Reviewed, then reviewed again.
The contract was put through an AI-assisted adversarial security review: three rounds, a final focused check, and a full launch rehearsal on a fork of mainnet. Every finding was resolved or is a documented design choice.
Method
Every finding had to survive a skeptic.
- Scoped reviewersIndependent reviewers, one per attack surface: access control, token handling, pricing, counting, governance, economic attacks, and the automation and website.
- Adversarial verificationA separate reviewer tried to refute every finding. Anything rated high had to be proven with a working exploit test against the real program and real pool data.
- Regression checksEach round re-checked every earlier finding against the code, not against the fix notes.
- Completeness criticA final reviewer each round looked for anything the others missed.
- Live rehearsalThe whole launch was run on a fork of mainnet: opting in, dividend sweeps, the daily count, the 30% switch, real buys against the $PENIS pool, pausing and settings changes.
Results
152automated tests, including one for every exploit found
0ways found, in any round, for anyone to take funds
| Stage | Scope | Outcome |
|---|---|---|
| Round 1: full review | The first complete contract, automation and website | Every finding addressed in a redesign |
| Round 2: full review | The shared multi-endowment contract, plus a re-check of every round-1 finding | 62 resolved, 12 accepted by design, 3 completed at launch |
| Round 3: targeted review | The new counting and pricing mechanisms | 21 resolved, 1 accepted by design |
| Final check | Every round-3 change, re-verified | All resolved |
| Launch rehearsal | Full launch on a fork of Solana mainnet, with the real tokens and pool | 7 of 7 steps passed |
Verified
What the contract guarantees.
- $PENIS never leavesNo function can move $PENIS out of the vault, or withdraw locked liquidity.
- Landlords keep what they holdThe endowment can only take new PUMP above the balance a landlord held when joining, and nothing else in the wallet.
- Leaving never depends on usRevoking works from any wallet, without this site.
- Changes are slow and publicSettings changes wait 72 hours and stay within hard limits written into the code.
- The pause is limitedIt lasts at most 7 days, can’t be renewed back to back, and can’t move funds.
- Safe tokens onlyEndowments can only be created for coins nobody can mint more of, freeze, or take back from wallets.
- Fair pricesBuys are priced against the pool’s own recent average and sized to its depth, so a trade placed just before a buy can’t push the price against the endowment.
Design choices
- The refresherAn automation key checks landlords before each daily count. It can’t move funds, its role is shown publicly for every endowment, and it can resign at any time.
- Counting is publicEach landlord’s counted $PENIS is on-chain and shown on the site, so any attempt to game the count is costly and visible.
- Outside token settingsPUMP and $PENIS each have a setting controlled by a third party. If either changes, the endowment pauses buying and sweeping on its own, and nothing is lost.
The code
The review covered commit 3bfce2c of the open-source contract. The deployed program will be a verifiable build of that code, so anyone can confirm what is running matches what was reviewed. Once the founders’ test is complete, the upgrade key is destroyed and the code can never change.