What a Tallow coin is

A pump.fun coin, created by pump.fun's own program (create_v2), with three things chosen at launch that make it a candle auction:

• Its price is a stock. pump.fun lets a coin trade against a tokenized stock instead of SOL — xStocks such as NVDAx and TSLAx, and Backpack's tokenized shares. Every buy pays in that stock and every sell is paid in it.
• Its creator is a pot key. pump.fun sends each trade's creator fee to the coin's creator. Tallow makes the creator a key that exists for this one coin, so its vaults hold this coin's fees and nothing else. That is the pot.
• Its rules are in its launch transaction. How long the candle burns, the smallest buy that relights it, and the winner's share are written in a memo in the very transaction that creates the coin — the only place anyone, including Tallow, reads them from.

Tallow deploys no program. Everything on chain is pump.fun's, the SPL token programs', Jupiter's and the memo program's.

The candle rule

Trades are taken in the order the chain recorded them, each stamped with the time pump.fun's program saw on the chain's clock.

1. A qualifying buy is a buy that took at least the coin's minimum of the stock out of the buyer's wallet, fees included. Buys on pump.fun, on Tallow or from any bot all count; the chain does not know which website built them.
2. A qualifying buy takes the flame and relights the candle: it now goes out at that buy's time plus the coin's fuse.
3. When the candle goes out with no newer qualifying buy, the round is over. Whoever holds the flame has won it. A trade at or after that very second belongs to the next round.
4. A round's pot is the sum of the creator fees of every trade in it — buys and sells, big and small. The winner is owed their share of it (50% to 100%, set at launch); the rest is the launcher's.
5. The next qualifying buy lights the next round. Fees from trades while no candle burns belong to that next round.

Sells never take the flame. A buy one unit under the minimum feeds the pot and changes nothing else. Two qualifying buys in the same second: the one the chain recorded later holds the flame.

Trades are read only from pump.fun's own event CPI — the record pump.fun's program writes about each trade, signed by an authority only that program controls. A "trade" printed into a transaction's logs by any other program is ignored, so nobody can fake their way to the flame.

Where the pot is

Wherever pump.fun keeps a creator's fees — no copy, no escrow of ours:

• on the bonding curve itself (pump.fun's newest trades keep the creator fee there until someone sweeps it),
• in pump.fun's creator vault for the pot key,
• after the coin graduates, in the PumpSwap pool and PumpSwap's creator vault,
• and, for the moment between collecting and paying, in the pot key's own stock account.

Every coin page shows all of them, read live. The sum of every round's pot equals what those accounts hold, to the unit; the tests check exactly that.

Who pays the winner — the honest part

The launcher does. When a round ends, the coin page shows the launcher a Pay button. One transaction sweeps the curve, collects the vault (both of which anyone may do), and has the pot key send the winner their share of that round in the stock, with a memo marking the round paid.

The pot key is made in the launcher's browser from a signature by the launcher's wallet over a fixed message with a random number from the launch memo. Signatures by these wallets are deterministic, so the same wallet always makes the same key, and no other wallet can. Nothing is stored anywhere.

What that means, plainly:

• Tallow cannot pay anyone, and cannot take anything. It never holds a key to any pot.
• A launcher can refuse to pay, or empty the pot. No contract stops them, because Tallow chose not to deploy one. What stops them is that every round, its winner, its pot and whether it was paid are public on the coin's page with links to the transactions — and a coin whose launcher does not pay is a coin nobody plays.
• The rules cannot change. They are read from the launch transaction, which nobody can edit.
• pump.fun's own admin powers over its programs apply to these coins as to every pump.fun coin.

How the site finds coins

Every launch includes a zero-lamport transfer to 5gGv3VfdmwbqsYo5Pv7eN1EQsNgSTEudaeH4ykrEJqpn — the SHA-256 of "tallow registry v1", an address nobody holds a key to. One query for that address's transactions lists every launch with its rules memo. Anyone can write such a memo, so an entry is believed only when its own transaction also created that coin through pump.fun with the stated rules; anything else is ignored.

How it is tested

Every transaction this site builds is executed against pump.fun's real programs, real xStock mints and real Jupiter routes on a private copy of Solana mainnet (surfpool), with the clock moved to make candles burn out. Every expected number is computed by the test itself — pump.fun's fee formula from its published interface, wallet balances before and after, and a second statement of the candle rule that shares no code with the site's.

The last run: 8/8 properties and 17,242 checks passed on a copy of Solana mainnet (09 Oct 2026).

A sabotage sweep then plants 25 bugs in copies of the page's own code, one at a time, and requires the property named for each to fail: 25/25 were caught by the property named for them.

And in a real browser: headless Chrome drove these pages with test wallets against a private copy of Solana mainnet. The launch page launched a coin with a picture and a one-minute candle; a second wallet bought enough to take the flame; a third bought too little and only fed the pot; the second sold half; the clock passed the candle and the round showed as won and owed; the launcher's one button paid the winner exactly 90% of the pot and the launcher exactly the rest; the board and the home page listed it. 7/7 journeys, 31 checks, every amount read back from the chain by the harness itself (09 Oct 2026).

And against mainnet itself, spending nothing: the transactions this site builds — a launch, and a buy of a live NVDAx-priced pump.fun coin with SOL through Jupiter in one transaction — were run by mainnet's own simulator as a real wallet: 8/8 live checks passed (05 Nov 2026).

The stocks

Every tokenized stock pump.fun's program accepts as a quote, that Jupiter prices with at least $100,000 of liquidity and can route SOL into at under 1% impact for 0.5 SOL — measured 09 Oct 2026.

Risks

• Memecoins can go to zero, and a candle auction rewards one buyer per round, not everyone.
• Tokenized stocks are issued by Backed (xStocks) and Backpack under their own terms; they can be paused or restricted by their issuers, and they are not available everywhere.
• The launcher pays winners (see above). Check a coin's paid rounds before you play it.
• Tallow is experimental and unaudited. pump.fun, Jupiter and the token issuers are third parties with their own risks.