DDocs

How raids work

Every coin launched here is a vault with a keep of SOL. Holders of one coin raid another coin's keep; the target's holders defend. The loot moves from keep to keep and is only ever spent on buying the coin back and burning it. No wallet is ever paid loot.

1. 01 · LaunchA coin becomes a vault70% of its creator fees fill its keep, forever.
2. 02 · DeclareA holder declares a raidBond posted, the target is warned, prep runs.
3. 03 · BattleCrews commit tokensAttack wins at 1.25x the defense. Loot moves keep to keep.

• 01Overview
• 02The keep
• 03A raid, step by step
• 04Power and the price feed
• 05Worked example
• 06Buyback and burn
• 07Launching a vault
• 08Transactions
• 09Parameters
• 10Program reference
• 11Verify on chain
• 12Admin powers
• 13Risks
• 14FAQ

01Overview

Heistpad is a Solana program (Heist46B2L5u4oDxcGwTRSRgy7dvoVDhTSmgLGvtSAjC) on top of pump.fun. A coin launched through it is a normal pump.fun coin whose creator is a program account (the coin's Fees account). The creator fees it earns are split on chain: 70% into the coin's keep, 20% to the dev, 10% to the treasury.

The keep has exactly two ways out: a buyback (the keep buys the coin on its own market and burns every token it bought) and loot taken by a winning raid, which goes into the attacker's keep. The program has no instruction that sends keep SOL or loot to a wallet.

The site reads everything from chain. The district's tower heights and lit floors are the keeps; the streams of points are running raids.

02The keep

Every keep satisfies, at all times: keep = rent floor + from fees + loot in + bonds in + donated − loot out − bought back. The vault panel on the site shows exactly these lines. A raid can never take a keep below its rent floor plus 0.1 SOL.

03A raid, step by step

Outcome

• Fizzled if the attack's power is below 0.25 SOL. The bond goes to the target's keep.
• Attack won if attack ≥ defense × 1.25. Loot moves from the target's keep to the attacker's keep.
• Defended otherwise. No loot moves.

Loot

loot = min( available × 20% × attack / (attack + defense), available − 0.1 SOL ), where available is the target keep above its rent floor at settle. A narrow win takes less than a crushing one.

Burns

Committed tokens sit in the raid's escrow until settle. The losing side's escrow is 20% burned, the winning side's 5% (a fizzle counts as a defense win). Every crew gets back exactly floor(amount × (1 − burn)).

After a raid

Only a target that lost a raid is shielded, for 24 h. A target that held (or saw the raid fizzle) gets no shield but a repel: the next raid on it costs twice the bond, and so on up to x32. The attacking coin rests for 6 h after every raid, fizzles included. Times count from the raid's end. The bond goes back to the declarer unless the raid fizzled.

04Power and the price feed

Power is measured in SOL at the moment a commit lands: what the tokens would sell for at the coin's 30-minute median price, and never more than they would sell for right now.

• Sell value is pump.fun's constant-product quote minus its 1.25% fee, stacked: as if the tokens already in this side's escrow were sold first. Splitting one bag into many commits gains nothing.
• Median price: the median of every price reading of the last 30 minutes. A commit needs at least 7 readings spanning at least 15 minutes (StaleMedian / ShortPriceHistory); the vault panel shows the feed as 7 cells, says "warming up" while the span is short, and offers to add a reading. Anyone can add one (observe, at most one per minute per coin); the keeper adds one every minute during raids.
• Readings are clamped: each reading is stored at most 10% away from the median of the 7 before it, so a pump bundled around a reading moves the series slowly.
• Pumping a coin right before committing buys nothing: the pool is valued as if it sat at the median price, and the lower of that and the live sale value counts.
• Every commit carries a minimum power (the site sets 97% of its estimate): if the price moves before it lands, it is refused instead of counting for less.

05Worked example

With the default parameters. The target's keep holds 10 SOL above its floor. The attack commits tokens worth 6 SOL of power, the defense 4 SOL.

Had the defense committed 5 SOL, the line would be 6.25 SOL and the attack (6) would have failed: nothing moves, the attackers lose 20% of their tokens, the defenders 5%.

06Buyback and burn

Anyone can trigger a coin's buyback once per 1 h. It spends 10% of the keep, never more than 0.5% of the market's SOL reserves (keeping 0.01 SOL of rent headroom, at least 0.01 SOL), buys the coin on pump.fun (or PumpSwap after migration) through a program account, and burns every token it bought in the same instruction. It refuses when the live price is more than 3% above the median of the last 7 readings (PriceAboveMedian), when those 7 readings disagree by more than twice that (PricesDisagree), and while the coin is under attack (KeepFrozen). The admin can only ever tighten a coin's buyback settings (tighten_buyback).

07Launching a vault

Name (up to 32 bytes), ticker (up to 10 characters), a picture and an optional first buy (none, 0.5, 1, 2 or 5 SOL on the site). The program creates the coin on pump.fun with its Fees account as the creator and makes your first buy in the same instruction. The launch fee is 2.5% of the first buy, on top, to the treasury; no first buy, no fee. You also fund the rent floors of the coin's Fees and keep accounts (about 0.002 SOL).

The program refuses a mint that has a freeze authority or any extension that could move escrowed tokens (UnsafeMint).

08Transactions

Every action on the site is one transaction you sign, simulated first so a failing one never reaches your wallet. launch, declare, commit and buyback must be alone in their transaction (only compute budget and SOL transfers may join), so no trade can be bundled next to them. The site resends the same signed transaction every 2 seconds until it lands and asks you to sign once more only if the network let it expire.

09Parameters

Read from the program's config now (this network). A coin copies the parameters at launch, a raid at declare: changes only apply to coins launched and raids declared afterwards.

10Program reference

Accounts

Errors

The site shows these messages when the program refuses a transaction. Rendered from the program's IDL.

11Verify on chain

1. Open the program in an explorer: Heist46B2...AjC. The IDL the site uses is at /idl/heist.json.
2. Pick any coin and read its Coin account. Check the keep equation from section 02 against the keep account's balance.
3. Add up loot_in and loot_out over every coin: the sums are equal, so loot only ever moved keep to keep. /stats does this sum live.
4. Open any settle transaction: the only SOL movements are keep to keep (loot) and the bond (to the declarer or the target's keep).
5. Open any buyback transaction: the Buyer account buys, burns every token it bought, and returns what it did not spend to the keep.

12Admin powers

As with every program on this pad family, the program's upgrade authority can upgrade it. An upgrade is a public on-chain transaction.

13Risks

• Capital decides. Outcomes follow committed value. A whale can win a raid; the 1.25 defender bonus, burns on both sides and the loot cap are what keep it a game.
• Your tokens are at stake. Committed tokens are locked until settle, and the losing side loses 20% of them to the burn (the winning side 5%).
• Price manipulation. A bundle can bias a price reading, but each reading is clamped to 10% of the recent median, commits need 15 minutes of history and value tokens at the median, so a short pump buys nothing but its fees.
• Dumping the other coin. Selling the target coin before defenders commit lowers their sell value. The dumper pays for the dump; commits already made keep their power.
• Fizzle griefing. Anyone holding 0.1% of some coin can lock a target for prep plus battle with a raid nobody joins. It costs the bond (doubling with every repel in a row), which goes to the target's keep, and puts the attacking coin on rest.
• Stale feed. Without readings, commits and buybacks are refused until 7 exist; a raid on an unobserved coin can fizzle.
• pump.fun powers. pump.fun's own admin tools can redirect a coin's creator fees; the keep then stops filling. Nothing already in a keep or escrow is at risk.
• Loot reaches sellers over time. Keeps buy their coin on the market, so whoever sells into a buyback receives that SOL. Buybacks are capped, hourly and permissionless, so nobody has a privileged seat.

14FAQ

Program Heist46B2...AjCBack to the districtStatsLog