Security
What you trust
| You trust | For |
|---|---|
| pump.fun's program and fee sharing | Pricing and custody on Solana, the split of creator fees |
| The Pons contracts | Pricing and custody on Robinhood Chain |
| The Glint contracts | The launch on Pons, the vault, the fee split on that side |
| The keeper | The launch sequence, the maker, the pool's wallets |
See the operator and the trust model for the last line.
What the contracts prevent
- Anyone but the keeper launching or trading through the launcher and the vaults.
- A vault sending funds to any address other than the pool, except the creator's payout in
split(). - A vault spending more than its cash.
- A vault being initialized twice.
- Reentrancy on every function that moves value.
- A launch with a creator fee above 10 % or a payout share above 100 %.
What the contracts do not prevent
- The keeper trading badly, or its key being lost or stolen.
- The pool losing value through the maker's trades.
- Anything on Solana, where Glint has no custom program.
Attacks considered
| Attack | Defence |
|---|---|
| Sandwiching a maker trade | Each trade carries a minimum output, the simulated output minus 1.5 %, and the maker stops at the target |
| Pushing one curve to drain the pool | The maker only buys the cheap side or sells inventory and never chases a price beyond the target. The pool's allocation per coin caps the loss |
| A manipulated rate | The rate is the median of three sources and the keeper does not trade when they disagree by more than 2 % |
| Griefing the launch | The sequence is checked step by step and the deposit is refunded if the launch cannot complete |
| Fake coin pages | The launcher's list is on-chain and the coin page lists both token addresses |
| Anti-sniper window on Pons | The launcher and the vault are exempted at launch so the maker's first buys are not taxed |
| Keeper downtime | Prices drift until it comes back, nothing else breaks. The monitor shows the age of the last update |
| A runaway keeper | Guards cap each trade, each tick and each coin's cash, and a KILL file stops everything |
Reading, not trusting
The numbers in these docs can be read from the chains. See verify on-chain.
Audit
The Robinhood Chain contracts are small but hold money. They are tested on a fork against the real Pons (see test results). An independent audit comes before the first coin, and the report will be linked here. The keeper has no audit. Until both exist, do not send funds to any Glint address. See status.