFAQ

Can the dev sell before maturity? Yes, by breaking the bond. The coins go to the dev and the whole bond goes to the holders, in the same instruction.

What if the market cap is below the floor at maturity? The dev can wait: the bond stays active and the coins stay in the escrow until 6 fresh observations at the floor make a release clean. Releasing anyway breaks the bond.

Who takes the observations? Our keeper, every hour, for every active bond. If it is late, anyone can press Take an observation on the certificate.

How do I claim from a broken bond? Connect the wallet that held the coin before the break. In Forfeits, the bond shows your share and a Claim button for 30 days after the drop is posted.

Why does a terminal show the coin as created by someone else? Terminals often show the wallet that paid for the creation. On chain the coin's creator is the bond's Fees address, and the dev's coins sit in the Escrow, not in the dev's wallet.

What happens when the coin graduates? Nothing changes for the bond. Observations read the PumpSwap pool instead of the curve.