Security model

What's non-custodial, what the backend can and can't do, and the known limitations worth knowing about before you trust it with your SOL.

Signing never leaves your wallet

Every transaction is constructed in your browser and signed locally by your wallet extension. This site never has access to, stores, or transmits a private key or seed phrase. It only ever sees a public address and the signed transaction bytes your wallet hands back.

The backend has no custody

The backend's /api/transaction endpoint relays an already-signed transaction to the RPC node. Before broadcasting, it checks that every instruction in the transaction targets an allowed program (this program, System Program, Token Program, Associated Token Program, or Compute Budget) and rejects anything else. That check exists so the relay can't be repurposed as an open proxy for arbitrary signed transactions; it can't construct, modify, or sign anything on its own.

The house wallet is fixed, not an admin key

The jackpot's house-cut wallet is a plain constant compiled into the program. It can only ever receive lamports via the jackpot payout path. It has no special authority over the curve, the mint, or anyone's funds. See The Jackpot for how that payout works.

Known limitations

• Mint authority isn't revoked. The curve PDA keeps mint authority over the token indefinitely, because every buy/sell instruction already re-checks (via Anchor's account constraints) that the mint's authority still equals the curve PDA, and revoking it after the first mint would break every subsequent trade. Supply is fixed by construction instead: no instruction after the initial mint ever calls mint_to again, so no more tokens can ever be created even though the authority technically still exists.
• Rate limiting, not authentication. All API endpoints are public and unauthenticated, protected only by per-window rate limits. Don't rely on this backend as a source of truth for anything security-critical. The chain is the source of truth; the backend is a convenience index on top of it.
• Single RPC endpoint. The indexer and relay depend on one configured RPC provider. If it's down or rate-limiting you, reads and transaction submission degrade together.

Verify, don't trust

Every trade, every curve completion, and every jackpot payout is a real Solana transaction. You won't have to take this frontend's word for any of it. Once it's live, look up the curve account, the program's transaction history, or any specific signature on Explorer yourself. Not deployed yet, so there's nothing there to check right now.