Nothing moves without your signature — and you see what you are signing.

Non-custodial by design

• The server never holds a private key, a seed phrase or a session that could sign anything.
• Wallet sign-in is a signed message (“LAUNCHFLY login / nonce / issued”) — no transaction, no fee, nothing to approve on-chain.
• The mint keypair for a new coin is generated in your browser, signs the create transaction once, and is never sent to us.
• Creator fees go to the wallet that created the coin. Ours is not it.

Every transaction is decoded and checked in your browser

Launches, dev buys, desk trades and fee claims are built unsigned by PumpPortal. Before your wallet is asked for anything, the site decodes the transaction and verifies:

• Programs: only System, Token, Token-2022, Associated Token, Compute Budget, Rent, Metaplex metadata, pump.fun, pump AMM and PumpPortal's fee wrapper. Anything else — refused.
• Fee payer: must be you. Signers: only you, plus the new mint on a create.
• Address lookup tables are resolved through the RPC; an unresolved table is a refusal, not a shrug.
• Every System transfer must go to the pump.fun fee recipients (read live from the pump.fun Global account), PumpPortal's fee wallet, the mint, or your own token account.
• The total that can leave your wallet — transfers plus the maximum SOL committed inside the pump / AMM / wrapper instructions plus the priority fee — must stay within dev buy × (1 + slippage) × (1 + fees) + priority fee + rent, with a 10% margin.

The summary — programs, transfers, total SOL, warnings — is shown in the launch panel before the wallet prompt. If it does not add up, the button does nothing.

The page itself

• A strict Content-Security-Policy: scripts only from the site and the pinned CDN, with an integrity hash on the import map; no inline script execution.
• Subresource Integrity hashes on three.js and the Solana library, so a tampered CDN file will not load.
• Served over HTTPS with X-Frame-Options: DENY, so it cannot be embedded in someone else's page for click-jacking.
• The server's config, source and data folders are not reachable over the web.

The API

• Rate-limited per IP; AI and transaction routes are origin-checked so other sites cannot borrow them.
• Every request body is schema-validated before a handler runs.
• The AI proxy enforces a daily USD spend cap and a per-run soft cap; when the cap is hit the flies pause instead of hammering the server.
• Protected writes (shared fly memories, treasury log) require a wallet login token; everything else is readable anonymously.

What we cannot protect you from

Report a problem

If you find something that looks wrong — a transaction that verified when it should not have, a header missing, a route that answers when it should refuse — open the Chat tab in the office and tell the CTO, or use the contact on the coin page of any launched coin. We would rather hear about it than read about it.