exploit

ONE AGENT ON PUMP.FUN, READ FROM THE PROGRAM

Reads the program before it moves. Shows every number it found.

exploit decodes pump.fun's own accounts and instructions for this coin and runs fixed mechanisms against what they say.

method

FIXED RULES, ALSO ENFORCED IN THE PROGRAM

The agent is a set of rules against a public program. It does not forecast. It reads state that already exists and acts only where the rules say an action is permitted. Every rule here is also enforced in the program, so the keeper that signs transactions cannot do anything this page does not describe.

reading the curve

The bonding curve account is derived from the mint with the seed string bonding-curve under the pump.fun program. It is read with a confirmed commitment and decoded by byte offset. The global account under the seed string global holds the fee rate and the initial reserves every curve starts with. Neither account can be changed by anyone but the pump.fun program. Reading them is free and permissionless.

decoding trades

pump.fun emits a trade event on every buy and sell. The event is written into the transaction as a self call to the program with a fixed discriminator, and also into the log as program data. The agent decodes the event bytes directly: mint, sol amount, token amount, side, user, and the four reserves after the trade. From the post trade reserves and the amounts it reconstructs the pre trade reserves and recomputes what the curve formula would have returned. The difference between that and the actual token amount is the gap.

classifying wallets

2 columns

A wallet's first transaction is found by paging its signature history to the oldest entry. The funder is the account in that first transaction whose balance fell by the most, excluding the wallet itself. Classification is then one pass through the following rules, first match wins.

classrule
bundleappears in a slot with three or more buys from three or more distinct wallets on this coin
sniperfirst trade on this coin is fewer than 10 slots after the curve was created
freshfirst transaction ever is fewer than 5000 slots before its first trade on this coin
linkedfunded by a wallet that has itself traded this coin
exchangefunded by a known exchange hot wallet
seasonednone of the above

dust

Integer division discards a remainder. On a buy the program computes the new token reserve as k over the new sol reserve, rounded up by one, which gives the buyer slightly fewer tokens than the real number would. The discarded part scales with the remainder of k modulo the new sol reserve. By choosing sol amounts where that remainder is near zero, the agent's buys lose almost nothing to rounding, while ordinary buys lose a fraction of a token each. Over many trades the difference between the agent's effective price and the average effective price of other trades is the harvested dust. It is reported in tokens and in the sol those tokens are worth at the curve price.

reflux

The reflux rule is one comparison: the current real sol reserve must be below the reserve recorded at the last reflux. The first reflux after deployment has no prior record and is allowed at any reserve. Each reflux records the reserve it entered at. The effect is that the vault only ever adds sol to the curve at a reserve lower than its previous entry, which is a lower price than its previous entry.

counter

A recorded bundle wallet selling is the only event that enables a counter buy. The counter buys a fixed fraction of the sol the bundle wallet just received. The purpose is not to defend a price. It is to make the bundle's exit fund the vault's position at the exact price the bundle exited at.

refund

A refund is the exact protocol fee of one buy, computed from the sol sent and the fee rate at the time, paid from creator fees. It becomes available after a fixed count of sells by other wallets, and only if the buyer's token balance has not fallen below the tokens that buy returned. The sell count is the clock. No wall clock time is read anywhere in the program.

migration

Completion is a buy that empties the real token reserve. The vault holds sol for that buy. It may send it only when two conditions read true at call time: recorded bundle exposure as a share of supply is under the stored maximum, and the share of fresh, sniper and bundle wallets among classified wallets is under the stored maximum. The second condition is read from an account the keeper updates from the dossier, and the keeper's update is itself constrained to counts it can prove with trade signatures. When the conditions fail and the curve is within the final stretch, the hold instruction may sell vault tokens into the curve, but only enough to keep the reserve under the threshold, never more.

findings

A finding is text plus proof. The keeper submits the sha256 of the text and either a transaction signature or an account address. The program stores them under an index. Nothing about the text can be changed afterward. The text itself is published on the findings page, and anyone can hash it and compare.

what the agent never does

It never sends a transaction that the program would reject. It never holds a key that can move the vault outside the four instructions. It never acts on a timer. It never reads a price from anywhere but the curve or pool account it is watching. It never classifies a wallet by anything other than the rules on this page.