Who controls what
Pop Launch is not trustless while a key can upgrade the program. This page says exactly who holds which power, and what each key cannot do.
Program upgrade authority
- Held by
- One key, the owner's wallet jNdwn3…tnx. No multisig.
- Can
- Replace the program code.
- Cannot
- This is the one key that could change escrow rules, and it is a single key held by the owner, not a committee. Upgrades will be announced before they happen, and the authority will be set to none once the mechanism has run unchanged for a disclosed period.
Protocol authority
- Held by
- The same owner wallet
- Can
- Change the terms for new launches; pause new launches; hand this role to another key.
- Cannot
- Cannot touch an existing launch: its terms are copied into the launch at opening. Cannot stop settlement, claims or refunds. Cannot move any SOL or tokens.
Creation-fee recipient
- Held by
- The owner's wallet jNdwn3…tnx
- Can
- Receives the creation fee (0 during the opening 24 hours, then 0.1 SOL).
- Cannot
- Nothing else.
Settlement keeper
- Held by
- A fee wallet run by Pop Launch
- Can
- Submits the public settlement instruction for filled launches.
- Cannot
- No privilege at all: anyone can submit the same instruction from the launch page. If the keeper is down, settlement is late, not lost; after 60 minutes backers refund.
Raydium
- Held by
- External program
- Can
- Runs the pool; its admin sets fee tiers and can pause new pool creation. The tier used charges 0.25% per trade plus a 0.05% "creator fee" that Raydium pays to the pool creator.
- Cannot
- Has no access to pooled assets. The pool creator is the launch's program account, which nothing can collect from, so the 0.05% is uncollectable by anyone, Pop Launch included. A launch that cannot create its pool refunds.
Creator of a coin
- Held by
- Any wallet
- Can
- Picks the name, ticker and image; pays the creation fee and setup reserve; backs on the same terms as anyone.
- Cannot
- Gets no tokens, no fee from backers, cannot cancel, extend or change a launch, cannot rename or re-image the coin after opening.
Addresses on mainnet-beta
Every address a launch depends on is fixed at opening and verified live before any cluster goes public (verify:addresses in the repository).
- Pop Launch program
- Gj6B3nfzze1aZyYkmrk21LymU4oo1BFDEpa1s6NG2MXy
- Raydium CP-Swap
- CPMMoo8L3F4NbTegBCKVNunggL7H1ZpdTHKxQB5qKP1C
- Raydium pool-creation fee receiver
- DNXgeM9EiiaAbaWvwjHj9fQQLAX5ZsfHyvmYUNRAdNC8
- Token Metadata program
- metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s
- Wrapped SOL
- So11111111111111111111111111111111111111112
What every coin gets, automatically
- The whole supply is minted into program vaults when the launch opens, then the mint authority is revoked. No freeze authority is ever set.
- Token metadata is written once, immutable, with the launch itself as its update authority.
- Backed SOL sits in a launch-specific escrow that only the program can move, and only into the pool or back to the backer.
- At settlement every LP token the pool issues is burned in the same transaction. Nobody can withdraw the pooled SOL and tokens.
The full disclosure, including the mainnet multisig once it exists, is maintained in the repository as docs/authority-disclosure.md. See also How it works and the Terms.