thesis
A mint that is its own market, its own treasury, and its own central bank.
Every token here prints itself, sells itself, buys itself back, and destroys what nobody wanted — under rules committed on-chain before a single unit existed. Earned revenue is split 60/40 to two addresses compiled into the program.
read this first
What is actually guaranteed by code: revenue leaves a pair through exactly one instruction, distribute. It re-derives both payees from compile-time constants and splits 60/40. There is no instruction that sends a pair-held token to a caller-chosen address — the one that did (sweep) was removed. distribute is permissionless, so the recipient can crank their own payout without the operator.
What is not guaranteed: the program is upgradeable and the operator holds the authority. Every sentence above describes the current binary and can be replaced. That is the whole of the residual risk, and no amount of program design removes it.
The two SOL paths, stated exactly. close_position and sweep_lamports return SOL to a receiver the caller names. Both are gated: the signer must be the pair creator or the recovery authority, so a stranger cannot call either. What they move is position rent and the lamports the operator funded for swap-route accounts — capital the operator put in, not revenue the pairs earned. Revenue is tokens, and tokens have exactly one exit.
What the record actually shows. Over its first run this system distributed $0, sank $329 in pool rent that cannot be recovered, and burned $260 of $TOKEN. 85 of 248 pools ever traded. Mispriced pools traded at 71%, correctly-priced ones at 21% — most volume was arbitrageurs picking off a pricing bug, not organic demand. Sitting live for four hours after liquidation it took zero swaps. The mechanism below is real; the demand for it is unproven.
tl;dr — three depths
ELI5
Imagine a vending machine that makes its own snacks.
It puts snacks on the shelf for free — it can make as many as it likes. People pay real money for the ones they want. At the end of the day the machine takes the leftover snacks off the shelf and throws them in the bin, so the only snacks that exist are the ones someone actually bought.
The money goes in a box with two taps and no lid. It can only come out through the taps, and the taps are set: 60 pence of every pound to one person, 40 to the other. Nobody can add a third tap or move where they point without rebuilding the machine in public.
There are eight machines. They all sell to each other and to the outside world, so there's always someone to trade with. Every sale charges a small toll, and the toll goes in the same box, out the same two taps.
ELI18
It's a token that runs its own order book, with free inventory and a hard-coded printer.
Normal market makers buy inventory before they can quote. This one mints it: supply comes from nothing, gets placed as one-sided asks in its own AMM pools, and costs zero capital to offer. Nobody can front-run it out of business because it never needs to buy in.
The catch that usually makes this a scam is unlimited dilution. One rule stops it, and it used to be two.
- Provisional emission. Whatever the market doesn't buy gets pulled back and burned. Net new supply always equals net demand, so dilution is bounded by realized demand rather than by promise.
- The per-epoch emission cap is no longer enforced. It was, and
cap_per_epoch is still written in every pair account — but emit stopped checking it, deliberately, and the field is retained only so the existing 157-byte layout does not move. Gross emission is now unbounded within a cycle. Provisional emission still bounds the net.
All revenue lands in accounts owned by a program-derived address. Exactly one instruction moves it out — distribute — and it pays a fixed 60/40 to two addresses fixed in the binary. The creator cannot redirect it, cannot vary the ratio, and cannot pay themselves the whole thing. Anyone can call it, so the recipient never has to ask.
Every trade pays a 600bp toll straight to the pool's sole LP, which is the token itself.
ELIVitalik
Seigniorage as a protocol primitive, with the mint authority held by a constitution instead of a key.
The design collapses issuer, market maker, and treasury into one on-chain object. Mint authority, metadata update authority, LP-position ownership, and every treasury account resolve to a single PDA whose entire action surface is the program's instruction set — so "monetary policy" is not a governance norm, it is the set of state transitions that exist.
The interesting property is provisional emission. Supply is minted into a pair-owned treasury and placed as single-sided concentrated liquidity strictly on one side of spot. Because a CLMM range above spot can only hold the base asset, the placement is a pure ask ladder — issuance and price discovery are the same operation. At cycle end the unfilled remainder is withdrawn and burned, so Δsupply ≡ absorbed. Dilution is bounded by realized demand rather than by promise. Note the gross bound is gone: emit no longer enforces cap_per_epoch, so within a cycle creation is unbounded and only the burn-back constrains the net.
The anti-rug property is structural, not social: no instruction transfers a pair-owned token to a caller-nominated destination. Every destination is re-derived — from seeds while the asset is working, from compile-time constants when it is paid out. Assets can change form (liquidity, fees, swaps) and can leave only through the 60/40. Two honest exceptions: closing a position refunds rent, and the auth PDA's own lamports can be drained, both to a receiver the caller names. Those are operator capital, not earned revenue. And all of it holds exactly as long as the upgrade authority does.
Counterparty topology is a star with $TOKEN pinned as anchor a in every fan, so any asset routes to any other in ≤4 hops, and cross-pair hub mints are admitted as counter-assets by proof — the program verifies a Pair account it created itself — rather than by curation.
The primitives
| name | what it is |
|---|
| pair | Two Token-2022 hub mints under one constitution. Mint 1 faces the outside world; mint 2 is the interior unit of account. Epoch length is set at creation and is immutable. cap_per_epoch is also written at creation but is no longer read by emit — present in the layout, absent from the rules. |
| emit | Permissionless. Mints up to the cap into the pair's own treasury. Anyone may run the schedule; nobody may exceed it. |
| ladder | Single-sided concentrated liquidity, placed strictly on one side of spot. Zero capital: the pair offers supply it minted, and only receives. |
| smash | Emit + place across 2+ pairs atomically, in one transaction. The graph dislocates everywhere in the same slot, so no leg can be picked off while another is still forming. |
| cycle | expand → smash ×N → withdraw → burn unsold → collect → redeploy → distribute 60/40. The full economy tick. Distribution runs every pass even if an earlier phase fails, so revenue cannot quietly accumulate unpaid. |
| retire | Permissionless. Burns hub supply from the treasury. A stranger cranking it is donating deflation — it cannot touch a holder's balance. |
| anchors | A 32-slot ring of admitted counter-assets, rotated as trending changes. Delisting used to strand liquidity — eviction made 25 funded positions unwithdrawable and took a redeploy to free. Admission is now checked on the way in only; the exit path never consults the ring. |
What is deliberately absent
Each absence is load-bearing. Together they are most of the design.
- No discretionary withdrawal. No instruction moves a pair-owned token to an address the caller picks. Revenue exits only through the fixed 60/40; anchor assets and LP positions otherwise stay in. Position rent and the auth PDA's lamports are the stated exceptions.
- No freeze authority. Set to
None at creation. Nobody can ban a holder, ever.
- No transfer hook. Holder transfers stay cheap and aggregator-routable; enforcement lives at settlement, never at transfer.
- No execute-as-authority. A constitution with an escape hatch is a discretionary printer with extra steps.
the honest limit
The program is upgradeable. Every guarantee above is enforced by code that the upgrade authority can replace. The claims on this page become literally true — rather than conditionally true — the day that authority is revoked or timelocked. Until then, read them as a description of the current binary, not a promise about the next one.
Where the money actually comes from
Not from nowhere. Three sources, and it's worth being exact because "infinite money printer" invites the wrong reading:
- Seigniorage — every unit printed and absorbed is dilution of existing holders, converted into real assets. This is the big one.
- The toll — 600bp on flow, paid to the pool's sole LP, which is the pair itself. Protocol fee on our configs is 0, so the whole rake lands.
- Volatility — reconciliation between venues, taxed on the way through.
Which means the printer's real throughput limit is demand. Printing into no bids just burns rent and gas and hands arbitrageurs a free option. Cycles harvest demand efficiently; they don't manufacture it.
That limit is not theoretical. Refilling a sold-out ladder costs ~0.0068 SOL and cannot be topped up in place — once price trades through a range it wants the counter asset and the venue refuses more base. So rent scales with how well the thing works, and in the first run two thirds of it bought nothing. Rent, not fees, is the structural cost: transaction fees across 6,782 program calls totalled 0.0536 SOL, while pool rent totalled 3.42 SOL and none of it comes back.
How to verify any of this
program 5Hn6DXAuPFTyP9vUHK8rNZKCPuJ46vHtSCyv37rzGBcZ
fee tier GS2MReVw3yYtVz9xF3x5N49GceZ3TxpJepc8gyDczaQT (128 spacing, 600bp)
anchor a EVULoNF4DeMBN4dGiZiDfpiiTfNZgoCvXWWgaV3epump ($TOKEN)
Every number on the graph is read live from chain — supplies, treasuries, emission counters, pool prices, vault balances. The edge set is derived by scanning which auth PDA holds which position NFT, so there is no registry to fall out of sync and no file that can lie about what exists.