> ## Documentation Index
> Fetch the complete documentation index at: https://docs.justpump.fun/llms.txt
> Use this file to discover all available pages before exploring further.

# Transparency and Security

> All trades are on-chain with deterministic fee distribution and auditable logic

## Transparency

JustPump is built on principles of **radical transparency**. Every operation is verifiable on-chain, ensuring users can trust the platform without relying on opaque backend processes.

### All Trades Are On-Chain

* Every buy, sell, and swap executes through Solana smart contracts
* Transaction details are permanently recorded on the blockchain
* Anyone can verify trades using Solana block explorers
* No hidden or off-chain order matching

<Info>
  You can verify any JustPump transaction by searching the transaction signature on [Solscan](https://solscan.io) or [Solana Explorer](https://explorer.solana.com).
</Info>

### Deterministic Fee Distribution

Fees are calculated and distributed in a **fully deterministic** manner:

* Fee percentages are hardcoded in smart contracts
* Distribution happens automatically on every trade
* No discretionary fee allocation by the team
* All fee recipients are publicly known addresses

<Note>
  See the [Fees Overview](/fees) page for complete breakdowns of how fees are calculated and distributed.
</Note>

### Auditable Reward Logic

While reward eligibility is calculated off-chain for flexibility:

* All payouts are on-chain and verifiable
* Signed vouchers prevent unauthorized claims
* Vault balances are publicly visible
* Historical claim data is recorded on the blockchain

***

## Security

JustPump implements multiple layers of security to protect users and their funds.

### Minimal On-Chain Logic

The smart contracts follow a principle of **simplicity**:

* Only essential logic lives on-chain
* Fewer lines of code = smaller attack surface
* Easier to audit and verify correctness
* Lower gas costs for users

<Warning>
  Complex logic introduces bugs and vulnerabilities. JustPump keeps on-chain code minimal and well-tested.
</Warning>

### Signature-Based Authorization

Sensitive operations use **cryptographic signatures** for authorization:

* Reward vouchers signed by authorized backend key
* Claims verified on-chain before execution
* Prevents unauthorized withdrawals from vaults
* Public key is published for verification

### Replay Protection

All signature-based operations include **replay protection**:

* Unique identifiers for each voucher
* Tracking of claimed vouchers on-chain
* Expiration timestamps prevent stale claims
* Prevents double-spending and duplicate claims

### Rate Limiting and Abuse Detection

Backend systems monitor for suspicious activity:

* Unusual trading patterns flagged for review
* Claim attempts tracked to prevent abuse
* Rate limits on sensitive operations
* Automated alerts for anomalies

<Tip>
  While these protections are implemented off-chain for flexibility, all enforcement actions result in on-chain state changes that are publicly auditable.
</Tip>

***

## Anti-Rug Mechanisms

JustPump includes built-in protections against rug pulls and market manipulation.

<CardGroup cols={2}>
  <Card title="10% Sell Limit" icon="shield-halved">
    You can only sell up to 10% of circulating supply per transaction. Large holders must split sells across multiple transactions, making their actions visible and giving the community time to respond.
  </Card>

  <Card title="Permanent Liquidity Lock" icon="lock">
    After graduation, LP tokens are minted directly to the pool's PDA and cannot be withdrawn. This ensures liquidity remains locked forever—no rug pull risk.
  </Card>

  <Card title="Mint Authority Revocation" icon="ban">
    When tokens graduate, the mint authority is revoked. No new tokens can be minted, preventing supply inflation attacks.
  </Card>

  <Card title="Canonical Pools Only" icon="certificate">
    Only the launchpad program can create canonical AMM pools via CPI. This prevents fake pools from being created to confuse traders.
  </Card>
</CardGroup>

### How the 10% Limit Works

Before every sell transaction on the bonding curve:

```
max_sellable = (tokens_sold × 1000) / 10000  // 10% of circulating supply
require(tokens_to_sell <= max_sellable)
```

This is enforced on-chain in the smart contract—no way to bypass it.

### Why Permanent Liquidity Lock Matters

Traditional AMMs allow liquidity providers to withdraw their LP tokens, removing liquidity and crashing the price (a "rug pull"). JustPump eliminates this risk:

1. When a token graduates, LP tokens are minted to the pool's **Program Derived Address (PDA)**
2. There is **no instruction** in the smart contract to withdraw these LP tokens
3. The pool PDA has no signing authority other than the program itself
4. Result: Liquidity is **permanently locked** and cannot be removed

<Info>
  This is a unique architectural decision that prioritizes community protection over liquidity provider flexibility.
</Info>

***

## Smart Contract Architecture

### Two-Program Design

JustPump uses a **Cross-Program Invocation (CPI)** architecture:

1. **Launchpad Program**: Manages token creation and bonding curve trading
2. **AMM Program**: Handles graduated token swaps with constant product formula

When a token graduates, the launchpad program calls the AMM program via CPI to create the canonical pool. The AMM validates that the caller is the authorized launchpad program before proceeding.

### PDA-Based Security

All critical accounts use **Program Derived Addresses (PDAs)**:

* Seeds are deterministic and public
* No private keys control PDAs (only the program can sign)
* Eliminates private key compromise risk
* Prevents unauthorized account access

Example PDA derivations:

```
GlobalConfig: ["global"]
Coin: ["coin", mint_pubkey]
BondingCurve: ["bonding-curve", mint_pubkey]
Pool: ["pool", base_mint, quote_mint]
```

### Checked Arithmetic

All mathematical operations use **checked arithmetic**:

* `.checked_add()`, `.checked_mul()`, `.checked_div()`
* Overflows/underflows cause transaction failures instead of silent errors
* Prevents integer overflow attacks
* Ensures calculations are always correct

<Warning>
  Integer overflow vulnerabilities have been exploited in many DeFi hacks. JustPump uses Rust's checked arithmetic throughout to prevent this entire class of bugs.
</Warning>

***

## User Security Best Practices

While JustPump implements platform-level security, users must also protect themselves:

### Wallet Security

<CardGroup cols={2}>
  <Card title="Use Hardware Wallets" icon="microchip">
    Store significant funds in hardware wallets like Ledger. Hot wallets are convenient but vulnerable to malware.
  </Card>

  <Card title="Verify Addresses" icon="magnifying-glass">
    Always verify token mint addresses before trading. Scammers create fake tokens with similar names.
  </Card>

  <Card title="Check Signatures" icon="signature">
    Review transaction details in your wallet before approving. Never blindly approve transactions.
  </Card>

  <Card title="Revoke Permissions" icon="xmark">
    Regularly audit and revoke token approvals you no longer need. Use tools like Solana token approval managers.
  </Card>
</CardGroup>

### Trading Security

* **Start small**: Test with small amounts before trading large volumes
* **DYOR**: Research tokens before trading—even on JustPump, memecoins are risky
* **Beware of hype**: Artificial hype and coordinated pumps are common—trade cautiously
* **Watch for red flags**: New tokens with low activity may be manipulation targets

<Tip>
  JustPump protects against platform-level risks, but cannot eliminate memecoin market risks. Always trade responsibly and only with funds you can afford to lose.
</Tip>

***

## Audits and Code Review

### Current Status

* Smart contracts are **open source** (repository available on request)
* Code follows Anchor Framework best practices
* Extensive integration test suite

### Planned Security Measures

* Professional third-party audit before mainnet launch
* Bug bounty program for responsible disclosure
* Ongoing security monitoring and updates

<Note>
  If you discover a security vulnerability, please report it responsibly to [security@justpump.fun](mailto:security@justpump.fun). Do not disclose publicly until the issue is resolved.
</Note>

***

## Incident Response

In the event of a security incident:

1. **Immediate Detection**: Monitoring systems alert the team to anomalies
2. **Rapid Response**: Team investigates and determines severity
3. **User Communication**: If users are affected, announcements via official channels
4. **Mitigation**: Smart contract upgrades (if needed) or user guidance
5. **Post-Mortem**: Transparent report on what happened and how it was resolved

<Info>
  JustPump commits to transparent communication during security incidents. Users deserve to know what happened and how the platform is responding.
</Info>

***

## Decentralization and Control

### Current Architecture

* Smart contracts are deployed by the JustPump team
* Backend systems (reward calculations, voucher signing) are centralized
* On-chain operations are permissionless—anyone can trade

### Progressive Decentralization

As the platform matures:

* Smart contract upgrade authority may transition to multi-sig or DAO governance
* Backend logic may become more transparent or decentralized
* Community input on platform evolution

<Warning>
  JustPump is currently a semi-centralized platform. The team has control over backend systems and smart contract upgrades. Use accordingly.
</Warning>

***

## Transparency Reports

JustPump publishes regular transparency reports covering:

* Total trading volume
* Fee distributions by recipient
* Vault balances (Cashback, Airdrop)
* Reward distributions
* Platform metrics

<Card title="View Transparency Reports" icon="chart-bar" href="https://justpump.fun">
  Access historical data and platform statistics on the JustPump dashboard
</Card>

***

## Questions About Security?

If you have security questions or concerns:

* Visit the [FAQ](/faq)
* Contact [support@justpump.fun](mailto:support@justpump.fun)
* Report vulnerabilities to [security@justpump.fun](mailto:security@justpump.fun)