Pangu
A fair first sale for stock tokens. The curve sets the price, the cap keeps it fair.
Watch the price find itself.
Every share on this drawing came off Meteora’s curve. The cap on one wallet lies under it at the width it really has.
How it works
One buy, all the way to graduation
Every movement of the token passes through Pangu first. Here is what it checks, and the moment it stops checking for good.
The curve sets the price
Every wallet has a cap
Only approved wallets, if the issuer wants
Buys stop above the real stock price
At graduation, or when the offering ends, the rules switch off
Selling back to the pool is always allowed. Nothing in the rules can close the exit.
the rules, from your own wallet
Try to
break it
Connect a devnet wallet and run the attacks yourself. Every refusal comes from the program, not from this page.
- your devnet SOL
- not connected
reading the sale from devnet
Simulating asks the chain what would happen, so your wallet is never asked to sign something meant to fail.
- 01
Buy under the cap, the way a buyer would
under the cap, buying works0.000005 SOL in feesThe program lets this through: a buy under the cap is an ordinary buy. rule C3
connect a devnet wallet to run this - 02
Take more than the cap in one go
one wallet, one cap, always0.000005 SOL in feesThe program refuses this: no wallet may take more than the cap. OverCaprule C3
connect a devnet wallet to run this - 03
Buy again, and cross the cap on the second try
the counter remembers every buy0.000005 SOL in feesThe program refuses this: the cap counts every buy the wallet has made, not only this one. OverCaprule C3
connect a devnet wallet to run this - 04
Buy into another of the wallet's holding accounts
counted per wallet, not per account0.000005 SOL in fees, and about 0.002 SOL as a small deposit the network keeps for the account it opensThe program refuses this: the cap counts the wallet, not each holding account it opens. OverCaprule C3
connect a devnet wallet to run this - 05
Buy into an account whose owner can still change
no handing the whole account on0.000005 SOL in fees, and about 0.002 SOL as a small deposit the network keeps for the account it opensThe program refuses this: tokens never land in an account that could be handed to someone else. ReceivingAccountOwnerCanChangerule C13
connect a devnet wallet to run this - 06
Send tokens straight to another wallet
no side market during the sale0.000005 SOL in fees, and about 0.002 SOL as a small deposit the network keeps for the account it opensThe program refuses this: tokens cannot move from one wallet to another while the sale runs. WalletToWalletDuringSalerule C4
connect a devnet wallet to run this - 07
Call the rules program on its own, with no transfer
no transfer, no counter change0.000005 SOL in feesThe program refuses this: the rules only act inside a real transfer, so calling them alone changes nothing. NotTransferringrule C1
connect a devnet wallet to run this - 08
Buy above the price ceiling
never far above the real stock0.000005 SOL in feesThe program refuses this: no buy may push the price past the price ceiling. PriceOutsideBandrule C9
connect a devnet wallet to run this - 09
Sell back to the pool
the exit is always opensells a fifth of what you hold back to the pool, and 0.000005 SOL in feesThe program lets this through: selling back to the pool is always allowed. rule C5
connect a devnet wallet to run this
Nothing run yet. Every row above is a real transaction against the real program.
The sale, the cap and the share every wallet holds are being read off devnet now.
Why not
Why not the tools that already exist
A plain launchpad
With no rules program in front of it, the fastest bot or the biggest wallet can take most of a sale in the first block. That is the outcome a stock token's first buyers should be protected from, and Pangu is that protection, built as a small program the token calls on every move, so no other app or wallet can skip it.
Meteora Alpha Vault
Meteora's own fairness product is a good one, but it only sits in front of Meteora's trading pools, so it cannot attach to a bonding curve at all. It also sells at one price decided in advance, while Pangu's rules run inside a live curve, which is exactly the moment first buyers need protecting.
Meteora Presale Vault
The presale vault runs a capped sale for wallets on the approved list before any market exists: a fixed price, first come, or a split in proportion, with no curve and no price discovery. Pangu's rules run inside the Meteora curve all the way to graduation, and selling back to the pool is always allowed.
A fixed price
Naming a number and selling at it until it runs out throws away the one thing a bonding curve is good at: finding out what buyers will actually pay. It also leaves nothing to measure a runaway price against, which is the live number Pangu's optional ceiling checks on every buy.
Proof
Every number here was run
The suites, the refused transactions and the deploy itself. Each one traces back to a file in the repository, and each attack below landed on Solana devnet and was turned away by the program.
- 31
- Rust tests
- 141
- unit tests
- 38
- forked mainnet steps
- 178
- package tests
- 126
- script tests
16 of 19
attacks on devnet, refused as expected
The other three went through, as they should: a wallet the verifier had attested buying under its cap, and two sells back to the pool, because nothing in the rules can close the exit.
the buy refused above Apple's price4
forged price attempts, all refused
A price signed by a key that is not an oracle, a price altered after signing, a real price for another stock aimed at this account, and a real price replayed once it had aged out.
8
code review findings, all fixed
The serious one: an issuer who kept the power to mint could have minted past every rule. A sale now refuses to open on a token that still has it.
Seventh devnet deploy
slot 503286300, 24 September 2026, SBPF v3, 339,848 bytes
sha256708289...b388f8
program4Nd46m...CAr5qG
Four doors
Now it’s yours
The rules you just watched hold are the same ones behind each of these pages, and every count here is read off devnet as the page loads.