Inside the protocol.

The initial raise

The initial token is CIPHER, ticker CIPHER, on Solana with six decimals. One lot is 10,000 tokens. Higher price limits rank first. Winners pay the lowest accepted price when supply is filled, otherwise the reserve. Ties use admission order, and a marginal bid may be partially filled.

The 24-hour window excludes bids at or after its closing timestamp. The 5 SOL limit is cumulative per wallet; it cannot prevent one person from using multiple wallets. Losing deposits and unused winning cover are refundable. Network fees are separate.

Start time, reserve, minimum raise, acquisition ceiling and delivery deadline must be committed before deposits open. The platform fee is fixed at 2%. The calculator’s reserve is an illustration; the first sale’s remaining economic limits are unset.

A floor for viability. Clear limits.

The soft cap is the minimum gross winning payments after clearing, before the platform fee. Deposits from losing bids and refundable cover do not count. If that threshold is missed, cancel before acquisition, return deposits in full and charge no platform fee.

An optional hard cap limits aggregate accepted deposits. A deposit that would cross it is rejected in full; reaching it never shortens the 24-hour window. This is a funding admission limit, not a token price or net-proceeds cap. It can favor earlier bidders and constrain price discovery. The initial raise has no selected soft-cap amount or hard-cap policy yet; these must be committed before opening.

The 2% platform fee is deducted from successful gross winning payments, rounded down once in lamports. It is not a surcharge on bidders, and refunds are excluded. For example, 100 SOL in winning payments leaves 98 SOL before inventory acquisition, network costs and any recovery reserve. Fee release requires verified delivery.

All collected platform fees are intended for future CIPHER buybacks and burns. That execution is not active. A reviewed fee vault, authorized spending policy, slippage limits and public purchase and burn receipts are required first. This policy promises neither a token price nor a return.

Your launch. Your keys.

The public launch intake lets creators choose an asset, destination, allocation, reserve, caps and delivery policy, then review and save a validated brief. The initial preset is a 24-hour SOL-funded token launch through Pump.fun. Other destinations remain planning options.

No private key, seed phrase, email or social login is requested. Saved briefs belong to the current browser session and expire after 24 hours; download the JSON to keep your own copy. Saving a brief does not publish an auction, authorize a transaction or establish ownership of an entered public wallet. Future execution must use explicit wallet signatures and reviewed escrow permissions.

Create. Acquire. Deliver.

Pump’s create_v2 creates a Token-2022 mint and a bonding curve. It does not accept an arbitrary presale allocation. CIPHER’s proposed solution is to create the curve and buy the required inventory atomically, then move those tokens to the designated inventory account in the same transaction.

The SDK reads Pump’s global reserves and fee configuration to estimate the purchase. It checks the expected 1B total supply and available inventory, imposes a maximum SOL cost and keeps refund liabilities and the 2% platform fee outside the acquisition spend budget. An unsigned instruction bundle is not an escrow contract or proof of settlement.

The remaining 500M tokens follow Pump’s bonding-curve and liquidity rules. They are not automatically owned by the CIPHER treasury. Later curve completion and migration depend on Pump’s rules and actual trading, not the auction closing time.

If the required inventory cannot be acquired within the committed budget, the launch must not proceed. Before launch, full deposits must remain recoverable. After acquisition, a reviewed distributor must deliver owed tokens; an operator cannot simply refund already-spent curve funds without a separate recovery reserve.

Working code, explicit boundaries.

The isolated Node SDK uses @pump-fun/pump-sdk 2.0.0, @solana/web3.js 1.98.4 and @solana/spl-token 0.4.15. It builds instructions without holding production keys. The web app never receives a mint signer or launches a token from a client-side timer.

const instructions = await PUMP_SDK.createV2AndBuyInstructions({
  global, mint, creator, user: payer,
  name: 'CIPHER', symbol: 'CIPHER', uri: metadataUri,
  amount: allocationAtomic, solAmount: quotedLamports,
  mayhemMode: false, holderReward: false,
});
// CIPHER additionally enforces the encoded maximum cost,
// reserves refunds, and appends the inventory transfer.
// Build, simulate and review before any signature.

const response = await fetch('/api/presale/preview', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    budgetSol: '1', maxLotPriceSol: '0.002',
    lots: 500, demand: 150,
  }),
});
// Synthetic demand. Does not submit a bid or move funds.
const preview = await response.json();

Wallets and privacy

Solana wallet-standard discovery and injected EVM discovery are connection diagnostics. The Solana ownership proof signs an expiring, origin-bound message and verifies its Ed25519 signature server-side. It does not authorize a deposit, grant token approval or prove that a wallet can complete the auction.

Authenticated MPC settlement and private funding remain separate engineering work. Arcium bid-encryption helpers do not establish operator-blind privacy on their own. The initial raise is denominated in native SOL. No private payment or cross-chain route is currently enabled for this raise.

Five gates before opening

01 / Commit the terms

Finalize reserve, minimum raise, fees, inventory ceiling, delivery deadline and failure policy. Publish immutable metadata using the fingerprint logo at an unauthenticated public URI.

02 / Secure the funds

Implement and independently review the native SOL escrow, cumulative wallet caps, bid admission and authenticated clearing. The existing development escrow is not this auction.

03 / Automate the launch

Connect an operator signer and durable job state to the reviewed program. Simulate before submission, reconcile signatures after timeouts and reuse one committed mint on retries. Do not create a second token after an uncertain result.

04 / Prove delivery

Verify custody, distribute exactly the winning amounts, preserve refunds and prove conservation under retries, partial failure and downtime. Define a funded recovery policy for a failure after acquisition.

05 / Rehearse and release

Run the complete funded devnet lifecycle, physical Phantom/Solflare mobile signing, adversarial contract tests and independent security review. Verify monitoring, incident response and recovery before mainnet activation.

The artwork and launch brief are ready for review. They do not establish that a live launch is production-ready.