Mainnet architecture
Circulate separates launch authorization, metadata storage, token creation, reward custody, automated execution, holder indexing, and public reporting so each layer has a narrow responsibility and a clear trust boundary.
System layers
Collect token and reward configuration, display the review, and request local wallet signatures.
Upload the token image and JSON metadata to IPFS before the creation transaction is requested.
Create the token, run the bonding curve, handle graduation, and maintain the official creator-fee lifecycle.
Maintain project PDAs, allowed reward mints, vault rules, thresholds, round state, and claim protection.
Schedule rounds, resolve fee paths, submit bounded transactions, build finalized snapshots, and retain public evidence.
Authority boundaries
| Authority | Permitted actions | Boundary |
|---|---|---|
| Launcher wallet | Approve metadata, pay launch costs, and sign the Pump.fun transaction | No key material leaves the wallet |
| Circulate server | Validate requests and return serialized transactions | Cannot sign as the launcher |
| Project PDA | Authorize configured vault and round operations | Has no private key and cannot sign arbitrary messages |
| Keeper wallet | Pay gas and invoke allowed program instructions | Cannot freely withdraw PDA-owned funds |
| Upgrade authority | Apply reviewed program upgrades | Governed separately from daily keeper operation |
Before collecting fees, the keeper resolves the current Pump.fun state. Bonding-curve projects use the creator-vault path; graduated projects use the official PumpSwap creator-fee flow.
Data and verification model
Solana programs cannot efficiently enumerate every holder. Circulate therefore builds holder snapshots off-chain from finalized RPC data and commits a Merkle root on-chain. Anyone can independently recompute the eligible set and allocation, while the program prevents a committed round from exceeding its purchased reward amount or paying one entitlement twice.