pump.fun

The traffic sample has no transactions for this instruction, so no replay model could be checked. Everything known about it comes from the bytecode alone. This handler does not show how other instructions use the stored reserves value.

ref. sample_transactions: available=0; fn_0c6d6

Discriminator 74dc6b53bf2c2049 is dispatched in the binary but is not in the published IDL. It takes (mint: Pubkey, reserves: u64) and replaces the u64 stored next to that mint in QuoteControl.mints without any bounds or sanity check. The old and new values go into an emit_cpi event (discriminator a9 43 27 6d 66 86 b6 e8). It needs a signature from one of three keys: QuoteControl bytes 40..72 (reserves admin), QuoteControl bytes 8..40 (admin), or Global.authority. The mint must already be listed (error 6068 otherwise). It moves no funds.

ref. fn_25ba1 (handler), fn_1b71f pc 1b7d3-1b806 (3-way authority check, error 6000), fn_0ccc6 pc cd17 (write), error 0x17b4 at pc cd08

On a sell hop, the gross quote is floor(vq*amt/(vt+amt)). The creator fee and the protocol fee minus its buyback share (Global buyback_bps = 5000) are not transferred out. They stay in the curve's quote vault until the hidden sweep instructions pay them out. The final output goes to a destination token account whose mint must equal the last hop's output mint (error 6098); its owner is not checked against the user. Validation errors: 6020 (amount 0), 6027 (remaining accounts not a multiple of 5), 6106 (flag count or value invalid), 6024 (fees exceed gross).

ref. fn_1341e, fn_109ae, fn_0f8d7, fn_0a8d6 pc a9e1; tx 5VP2yfS3nMY6GU1D (vault -3019, gross 3029)

multi_hop_curve_swap (discriminator e19a7516d756f667) is missing from the IDL. Each hop takes one caller-supplied flag byte. Bit 0 turns the protocol fee on, and bit 1 turns the creator fee on. Any value from 0 to 3 is accepted, so a caller can pass 0 and trade through curves with no protocol or creator fee. In the observed tx the flag was 2: only a 30 bps creator fee (10 units) was charged and no protocol fee, even though fee_config sets 95 bps. Nothing in the code limits who may pass a given flag value; the only signers required are user and source_authority.

ref. fn_0b251 pc b40c-b40e ([-2584] = flags & 1 gates protocol fee at b54e), pc b267 (flags & 2 gates creator fee at b552); tx 5VP2yfS3nMY6GU1D event fee=0, creator_fee=10

The only arguments are amount_in (u64) and the fee-flag vector. There is no minimum-output check. The result is returned via set_return_data as (amount_out, total). In the sample, the outer router (MultiHopSwap / MultiHopJupiterSell) called the instruction by CPI, and that router must enforce slippage. Anyone calling it directly can be sandwiched.

ref. fn_24670 arg parsing (u64 + Vec<u8>), fn_0a8d6 end (only the destination-mint check, 6098), fn_32db9 return data

The published IDL does not include the instruction with discriminator a1c3dea5e165c03e. It overwrites QuoteControl.reserves_admin (data[40..72] of PDA "quote-control") with any pubkey the caller passes in, and nothing checks that value. The signer must be either QuoteControl.admin (data[8..40]) or Global.authority (Global data[9..41], currently d3bb8cab…02aa). Otherwise the call fails with error 6000. Because the global pump.fun authority can always override this role, the role is not independent of the protocol admin.

ref. fn_1b988 pc 1ba3c-1ba6a (two memcmp checks, fn_2ac31(0) → 6000); fn_0c868 pc c86c-c87b (write); global serializer fn_00e52 pc e91 (struct+0x108 = first pubkey after `initialized`)

The handler makes no transfers. It writes the new value and emits an Anchor event (disc 21a95c57b6b3fb43) holding the quote_control key, the authority, the old and new reserves admin, and the unix timestamp. The event goes out through sol_log_data and again through an emit_cpi self-invoke signed by the "__event_authority" PDA. Account constraints: global and quote_control seeds are verified, quote_control must be writable and owned by the program with discriminator c9a2d5c1ee23f438. No mainnet calls appear in the sample.

ref. fn_0c868 pc c8d0 (event disc), c8fb (log), c9cf (invoke_signed); fn_1b988 pc 1bb58 (ConstraintMut 2000), 1ba83-1bb7e (seed checks)

On SOL curves, if the creator vault holds less than the rent-exempt minimum for a 0-byte account (890,880 lamports), the payer sends it that full minimum through a System Program transfer before the fee moves. On token curves the code creates the curve and recipient quote ATAs if they don't exist (fn_029be, which looks like an idempotent create), with rent paid by the payer. The payer gets nothing back. These are small costs for whoever runs the crank.

ref. fn_0dda2 pc dff0-e046 (Rent minimum_balance(0), fn_10f5c system transfer payer->recipient)

The sweep code points to a newer BondingCurve layout. It has a quote_mint field (default key = SOL, otherwise an SPL/Token-2022 mint with its own curve ATA) and two fee counters, one for creator fees and one for protocol fees. Fees build up on the curve and are swept out later by SweepCreatorFee or SweepProtocolFee, not paid on every trade. Any curve smaller than 166 bytes is resized up to 166 bytes, with the caller (payer) covering the extra rent.

ref. fn_1d135 pc 1d3a9 (quote_mint constraint), fn_076ea (realloc to 0xa6), fn_0dda2 pc dfe2 (SOL vs SPL branch)

The binary has SweepCreatorFee (disc 20f6bf3408c949ba), which the published IDL does not list. It reads a creator-fee counter stored on the bonding curve, sets it to zero, and moves that amount to the creator-vault PDA (["creator-vault", bonding_curve.creator]). This is lamports for SOL curves, or the quote token via transfer_checked for curves priced in another token. Anyone can call it: the recipient is checked against the derived vault (ConstraintSeeds), so a caller cannot redirect the funds. No mainnet calls were seen in the sample.

ref. fn_247c1 / fn_0dda2 pc ddcc (creator-vault PDA check), pc ded8 (read+zero bc+120), fn_12196 transfer

sweep_protocol_fee (disc 0830be07b644b7e5) is not in the published IDL. It has no authority signer: any payer can call it. Funds can only go to a recipient that passes require_valid_fee_recipient (fn_078ef). That means global.fee_recipient or one of global.fee_recipients[7], or for mayhem-mode curves one of the 8 reserved fee recipients. Anything else fails with error 6000, and the default pubkey is rejected too. So the Global authority, through whatever instructions set those recipient lists, decides where all accrued protocol fees end up.

ref. fn_2472e (handler), fn_0dda2 pc dda0-ddc8 and de66, fn_078ef pc 78fb-7956

The v3 trade paths only count part of the protocol fee in a bonding-curve field (in-memory offset +128); they don't pay it out. sweep_fees reads that whole amount, sets the field to zero, then moves it. On SOL curves (curve.quote_mint == default) it moves lamports straight out of the program-owned curve account, with no rent-exemption check. On token-quoted curves it does a transfer_checked from the curve's quote ATA, signed with the PDA seeds ["bonding-curve", base_mint]. Each sweep emits an event through event_authority.

ref. fn_0dda2 pc de6f-de72, e00d, de82; fn_12196; fn_1202e pc 12034-1206a

Before sweeping, fn_076ea grows the bonding curve account to at least 166 bytes, with the payer funding the extra rent through the system program. On token-quoted curves, fn_029be is called twice to create-idempotent the bonding curve's quote ATA and the recipient's quote ATA, also paid for by the payer. Whoever calls this may therefore pay rent on top of the transaction fee, while the swept fee goes to the protocol recipient.

ref. fn_076ea pc 77723-7755 (0xa6), fn_0dda2 pc df72, df9e

Discriminator 209a98db8e6cdaa5 is dispatched to fn_2391e but missing from the published IDL. It requires the Global.authority signer (custom error 6000 otherwise) and writes the raw u8 argument to Global.max_curve_depth (account byte 1087) with no bounds check and no event emitted, so the change can only be seen by diffing the account. The current on-chain value is 1. A related CurveDepthExceeded error exists, which suggests the value limits some curve operation, but I did not confirm where it is enforced.

ref. fn_2391e pc 23946-2394f (arg byte stored at Global+0x438, then serialized by fn_00e52 at pc f72); auth check fn_2bd2c pc 2be41; Global 4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf byte 1087 = 0x01

net = floor(in*10000/(10000+p+c)); each fee = ceil(net*bps/10000). FeeConfig 8Wf5TiAh... sets 95/30 in every tier. Curves can store their own creator_fee_bps (curve 3JyMSMDN... stores 100), which global can allow to override. buyback = floor(protocol_fee*buyback_bps/10000) (global buyback_bps = 5000) goes to the fee recipient. The rest of the protocol fee and the whole creator fee are kept in the bonding curve's quote balance (curve fields +120/+112) and moved later by the hidden sweep_protocol_fee / sweep_creator_fee instructions.

ref. fn_0f91f, fn_109ae, fn_1093e, fn_136f2; tx 3kT6Ua69hwnrfqZz: in 495000000, curve +492677778, recipient +2322222

If the user equals a pubkey stored in global (struct offset 0x288), compute_trade_fees returns zero fees and the whole spend becomes curve input. That key is also treated differently when deciding whether a partial fill is allowed. Whoever controls the global authority (upgrade authority 7gZufwwA...) decides which key gets this privilege.

ref. fn_0f803 pc f816; fn_2835c pc 283a2 / 2845a; fn_0fd9b pc fe13

Discriminator e1f7501ed5b38488 sends 17 accounts and (spendable_quote_in, min_tokens_out, optional bool) to fn_2453d. In the traffic sample it is the most-used buy instruction (67 calls), on both SOL-quoted and PUMP-quoted curves. Often an aggregator spends the exact output of an earlier swap in the same transaction, so the user's quote balance can net to zero. Integrators relying on the published IDL cannot decode these trades.

ref. fn_2453d, fn_2835c; tx 3kT6Ua69hwnrfqZz (event ix_name "buy_exact_quote_in")

The discriminator 1c92de7726c469d5 dispatches to a SellV3 handler that isn't in the published IDL, yet it shows up in mainnet traffic (27 sampled calls, often routed through Jupiter). It takes 17 accounts and two u64 args (amount, min_quote_out). It also supports SPL quote mints such as the pumpCmXq-quoted curves: the bonding-curve PDA signs the quote payouts. Integrators that rely on the IDL can't decode it.

ref. fn_245e9 (log "Instruction: SellV3"), fn_28613 trade_v3.rs; tx 54n5pTCA3WX1ZFdk

compute_trade_fees compares the creator against three pubkey constants in the binary (0x1ac310, 0x1ac0d0, 0x1ac370), which select different fee fields. If a global flag is set and the curve stores a nonzero creator-fee bps, that value replaces the fee_config value. The PUMP-quoted curve in the samples charged 100 bps instead of 30. Sellers can't tell the effective creator fee from fee_config alone.

ref. fn_109ae pcs 109e9-10a01, 10a42-10a49; TradeEvent in tx 54n5pTCA3WX1ZFdk (creator_fee_bps=100)

Protocol fee = ceil(gross × 95/10000) and creator fee = ceil(gross × 30/10000) by default, both from fee_config. The fee recipient receives floor(protocol_fee × global.split_bps/10000), where split_bps is currently 5000 (global raw offset 997). The remainder and the whole creator fee are left in the curve account and recorded in curve fields, to be swept by the hidden sweep_protocol_fee / sweep_creator_fee instructions. So the curve's lamport or token balance is higher than its real reserves. If a curve flag (struct offset 154) is set, the recipient gets nothing and the whole fee is retained.

ref. fn_136f2 (reads global+1048, divides by 0x2710); tx 4z1FNFQT5c: fee 1367674, recipient +683837

On buy_v3 the user pays 0.95% protocol fee and 0.30% creator fee, both rounded up. floor(protocol_fee × Global.buyback_bps / 10000) is sent to buyback_fee_recipient. buyback_bps is 5000 today (Global raw offset 998). The remaining protocol fee and the whole creator fee are moved into the bonding-curve account and counted in curve fields (+120 protocol, +112 creator). They are paid out later by the hidden sweep_protocol_fee / sweep_creator_fee instructions. So curve lamports are more than the real quote reserves, and creators are not paid at trade time.

ref. fn_136f2 pcs 136f8-13776; event in tx mYuVnKQYcPKfFKHt (fee 5,027,074, buyback 2,513,537, creator_fee 1,587,497)

Discriminator 07051dc4f5176550 dispatches to fn_24491 ("Instruction: BuyV3"), which is not in pump.fun's public IDL but runs on mainnet. It takes (amount u64, max_quote_cost u64, optional bool clamp) and 17 accounts, including a quote mint, quote token accounts and a buyback_fee_recipient. It shares its account validation (fn_1f826) with the also-hidden buy_exact_quote_in_v3 and sell_v3.

ref. fn_24491 pc 24496 log string; fn_1f826 account names; tx mYuVnKQYcPKfFKHt

Fee rates come from the pfee fee_config account, whose admin can change the tiers. Every tier is 95/30 bps today. The buyback share comes from Global.buyback_bps, set by update_buyback_config. The program itself can be upgraded by 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8. The max_quote_cost slippage check (error 6002) protects buyers if fees change before their transaction lands.

ref. fn_0f803/fn_13496 fee-tier lookup; fn_136f2 reads global[1048]; fn_28189 pc 282e7

admin_cto is signed by global.admin_set_creator_authority. It takes optional new_creator, creator_fee_bps and is_holder_reward, and writes them to a token's bonding_curve and fee-sharing config. It also touches creator vaults and the migrated pump_amm pool. So creator-fee income for any coin can be redirected by this admin key ("community takeover"). set_creator and migrate_bonding_curve_creator are related creator-management instructions gated by set_creator_authority.

ref. fn_24ef8 (handler_admin_cto), IDL accounts for admin_cto; fn_16026 validator string 'admin_set_creator_authority'

pump.fun is deployed under the upgradeable BPF loader. Its upgrade authority is 7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8. That key can replace all program logic at any time, including the curve math, fees and where funds go. Every guarantee described here holds only for the current deployment.

ref. program_overview: loader=upgradeable, upgradeAuthority=7gZufwwAo17y5kg8FMyJy2phgpvv9RSdzWtdXiWHjFr8

These handlers are not in the IDL: set_max_curve_depth, sweep_protocol_fee (disc 0830be07b644b7e5), sweep_creator_fee (disc 20f6bf3408c949ba), set_quote_control_reserves_admin, set_quote_control_mint_reserves, buy_v3, buy_exact_quote_in_v3, sell_v3 and multi_hop_curve_swap. The v3 trade instructions carry real traffic: buy_exact_quote_in_v3 appeared 67 times and sell_v3 27 times in a 400-transaction sample. The two sweep handlers (sweep_fees.rs) move accumulated protocol/creator fees out of bonding-curve quote vaults and the creator-vault. Their validator (fn_1d135) takes a 'payer' plus global/base_mint/quote_mint, and I have not yet confirmed who is allowed to call them.

ref. fn_2472e, fn_247c1, fn_1d135, fn_0dda2; fn_2453d, fn_245e9, fn_24491, fn_24670; program_overview txCount

The authority stored in Global can call set_params (args: virtual/real reserves, total supply, fee_basis_points, creator_fee_basis_points, withdraw_authority, enable_migrate, pool_migration_fee, set_creator_authority, admin_set_creator_authority). It can also call set_reserved_fee_recipients, update_global_authority, toggle_create_v2, toggle_mayhem_mode, toggle_cashback_enabled, update_creator_fee_config, update_buyback_config, add/remove_quote_mint and set_virtual_quote_reserves. Global (4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf) currently stores authority bytes d3bb8cab…ddac02aa at offset 9 and fee_basis_points = 95 at offset 113. The initial curve values are 1.073e15 virtual tokens, 30 SOL virtual SOL, 7.931e14 real tokens and 1e15 total supply. As read so far, there is no on-chain cap on the fees the authority can set (not yet verified in the handler).

ref. fn_23d06 (handler_set_params); Global account 4wTV1YmiEkRvAtNtsSGPtUrqRYQMe5SKy2uB4Jjaxnjf data offsets 9, 73-113