From auction to Pump.

A floor for viability. Clear limits.

The soft cap is the minimum gross winning payments after clearing, before the platform fee. Deposits from losing bids and refundable cover do not count. If that threshold is missed, cancel before acquisition, return deposits in full and charge no platform fee.

An optional hard cap limits aggregate accepted deposits. A deposit that would cross it is rejected in full; reaching it never shortens the 24-hour window. This is a funding admission limit, not a token price or net-proceeds cap. It can favor earlier bidders and constrain price discovery. The initial raise has no selected soft-cap amount or hard-cap policy yet; these must be committed before opening.

The 2% platform fee is deducted from successful gross winning payments, rounded down once in lamports. It is not a surcharge on bidders, and refunds are excluded. For example, 100 SOL in winning payments leaves 98 SOL before inventory acquisition, network costs and any recovery reserve. Fee release requires verified delivery.

All collected platform fees are intended for future CIPHER buybacks and burns. That execution is not active. A reviewed fee vault, authorized spending policy, slippage limits and public purchase and burn receipts are required first. This policy promises neither a token price nor a return.

Your launch. Your keys.

The public launch intake lets creators choose an asset, destination, allocation, reserve, caps and delivery policy, then review and save a validated brief. The initial preset is a 24-hour SOL-funded token launch through Pump.fun. Other destinations remain planning options.

No private key, seed phrase, email or social login is requested. Saved briefs belong to the current browser session and expire after 24 hours; download the JSON to keep your own copy. Saving a brief does not publish an auction, authorize a transaction or establish ownership of an entered public wallet. Future execution must use explicit wallet signatures and reviewed escrow permissions.

Create. Acquire. Deliver.

Pump’s create_v2 creates a Token-2022 mint and a bonding curve. It does not accept an arbitrary presale allocation. CIPHER’s proposed solution is to create the curve and buy the required inventory atomically, then move those tokens to the designated inventory account in the same transaction.

The SDK reads Pump’s global reserves and fee configuration to estimate the purchase. It checks the expected 1B total supply and available inventory, imposes a maximum SOL cost and keeps refund liabilities and the 2% platform fee outside the acquisition spend budget. An unsigned instruction bundle is not an escrow contract or proof of settlement.

The remaining 500M tokens follow Pump’s bonding-curve and liquidity rules. They are not automatically owned by the CIPHER treasury. Later curve completion and migration depend on Pump’s rules and actual trading, not the auction closing time.

If the required inventory cannot be acquired within the committed budget, the launch must not proceed. Before launch, full deposits must remain recoverable. After acquisition, a reviewed distributor must deliver owed tokens; an operator cannot simply refund already-spent curve funds without a separate recovery reserve.

Working code, explicit boundaries.

The isolated Node SDK uses @pump-fun/pump-sdk 2.0.0, @solana/web3.js 1.98.4 and @solana/spl-token 0.4.15. It builds instructions without holding production keys. The web app never receives a mint signer or launches a token from a client-side timer.

const instructions = await PUMP_SDK.createV2AndBuyInstructions({
  global, mint, creator, user: payer,
  name: 'CIPHER', symbol: 'CIPHER', uri: metadataUri,
  amount: allocationAtomic, solAmount: quotedLamports,
  mayhemMode: false, holderReward: false,
});
// CIPHER additionally enforces the encoded maximum cost,
// reserves refunds, and appends the inventory transfer.
// Build, simulate and review before any signature.

const response = await fetch('/api/presale/preview', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    budgetSol: '1', maxLotPriceSol: '0.002',
    lots: 500, demand: 150,
  }),
});
// Synthetic demand. Does not submit a bid or move funds.
const preview = await response.json();

Five gates before opening

01 / Commit the terms

Finalize reserve, minimum raise, fees, inventory ceiling, delivery deadline and failure policy. Publish immutable metadata using the fingerprint logo at an unauthenticated public URI.

02 / Secure the funds

The native SOL prototype enforces funded admission, wallet caps and timeout refunds in compiled local-VM tests. Its settlement path is disabled. Authenticated private clearing, on-chain acquisition and independent review remain required.

03 / Automate the launch

The devnet coordinator validates signed instructions and auction context, journals before sending and reconciles identical retries. Connect an authentic settlement verifier, creator-controlled signer and reviewed funding path. There is no active launch scheduler or mainnet execution switch.

04 / Prove delivery

Verify custody, distribute exactly the winning amounts, preserve refunds and prove conservation under retries, partial failure and downtime. Define a funded recovery policy for a failure after acquisition.

05 / Rehearse and release

Run the complete funded devnet lifecycle, physical Phantom/Solflare mobile signing, adversarial contract tests and independent security review. Verify monitoring, incident response and recovery before mainnet activation.

The artwork and launch brief are ready for review. They do not establish that a live launch is production-ready.