atomic — pump.fun launch & fee-collection toolkit
This repo bundles Node scripts that wrap pump.fun creator/collect/trade flows in Jito bundles so that multi-tx flows execute atomically. Use it when the naive single-tx path is either over the 1232-byte limit, racing a sweeper bot, or leaks SOL through an intermediate wallet.
When to invoke
Pick this skill when the user wants to do any of:
- Launch a pump.fun coin where the creator wallet is different from the wallet paying SOL, or where the creator's key is leaked/shared.
- Collect creator fees from a coin without giving other key-holders a window to drain first.
- Buy a token while routing around a pump-sdk version drift (uses Jupiter under a Jito bundle).
- Rescue SPL / Token-2022 balances from a leaked-key wallet without a sweeper front-running.
- Distribute USDC rewards to holders (sqrt-weighted) or sweep-out via
EMERGENCY mode.
- Audit whether a Solana wallet was seeded by pump.fun (provenance check).
Skip this skill for non-pump tasks, generic Solana tx construction, or anything not involving Jito bundles + pump.fun.
Layout
src/ — runnable scripts (post-restructure home; the old tmp/leaked-launch/ tree).src/lib/ — shared TypeScript helpers (e.g. detectSeededByPump) imported by the tools.tools/ — standalone TypeScript utilities run with tsx: check-pump-funding.ts (provenance), check-tip-accounts.ts (Jito drift), check-balances.ts (wallet balance audit).docs/runbooks/ — incident playbooks (leaked-key response, etc.).docs/v2-usdc-rollout/ — context on the V2 USDC pool migration; read before touching buy/sell flows.
Setup
npm install # at repo root — root package.json defines all scripts
cp .env.example .env # fill in
# never commit .env
Required base vars: RPC_URL, FUNDER_SECRET, CREATOR_SECRET (base58) or FUNDER_KEYPAIR / CREATOR_KEYPAIR (JSON file paths). Per-flow vars listed below. The root package.json exposes npm scripts (npm run launch, npm run collect, etc.) — see package.json for the full list.
Script index
| Script |
Flow |
Key env vars |
metadata.js |
Upload token metadata + image to pump.fun IPFS; prints a URI. |
NAME, SYMBOL, IMAGE_PATH |
fire-jito.js |
Jito 2-tx bundle launch. Funder pays rent + Jito tip in Tx1; creator pays own fee in Tx2 (createV2). On-chain creator = CREATOR_SECRET's pubkey. |
NAME, SYMBOL, URI, FUNDER_SECRET, CREATOR_SECRET, JITO_TIP, optional DEV_BUY_SOL |
fire-atomic-create.js |
Single-tx create. Fee payer = funder; creator signs but does not pay. No Jito. |
Same as above minus JITO_TIP |
collect-jito.js |
One-tx atomic creator-fee collect → DESTINATION. No window for a competing key-holder. |
DESTINATION, FUNDER_SECRET, CREATOR_SECRET |
watch-collect.js |
Long-running poller; runs collect-jito when vault ≥ MIN_COLLECT_SOL. |
CREATOR_PUBKEY, MIN_COLLECT_SOL, DESTINATION, secrets |
consolidate.js |
One Jito bundle: collect vault + drain creator + drain funder → DESTINATION. |
DESTINATION, both secrets |
buy-jito.js |
Jupiter buy inside a Jito bundle. Use when pump-sdk's buy ix is out of sync with the live program. |
TARGET_MINT, BUY_SOL, SLIPPAGE_BPS |
rescue-tokens.js |
Atomic SPL / Token-2022 transfer via Jito bundle. Bot cannot insert. |
secrets, destination, mint |
distribute.js |
Sqrt-weighted USDC rewards to holders. EMERGENCY=1 sweeps to one address. |
MINT, REWARD_PERCENT, MIN_BPS |
grind.js |
JS vanity-address grinder. Slow — prefer solana-keygen grind. |
— |
Typical flows
Launch (Jito): run from repo root.
NAME="MyCoin" SYMBOL="MEME" IMAGE_PATH=./logo.png npm run metadata
# -> https://ipfs.io/ipfs/<CID>
URI="https://ipfs.io/ipfs/<CID>" NAME=MyCoin SYMBOL=MEME \
FUNDER_SECRET=... CREATOR_SECRET=... JITO_TIP=0.005 \
npm run launch
Auto-collect for a leaked creator key:
DESTINATION=<safe-wallet> CREATOR_PUBKEY=<base58> MIN_COLLECT_SOL=0.05 \
FUNDER_SECRET=... CREATOR_SECRET=... \
npm run watch
Provenance audit (no Jito needed):
npx tsx tools/check-pump-funding.ts <walletAddress> [rpcUrl]
Operational gotchas
- Jito tip floor drift. 0.001 SOL is the documented floor but rarely lands. Start at
JITO_TIP=0.005; if Jito returns Invalid for the bundle, bump to 0.01–0.02.
- Jito tip-account list. Hardcoded list can rotate. On
"Bundles must write lock at least one tip account", fetch live getTipAccounts from the Jito Block Engine RPC and update the script.
- pump-sdk drift. When pump.fun adds required accounts (e.g.
BuybackFeeRecipient) to the buy ix and the local SDK is behind, switch buys to buy-jito.js (Jupiter route).
- Token-2022 sweepers. Tokens that land in a leaked/shared wallet are typically drained in ~3 s. Use
rescue-tokens.js patterns to buy-and-transfer atomically.
- V2 USDC pool. Buy/sell flows changed for V2-USDC coins — read
docs/v2-usdc-rollout/ before editing buy logic.
Secrets handling
- Secrets come only from env vars (base58) or local JSON keypair files. Never hardcode.
.gitignore excludes *.json by default. Do not weaken this. If a build needs a JSON file tracked, add a narrow allowlist exception, never a blanket one.- If a key is leaked, the patterns in this toolkit (
collect-jito, consolidate, rescue-tokens) are how you extract value safely. Sweeper bots watch leaked addresses; SOL that rests in such a wallet for more than a few seconds is gone.
Architecture: why Jito bundles
A pump.fun create instruction is near the 1232-byte tx-size ceiling. To have the create tx come from the creator wallet (so on-chain attribution matches), you'd also need to fund that wallet with rent SOL atomically — which blows the size limit. Jito bundles split this into two txs that share a blockhash and land all-or-nothing on the block engine. No bot can insert between them. The same atomicity property is what makes collect-jito, consolidate, buy-jito, and rescue-tokens safe against same-key sweepers.
1---2name: atomic3description: Use when the user wants to launch, buy, collect creator fees from, rescue tokens from, or distribute rewards for a pump.fun coin in a way that is atomic across multiple Solana txs (Jito bundles). Also covers the `check-pump-funding` wallet-provenance tool. Triggers on requests like "launch a pump coin", "collect creator fees", "atomic buy via Jito", "rescue tokens from a leaked key", "did pump.fun seed this wallet", or any mention of `fire-jito`, `collect-jito`, `buy-jito`, `consolidate`, `rescue-tokens`, or `distribute`.4---56# atomic — pump.fun launch & fee-collection toolkit78This repo bundles Node scripts that wrap pump.fun creator/collect/trade flows in **Jito bundles** so that multi-tx flows execute atomically. Use it when the naive single-tx path is either over the 1232-byte limit, racing a sweeper bot, or leaks SOL through an intermediate wallet.910## When to invoke1112Pick this skill when the user wants to do any of:1314- **Launch** a pump.fun coin where the creator wallet is *different* from the wallet paying SOL, or where the creator's key is leaked/shared.15- **Collect creator fees** from a coin without giving other key-holders a window to drain first.16- **Buy** a token while routing around a pump-sdk version drift (uses Jupiter under a Jito bundle).17- **Rescue** SPL / Token-2022 balances from a leaked-key wallet without a sweeper front-running.18- **Distribute** USDC rewards to holders (sqrt-weighted) or sweep-out via `EMERGENCY` mode.19- **Audit** whether a Solana wallet was seeded by pump.fun (provenance check).2021Skip this skill for non-pump tasks, generic Solana tx construction, or anything not involving Jito bundles + pump.fun.2223## Layout2425- `src/` — runnable scripts (post-restructure home; the old `tmp/leaked-launch/` tree).26- `src/lib/` — shared TypeScript helpers (e.g. `detectSeededByPump`) imported by the tools.27- `tools/` — standalone TypeScript utilities run with `tsx`: `check-pump-funding.ts` (provenance), `check-tip-accounts.ts` (Jito drift), `check-balances.ts` (wallet balance audit).28- `docs/runbooks/` — incident playbooks (leaked-key response, etc.).29- `docs/v2-usdc-rollout/` — context on the V2 USDC pool migration; read before touching buy/sell flows.3031## Setup3233```bash34npm install # at repo root — root package.json defines all scripts35cp .env.example .env # fill in36# never commit .env37```3839Required base vars: `RPC_URL`, `FUNDER_SECRET`, `CREATOR_SECRET` (base58) or `FUNDER_KEYPAIR` / `CREATOR_KEYPAIR` (JSON file paths). Per-flow vars listed below. The root `package.json` exposes npm scripts (`npm run launch`, `npm run collect`, etc.) — see `package.json` for the full list.4041## Script index4243| Script | Flow | Key env vars |44|---|---|---|45| `metadata.js` | Upload token metadata + image to pump.fun IPFS; prints a URI. | `NAME`, `SYMBOL`, `IMAGE_PATH` |46| `fire-jito.js` | **Jito 2-tx bundle launch.** Funder pays rent + Jito tip in Tx1; creator pays own fee in Tx2 (createV2). On-chain creator = `CREATOR_SECRET`'s pubkey. | `NAME`, `SYMBOL`, `URI`, `FUNDER_SECRET`, `CREATOR_SECRET`, `JITO_TIP`, optional `DEV_BUY_SOL` |47| `fire-atomic-create.js` | Single-tx create. Fee payer = funder; creator signs but does not pay. No Jito. | Same as above minus `JITO_TIP` |48| `collect-jito.js` | One-tx atomic creator-fee collect → `DESTINATION`. No window for a competing key-holder. | `DESTINATION`, `FUNDER_SECRET`, `CREATOR_SECRET` |49| `watch-collect.js` | Long-running poller; runs `collect-jito` when vault ≥ `MIN_COLLECT_SOL`. | `CREATOR_PUBKEY`, `MIN_COLLECT_SOL`, `DESTINATION`, secrets |50| `consolidate.js` | One Jito bundle: collect vault + drain creator + drain funder → `DESTINATION`. | `DESTINATION`, both secrets |51| `buy-jito.js` | Jupiter buy inside a Jito bundle. Use when pump-sdk's buy ix is out of sync with the live program. | `TARGET_MINT`, `BUY_SOL`, `SLIPPAGE_BPS` |52| `rescue-tokens.js` | Atomic SPL / Token-2022 transfer via Jito bundle. Bot cannot insert. | secrets, destination, mint |53| `distribute.js` | Sqrt-weighted USDC rewards to holders. `EMERGENCY=1` sweeps to one address. | `MINT`, `REWARD_PERCENT`, `MIN_BPS` |54| `grind.js` | JS vanity-address grinder. **Slow** — prefer `solana-keygen grind`. | — |5556## Typical flows5758**Launch (Jito):** run from repo root.5960```bash61NAME="MyCoin" SYMBOL="MEME" IMAGE_PATH=./logo.png npm run metadata62# -> https://ipfs.io/ipfs/<CID>6364URI="https://ipfs.io/ipfs/<CID>" NAME=MyCoin SYMBOL=MEME \65FUNDER_SECRET=... CREATOR_SECRET=... JITO_TIP=0.005 \66 npm run launch67```6869**Auto-collect for a leaked creator key:**7071```bash72DESTINATION=<safe-wallet> CREATOR_PUBKEY=<base58> MIN_COLLECT_SOL=0.05 \73FUNDER_SECRET=... CREATOR_SECRET=... \74 npm run watch75```7677**Provenance audit (no Jito needed):**7879```bash80npx tsx tools/check-pump-funding.ts <walletAddress> [rpcUrl]81```8283## Operational gotchas8485- **Jito tip floor drift.** 0.001 SOL is the documented floor but rarely lands. Start at `JITO_TIP=0.005`; if Jito returns `Invalid` for the bundle, bump to 0.01–0.02.86- **Jito tip-account list.** Hardcoded list can rotate. On `"Bundles must write lock at least one tip account"`, fetch live `getTipAccounts` from the Jito Block Engine RPC and update the script.87- **pump-sdk drift.** When pump.fun adds required accounts (e.g. `BuybackFeeRecipient`) to the buy ix and the local SDK is behind, switch buys to `buy-jito.js` (Jupiter route).88- **Token-2022 sweepers.** Tokens that land in a leaked/shared wallet are typically drained in ~3 s. Use `rescue-tokens.js` patterns to buy-and-transfer atomically.89- **V2 USDC pool.** Buy/sell flows changed for V2-USDC coins — read `docs/v2-usdc-rollout/` before editing buy logic.9091## Secrets handling9293- Secrets come **only** from env vars (base58) or local JSON keypair files. Never hardcode.94- `.gitignore` excludes `*.json` by default. Do not weaken this. If a build needs a JSON file tracked, add a narrow allowlist exception, never a blanket one.95- If a key is leaked, the patterns in this toolkit (`collect-jito`, `consolidate`, `rescue-tokens`) are how you extract value safely. Sweeper bots watch leaked addresses; SOL that *rests* in such a wallet for more than a few seconds is gone.9697## Architecture: why Jito bundles9899A pump.fun `create` instruction is near the 1232-byte tx-size ceiling. To have the create tx **come from** the creator wallet (so on-chain attribution matches), you'd also need to fund that wallet with rent SOL atomically — which blows the size limit. Jito bundles split this into two txs that share a blockhash and land all-or-nothing on the block engine. No bot can insert between them. The same atomicity property is what makes `collect-jito`, `consolidate`, `buy-jito`, and `rescue-tokens` safe against same-key sweepers.
nirholas