Security and trust

PLEDGE asks backers to trust nothing beyond the program's code. This page lists what the program checks and what it does not.

What is enforced

• The bonus exists before any pledge. create_campaign moves the whole deposit into the vault in the same transaction that creates the campaign.
• Pledges cannot leave early. There is no withdraw instruction. Money in the vault leaves only through claim_backer, claim_creator, settle (the fee) and close_campaign.
• Refunds always fit. The vault holds every pledge plus a deposit that covers every bonus it promised: bonus_owed <= bonus_deposit because early pledging is capped at bonus_deposit / rate. A fuzz run of 400 random campaigns per seed checks after every transaction that the vault equals an independent model and holds at least everything still owed.
• Late pledges earn nothing. eligible_part returns 0 at or after early_end. Tested at one second before the window closes (earns 20%), at the boundary and 21 pledges after (earn 0).
• No dilution. Each backer's bonus is rate x own early amount, fixed at pledge time. A property test checks that any sequence of later pledges leaves an earlier backer's bonus unchanged.
• Money goes only to its owner. Claims are permissionless, but claim_backer pays only the backer's own token account and claim_creator only the creator's (WrongRecipient otherwise).
• No admin outcome. settle is a comparison: total_pledged >= goal. Nobody can mark a campaign succeeded or failed.

The one admin step

init_config runs once at launch, signed by the program's upgrade authority, to name the PLEDGE mint, its Raydium pools and the waiver size. It cannot touch campaigns or vaults.

Creator self-pledging

A creator could pledge to their own campaign from other wallets to use up the early cap before honest backers arrive. This cannot reduce any bonus already earned. The room left (early_cap - early_pledged) is public, and min_eligible lets a backer refuse a pledge that would land without the bonus they saw. A creator's own pledges also count toward the goal and pay the 2% fee if the campaign succeeds.

The burn crank

crank_burn spends at most 0.1% of the pool's reserve per call and must receive at least 98% of the pool's own 30-minute time-weighted price, so moving the price before the call makes it revert instead of paying a sandwich.

Testing

35 tests: 8 host tests on the money rules, 27 LiteSVM tests on the mainnet SPL Token, Token-2022 and Raydium CP-Swap binaries, including a fuzz run. A local validator run covered all 10 instructions in 28 transactions. cargo clippy -D warnings is clean; cargo audit shows no vulnerabilities in program logic.