Pip

One person, one ticket, one trade.

Pip is a token launchpad on Solana. While a token is on its bonding curve, every single buy and sell has to be made by a person. Here is exactly how that is enforced, what it stops, and what it does not.

What happens when you trade

  1. You enter an amount and press Buy or Sell. A quick human check (Cloudflare Turnstile) appears.
  2. Our verification service confirms the check, looks at the live chain state, and signs a small ticket: your wallet, this token, this exact amount, your trade counter, and an expiry about a minute away.
  3. Your wallet signs a transaction that carries the ticket. The program checks the ticket on-chain before any SOL or tokens move.
  4. On success your trade counter increases, so the same ticket can never be used again.

What the program enforces, on-chain

  • No ticket, no trade. Transactions without a valid ticket from an active signer are rejected. There is no allowlist and no exception for the team.
  • Tickets are single-use and bound. Wallet, token, side, amount, counter and expiry are all part of what is signed. Change any of them and the ticket is invalid.
  • No programs in the middle. Trades must come directly from a wallet. Routers, aggregators, bundlers and flash-loan contracts cannot reach the curve.
  • Human-speed limits. A few slots between trades per wallet, a cap per trade and per wallet, and stricter caps in the first minutes after launch. The creator sets these inside protocol bounds; the program applies them.
  • Fair start. Creators can delay the opening by up to ten minutes. Their own first buy is capped at 5% of supply and goes through the same rules.

What this stops

Snipers buying in the creation block. Bundles and sandwiches. Bots looping buy–sell to fake volume. Wallets farmed by scripts. Each of these needs automation the gate takes away: a bot cannot sign a ticket, cannot reuse one, and cannot route around the direct-call rule.

What this does not stop

A person paying other people to solve checks is slow and expensive, not impossible. Rate limits, proof-of-work for datacenter traffic and per-wallet caps make it uneconomic, not mathematically impossible. We say this plainly rather than promise otherwise.

What the operator can and cannot do

The verification service decides whether to issue a ticket, so in principle it could refuse one. It cannot move your funds, change your trade, or trade on your behalf. Every rule the program applies is public, every configuration change emits an on-chain event, and the service keeps a hash-chained audit log of what it issued and refused. If the service is down, trading pauses until it is back; sells are never paused by routine operations.

Fees and graduation

Trades on the curve pay a 1% fee, split half to the token creator and half to the protocol. When about 85 SOL has been raised, the curve is full: the raised SOL and the remaining tokens are moved into a Meteora DAMM v2 pool whose liquidity is permanently locked, and the token trades there openly — with no human check. The pool charges a high fee in its first minutes (so bots cannot cheaply snipe the fresh pool) and settles at 1%; the creator keeps earning half of the locked-liquidity fees. The creator can also confine the pool's liquidity to a price band; the token page says so when that is the case.