Security
What the admin can and cannot do.
The protocol authority can
- Update the
GlobalConfigdefaults (fees, shares, supply, curve parameters, ceilings). Changes apply to future launches only. - Transfer authority with a two-step handover (propose, then the new authority accepts) — e.g. to a multisig.
- Pause trading, sweeps, graduation and harvesting for at most 7 days at a time, followed by a mandatory 7-day cooldown before another pause. Pausing new launches (which hold no user funds) is open-ended. Pausing never moves funds.
The protocol authority cannot
- Withdraw from any Sweep Vault, CreatorFeeVault, bonding curve or GraduationVault.
- Change an existing launch's collection, destination, fees, max NFT price or intervals.
- Raise any trade fee above the 5% hard ceiling.
- Withdraw locked PumpSwap LP principal.
- Mint tokens or freeze accounts — the mint authority is revoked at launch and no freeze authority exists.
Trust assumptions
- Program upgrades. Whoever holds the program's upgrade authority can deploy new code. Check the upgrade authority of the program address below on an explorer before relying on these guarantees.
- External programs. Sweeps depend on Tensor Marketplace and Metaplex Core; graduation and harvesting depend on PumpSwap.
- Off-chain services (indexer, keeper, this website) hold no funds. If they stop, the protocol keeps working and anyone can submit the permissionless instructions.