Docs · Protocol

Security & verification

Check every claim yourself: the programs, their authorities, a quote's config, a launch's vault, and the events it emits.

The checklist

The Backstock program 69H4…8Yzq ↗ is deployed and executable.
The venue is Raydium LaunchLab LanM…J3uj ↗ and, after graduation, Raydium CPMM CPMM…KP1C ↗.
A launch’s quote is enabled by its config at ["quote", quote_mint], which holds the raise bounds, the vault floor and the LaunchLab global config for that quote. Each change emits QuoteConfigured.
launch creates the coin and buys the bundle in one instruction of one transaction, so the launch transaction is the coin’s first trade. Its Launched event records the raise, the launch fee, the bundle’s quote and tokens and the vault’s quote.
The quote vault and token vault are owned by ["authority", launch]: only the program can sign for them, through the agent trades, collect_fees, payout_backers, claim_backer_fees, wind_down, admin_withdraw_vault and dev_withdraw_vault.
The launch account’s terms hold the fee split, the payback rule, the vault floor and the agent limits you backed under.
The platform account’s admin is the only key that can call admin_withdraw_vault, and its fee_recipient is where those withdrawals go; its dev_authority is the only key that can call dev_withdraw_vault, which pays the dev key itself (admin GU47…HtDT ↗, recipient FNFM…daKX ↗, dev key Bbui…Bo4M ↗).
Every vault movement is an event: Trade (venue 0 = curve, 1 = CPMM), Graduated, CreatorFeesCollected, BackersPaid, BackerFeesClaimed, WoundDown, VaultWithdrawn (admin) and VaultWithdrawnByDev (dev key). Withdrawals are listed on the launch page and at /api/launches/:mint/activity?type=vault_withdrawn.

Program deployed
Executable, upgradeable loader
69H4…8Yzq
Upgrade authority
Held by the platform admin key (a single key at launch; it is also the program's upgrade authority)
GU47…HtDT
Mint and freeze authority
Each coin is created by Raydium LaunchLab with a fixed 1,000,000,000 supply; check its authorities on the explorer
Launch authority
One per launch, derived from the launch: owns its quote vault and token vault · withdrawals only by the admin key or the dev key, each an on-chain event
Terms frozen per launch
Creator-fee split, payback rule, agent limits, vault floor and launch fee, copied into each launch account at creation
Agent authority
Can only sign agent_buy, agent_sell and payout_backers, within each launch’s frozen limits; every trade is a Trade event
D1Mv…xd6d

Read live from mainnet on the server; each tile links to the account.

Verified quote mints

Quote	Mint
SOL (WSOL)	So1111…111112 ↗
USDC	EPjFWd…yTDt1v ↗
SPYx	XsoCS1…BbDF2W ↗
NVDAx	Xsc9qv…mx9qEh ↗

QQQx, TSLAx, AAPLx and MSTRx are enabled the same way. Compare any quote chip’s mint with the issuer’s published address before backing; the QuoteConfigured events are the authoritative list.

Derive the accounts yourself

TypeScript · @solana/web3.js

import { PublicKey } from "@solana/web3.js";
import { getAssociatedTokenAddressSync, TOKEN_2022_PROGRAM_ID } from "@solana/spl-token";

const PROGRAM = new PublicKey("69H4mKjPcR3Ncsk8orfSDAx6UDWz98szmFm3L4qU8Yzq");
const pda = (...seeds: (Buffer | Uint8Array)[]) => PublicKey.findProgramAddressSync(seeds, PROGRAM)[0];

const launch = new PublicKey("<launch>");
const quoteMint = new PublicKey("<quote mint>");
const authority = pda(Buffer.from("authority"), launch.toBuffer()); // owns both vaults
const mint = pda(Buffer.from("mint"), launch.toBuffer());           // the coin
const quoteConfig = pda(Buffer.from("quote"), quoteMint.toBuffer());
const tokenVault = getAssociatedTokenAddressSync(mint, authority, true, TOKEN_2022_PROGRAM_ID);
// quote vault: getAssociatedTokenAddressSync(quoteMint, authority, true, <the quote's token program>)

Every instruction

InstructionWho can callWhat it can move

Raise

create_launchCreatorCreate fee (SOL) → fee recipient; rent → the launch; opens the raise
Opens a raise in one allowlisted quote asset (SOL, USDC or a tokenized stock), within that quote's raise bounds: min and max raise, per-wallet cap, deadline, optional whitelist. Pays the flat SOL create fee, funds the rent for the launch's accounts, creates its quote vault, and freezes the launch fee, agent limits, creator-fee split, payback rule and vault floor into the launch. Fails if the platform's terms changed after you signed.
depositAnyone (whitelisted wallets, when the raise has a whitelist)Your quote → the launch's quote vault
Joins the raise as a backer, in the launch's quote asset. Deposits are clipped to the room left under the max raise and the per-wallet cap.
cancel_launchCreatorNothing — opens full refunds
The creator can abort a raise before it launches. Every backer can then refund 100%.
refundBackerYour deposit → you, in the quote asset
Returns the full deposit when the raise missed its minimum by the deadline, was cancelled, or met it but wasn't launched within 3 days of the deadline.

Launch and venue

launchCreator once the minimum is met; anyone once the deadline passed or the raise is fullRaise → 1% launch fee → treasury; coin created on LaunchLab; bundle buy + reserve → vault
In one instruction: pays the launch fee in the quote asset, creates the coin on Raydium LaunchLab quoted in that asset (1,000,000,000 supply, 79.31% of it sold on the curve), then makes the bundle buy from the raise at the opening price, before any public trade can exist. The bundle takes at most 75% of supply and never completes the curve. Its tokens and the unspent quote go into the vault; that total is what went in at launch, the base of the payback rule.
graduateAnyoneNothing — records the CPMM pool
Once Raydium has migrated the completed curve to a CPMM pool (graduation, at the same price), records that pool on the launch so the vault agent and fee collection use it from then on.

Vault agent

agent_buyAgent authorityVault quote → LaunchLab curve or CPMM pool; tokens → vault
Buys back dips with the vault's quote: only at least the band under the EMA, at or below the vault's average cost (or a buy-back below its average sell), within the window budget and price-impact cap, never below the quote's vault floor, one agent trade per slot. Trades the curve before graduation and the CPMM pool after; fails cleanly while the pool is migrating or the quote's issuer has paused transfers.
agent_sellAgent authorityVault tokens → LaunchLab curve or CPMM pool; all quote → vault
Sells slowly into strength: only at least the band over the EMA, at a fill of at least the vault's average cost plus the band, within the window budget and price-impact cap, one agent trade per slot. Every unit of quote it receives stays in the vault.

Fees and payback

payout_backersAgent authorityVault quote → backers' claimable balance
Pays backers back once the vault's liquid quote is at least 5× what went in at launch: their principal first, then 15% of the vault per payout, at most one payout every 4h (the principal payout starts the clock too), never below the vault floor. Buying back dips comes first.
collect_feesAnyoneCreator fees → 75% vault, 15% buyback & burn, 10% backers
Claims the 0.5% creator fee LaunchLab has collected for the launch (and the CPMM pool's creator fee after graduation), in the quote asset: 75% becomes vault quote (agent capital), 15% goes to the buyback wallet, which buys back and burns the Backstock token, and 10% is credited to backers pro-rata. The creator gets 0%.
claim_backer_feesBackerYour claimable quote → you
Pays the backer's pro-rata share of everything credited so far: 10% of creator fees, payback from payout_backers and a wind-down payout, to their quote account. Claim any time; it never expires.

Vault withdrawals

admin_withdraw_vaultPlatform admin key (a single key at launch; it is also the program's upgrade authority)Vault quote and tokens → fee recipient
Withdraws any amount of a launch's vault quote and tokens to the platform fee recipient; it can't touch the pool's liquidity or backers' unclaimed credit. Every withdrawal emits VaultWithdrawn and is listed on the launch page.
dev_withdraw_vaultDev key (a single key the admin sets)Vault quote and tokens → the dev key's own accounts
The same withdrawal as admin_withdraw_vault, signed by the platform's single dev key instead of the admin key: quote and tokens go to the dev key's own token accounts. Works while the platform is paused. Every withdrawal emits VaultWithdrawnByDev and is listed on the launch page.

Platform admin

initialize_platformProgram upgrade authorityNothing — creates the platform config
One-time setup: admin, fee recipient, agent authority and default params.
update_platformPlatform admin keyNothing — params for future launches
Changes defaults for launches created afterwards, within the program's hard caps. Existing launches keep the terms frozen at their creation.
set_fee_recipientPlatform admin keyNothing — where platform fees and admin vault withdrawals go
Points launch fees, create fees, the platform's share of creator fees and admin vault withdrawals at a new recipient (dev-key withdrawals always go to the dev key).
set_agent_authorityPlatform admin keyNothing — which key may call the agent instructions
Rotates the vault agent's key. Whoever holds it can still only call agent_buy, agent_sell and payout_backers, within each launch's frozen limits.
set_dev_authorityPlatform admin keyNothing — which key may call dev_withdraw_vault
Sets, rotates or (with the default pubkey) disables the dev key, the one key besides the admin that can withdraw a vault.
set_launchlab_platformPlatform admin keyNothing — which LaunchLab platform new coins launch under
Points new launches at Backstock's Raydium LaunchLab platform config, the one that sets the 0.5% platform fee, the 0.5% creator fee and the CPMM pool coins graduate to.
add_quotePlatform admin keyNothing — allowlists a quote asset
Adds a quote asset after checking its mint on-chain: SPL Token or Token-2022, no transfer fee, no active transfer hook, accounts not frozen by default, transferable, and a matching LaunchLab config. Sets its raise target, raise bounds, per-wallet cap and vault floor.
update_quotePlatform admin keyNothing — a quote's settings for future launches
Enables or disables a quote asset and re-sizes its raise target, bounds and vault floor. Launches already created keep the values frozen at their creation.
propose_adminPlatform admin keyNothing
Starts a two-step admin handover.
accept_adminProposed adminNothing
Completes the handover; the new key must sign.

Other

begin_wind_downcrankerWrites launch, authority, quote_vault, token_vault
Signed by cranker.
finish_wind_downcrankerWrites launch, authority, quote_vault, token_vault
Signed by cranker.

Vault exitsAgent trades on the launch’s venue (the LaunchLab curve, then its CPMM pool), payout_backers (to backers, principal first), wind_down (all vault quote to backers), admin_withdraw_vault (platform admin key → fee recipient) and dev_withdraw_vault (the single dev key → its own accounts). Each one is an on-chain event shown on the launch page.

What you still trust

The upgrade authority. The program is upgradeable by GU47…HtDT; an upgrade could change any rule.
The admin can withdraw any vault’s quote and tokens to the fee recipient with admin_withdraw_vault (never what backers have already accrued), pause new launches and deposits, pause the agent, enable or re-size quotes, set the dev key, and change defaults for future launches, not the terms of existing ones.
The dev key, a single key, can withdraw any vault’s quote and tokens to its own wallet with dev_withdraw_vault. Every one of its withdrawals is a VaultWithdrawnByDev event on the launch page.
The agent operator decides when to trade and when to pay backers within the rules; it can’t break them, and it can’t send vault quote anywhere but the venue and the backers’ accumulator.
Raydium runs the curve, the CPMM pool and the graduation crank, and sets its protocol fee.
The quote’s issuer can pause, freeze, and on xStocks move or burn tokens from any account, a vault included.