Contracts and addresses

The Pangu program, on Solana devnet

The program was deployed once and upgraded six times on devnet, always at this same address, each build checked byte for byte against the code that was tested before it went live.

The full history, including what each upgrade cost, is in docs/deployments.md in the repository.

What Pangu depends on

Every sale on devnet now

/sales in the app reads this list off the program itself, so it is always current. The front page leads with the banded demo sale that can take a buy right now: PBAND2 while Pyth is publishing Apple's exchange price, and PAAPLX, banded on AAPLx which trades all week, when it is not.

The demo sales, opened from the command line:

Against PBAND2, 9 attacks were run in the sixth run, 8 refused and 1 allowed as expected, the cap and the ceiling both refused on the same sale. Against PAAPLX, in the seventh run, the same 9 with the same result, against a price that publishes all week. Against PVRFD, 10 attacks, 8 refused and 2 allowed as expected: the first time credential mode was attacked on the live program.

The sales opened from the launch page, each by a throwaway issuer wallet in a recorded run (packages/web/lab-evidence/launch-devnet.txt, metadata-devnet.txt and metadata-test-wallet.txt in the repository):

History, kept for the record. POPEN (CBckMjBpHHQtcqxbTu5dUd3nQjyV8oVA4nfBZiTwYXo7, opened at 400 dollars a share so every buy was refused at the ceiling) and a second list sale (4kzCbpEZxyzwXno1ZVnTJ9BAGSjD1HVgSBSwikEsxeaE) were retired on 23 September 2026; /sales hides them behind a switch. Four sales from the first three runs, among them the list sale FToBcoyaCZtLpbaGFV8wdomngjwuQp5XShj6fHdzLyGv that graduated into DAMM v2 pool DLK2xF5i18rgXui9RN6urpAYg3bJxKNtkxiMYS5KECv, were retired after the layout-version build, because its reader refuses rules another layout wrote. The eighth run opened no sale at all: its banded pool and rules, on a token that is not a listed dollar, were refused with BandNeedsDollarQuote in one transaction, https://explorer.solana.com/tx/M9GmvWbFTHCPBJnPbX1k2hmHUzqdBgAQnf7LevymftEjcjTbfM6wy3YXrUieCg2NWsfNdoP9qXESgQP4C9wcYCG?cluster=devnet, leaving only the token and its launch template behind.

Full transaction-by-transaction detail, including every attack and its signature, is in docs/measurements/devnet-run.md and docs/measurements/sdk-pyth.md in the repository.

Run the proof yourself

All Rust and TypeScript tests, no network needed:

MSYS_NO_PATHCONV=1 wsl -d Ubuntu -- bash /mnt/d/Projects/Meteora/scripts/wsl/test.sh

Prints rust: test result: ok. 31 passed and a mocha summary of 141 tests passing, then exits 0. The mocha suite runs on solana-bankrun, which cannot load SBPF v3, so it runs an SBPF v0 build of the same source that nothing deploys; the fork suites run the v3 build. The counts for every suite are in docs/measurements/test-counts.md.

The devnet prove command, against the live program:

cd packages/scripts && npm run prove

Prints a table of attacks, an exit code, and the largest holder's share against the cap. The sixth devnet run, against the banded dollar sale (PBAND2), ended:

proof    : the largest wallet holds 16.93 percent of the 6229218448 raw units sold, against a cap worth 17.66 percent of them
cost     : 0.011317 SOL, after 0.033344 SOL came back from the attacking wallets

9 attacks run, 8 refused as expected, 1 allowed as expected, 1 not applicable, 0 off the standard

On the credential sale, npm run prove -- --mint 7ixMAMUmysN4qsCpthdznhq7aRbiCNB5Xeg3X9vBSLWn, the same run ended 10 attacks run, 8 refused as expected, 2 allowed as expected, 1 not applicable, 0 off the standard. On the round-the-clock sale, npm run prove -- --mint 8FaBUEjMfkpYAzZLmLKwYHxd15BNC1ZBFkgTgN2WCQvK, the seventh run ended 9 attacks run, 8 refused as expected, 1 allowed as expected, 1 not applicable, 0 off the standard.

The four doors of the app have their own recorded runs on devnet, each a script that drives the real page with a throwaway wallet and checks every line against the chain: launch-devnet.txt, metadata-devnet.txt, sale-devnet.txt, verify-devnet.txt and portfolio-devnet.txt in packages/web/lab-evidence. The signatures from each are at the foot of the Launch a sale, Buy and sell, Verify buyers and Your portfolio pages.

The status command

npm run status, run daily through judging, checks that the deployed program still hashes to what docs/deployments.md records, that every demo sale's rules account is still on chain, that each running banded sale has a Pyth price account and shows how old the price in it is, that the Pyth key still answers, and that both project wallets can still pay. It prints one row per check and exits non-zero if anything says FAIL. A WARN is for something worth a look that does not stop the demo, most often a stock price that has aged out because the US market is closed, which the row states plainly when that is the reason.

Mainnet

Not deployed. Ready: the mainnet build, SBPF v3, is made reproducibly and verified, sha256 16a13b7f8e9eab5f407d9564f8826bdca8390e6a28dc411a954adad7d3d7852e, 337,856 bytes, recorded in docs/deployments.md; the deploy is one guarded command a person runs with their own key, and every step was rehearsed on a forked copy of mainnet on 23 September 2026. The program keypair fixes the address, so on mainnet it will sit at the same 4Nd46mDiaTSkqXPAXKqT4jkahcz1TxVSdoirbBCAr5qG. What changes on mainnet, the costs and the upgrade key plan are on the mainnet page; the runbook is docs/deploy/mainnet.md in the repository.