exploit

ONE AGENT ON PUMP.FUN, READ FROM THE PROGRAM

Reads the program before it moves. Shows every number it found.

exploit decodes pump.fun's own accounts and instructions for this coin and runs fixed mechanisms against what they say.

escrow

READ FROM THE VAULT ACCOUNT

The agent's program owns one vault per coin. Creator fees arrive there. The vault pays out only through four instructions, each of which can only be called when a stated on chain condition is true. There is no admin withdraw. There is no timer. The conditions are trades.

vault

address
authority
balance
fees received
fees re-entered
counter buys spent
refunds paid
phase

reflux

Creator fees accrue to the vault with every trade. The reflux instruction claims them and buys the coin on the curve, but it can only be called when the curve's real sol reserve is below the reserve recorded at the last reflux. That means the vault only buys after sells have pulled the reserve down past the previous entry. Each lamport entering a lower reserve moves price by more than it would at a higher one. Dumps fund entries, and entries happen at local lows by construction, not by prediction.

allowed(reflux) = real_sol_now < last_reentry_real_sol
on success:      last_reentry_real_sol = real_sol_now
                 fees_reentered += amount
                 reflux_count += 1
creator fee arrivesreal sol below last entry?buy on curverecord reserve as last entryyesno
re-entries
tokens acquired
last entry real sol
real sol now
allowed now

bundle counter

When the dossier flags a bundle the keeper calls the record instruction with the bundle's slot and wallets. The program stores the position. From then on, any sell by a recorded wallet enables the counter instruction, which buys from the vault an amount equal to a fixed fraction of what that wallet just sold, and reduces the stored exposure by the sold amount. The fraction is fixed in the program and shown below. The counter cannot be called without a matching sell in the same or previous slot.

allowed(counter) = sell by bundle wallet in slot s or s-1
amount           = sold_sol * counter_fraction_bps / 10000
exposure        -= sold_tokens
bundles tracked
exposure remaining
counter buys
counter buy sol
counter fraction

fee refund

The protocol fee pump.fun collects on a buy is a known number: the fee rate times the sol sent. The refund instruction returns exactly that number to the buyer from the vault. It becomes callable for a given buy only after a fixed count of sells by other wallets have landed on the curve while the buyer's token balance has not decreased. The count is checked against the trade history the program has recorded, and the buyer's balance is read from their token account at call time. A buyer who sold forfeits the refund for that buy.

refund_amount          = sol_in * fee_bps / 10000
allowed(refund, buy b) = sells_by_others_since(b) >= refund_sell_count
                         and balance(buyer) >= tokens_out(b)
paid
paid sol
pending
sell count required

migration control

The curve completes when its real token reserve hits zero, and the program then moves the liquidity to its pool. Whoever sends the buy that crosses the line decides when that happens. The vault keeps a migration reserve for that purpose. The crossing instruction can only be called when the dossier's recorded bundle exposure is under a maximum share of supply and the share of fresh, sniper and bundle wallets among all classified wallets is under a maximum. Both maximums are stored in the vault and shown here. When the conditions fail and the curve is within the final stretch, the hold instruction sells vault tokens into the curve to keep the reserve under the threshold until they pass.

sol to threshold
migration reserve
bundle exposure max
bundle exposure now
fresh share max
fresh share now
crossing allowed now
bundle exposurefresh share

phase

After completion the agent reads the pool account instead of the curve and keeps the same mechanisms running against pool trades: reflux buys through the pool at reserve lows, counter buys against recorded bundles, refunds of the pool's fee on the same count rule. The dossier keeps classifying. This page reads the vault's phase byte and shows which account it is watching.

phase
watching