# DERBY security.txt (RFC 9116) Contact: https://x.com/solderbysol Expires: 2027-11-09T00:00:00.000Z Preferred-Languages: en Canonical: https://solderby.fun/.well-known/security.txt Policy: https://solderby.fun/.well-known/security.txt # ===================================================================== # 1. WHAT DERBY IS # ===================================================================== # DERBY is a token launchpad built directly on Meteora's audited programs. # Every token is a standard Meteora Dynamic Bonding Curve (DBC) pool on one # DERBY config. When its curve fills it migrates to a Meteora DAMM v2 pool. # DERBY deploys NO on-chain program of its own. There is no custom contract # to exploit, upgrade or pause, and no presale: tokens trade on chain from # their first block, on this site or on any terminal (Axiom, GMGN, Jupiter, # DEX Screener) that reads Meteora pools. # # Cluster ............... mainnet # Meteora DBC program ... dbcij3LWUppWqq96dh6gJWwBifmcGfLSB5D4DuSMaqN # Meteora DAMM v2 ....... cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG # DERBY DBC config ...... EGgve7irLpBtay4qt5ouhEdyWqCT44CvqVqsHCGi95XJ # DAMM v2 config ........ Hv8Lmzmnju6m7kcokVKvwqz7QPmdX9XfKjJsXz8RXcjp # House wallet .......... CAPEEcsQJeqieh4uKaK4Rz9NHBB2jqVwdkCwRfGVTB7y # Token mints end in .... "race" # # ===================================================================== # 2. TOKEN TERMS (fixed in the DBC config, which cannot be edited) # ===================================================================== # - Supply: 1000000000 tokens, 6 decimals, minted once at launch. # - Metadata is immutable after launch (token update authority: none). # - Swap fee: flat 1% on every buy and sell. No anti-snipe tax, no # hidden fee schedule, no transfer tax. # - Fee split: 30% to the token's creator (claimable on its page), # the rest to the platform. 50% of platform fees fund the race purse. # - Curve: starts at 46.5 SOL market cap, migrates at 40 SOL raised. # - On migration 100% of the LP is permanently locked in DAMM v2. Nobody, # including DERBY, can withdraw the liquidity. # - Tokens left unsold in the curve after migration are burned. # # ===================================================================== # 3. LAUNCHES: ONE SIGNATURE, NO FRONT-RUN OF THE CREATOR # ===================================================================== # - A launch is ONE transaction that creates the mint, metadata, pool and # the creator's optional first buy. The creator signs once in their own # wallet. Nobody can buy before the creator: the pool does not exist # until that transaction lands, and the first buy is inside it. # - The server pre-signs only with the fresh vanity mint key. That key can # do nothing except create that one mint, and it is retired after use. # - The server simulates every launch before handing it to the wallet and # accepts back only the exact message it prepared. # - The very first token (the house runner) can only be launched by the # DERBY dev wallet; launching opens to everyone right after it. # # ===================================================================== # 4. CUSTODY AND KEYS # ===================================================================== # - DERBY never holds user keys or user funds. Your wallet signs every # trade, launch and fee claim itself; the site only builds transactions. # - The house wallet holds only platform fees on their way to the purse # and a small float for network fees. It can claim platform fees, pay # purse transfers, pay migration rent and burn leftover tokens. It has # no authority over pools, user tokens, creator fees or locked LP. # - The house key lives only on the server, readable by the service # account alone; it is not in any repository or backup. The dev key # is never on any server. # # ===================================================================== # 5. RACES AND PAYOUTS # ===================================================================== # - Races run back to back for 6 h. The finish is sealed: it lands at a # second inside the last 30 minutes chosen by HMAC-SHA256(secret, race # id). The hash is published when the race starts; the seed is revealed # after the bell. Anyone can re-check it on /race/. # - Race time is the chain's block time, not the server clock. # - Score = net SOL bought per wallet during the race, capped at 5 SOL # per wallet, plus a small first-time-backer bonus (never larger than # the minimum counted buy, so splitting wallets does not pay). # - Buying and selling back moves nothing. Wash trading only pays fees. # - The top three split the purse 50/30/20. A placed token's creator gets # 10% of its share; its holders share the rest by the smaller of # time-weighted balance, balance at the bell and an on-chain snapshot. # - Results come from confirmed chain data only. Every payout is journaled # before sending and checked on chain before it is retried, so a payout # is never sent twice. # # ===================================================================== # 6. WEB SECURITY # ===================================================================== # - Strict Content-Security-Policy (scripts from this origin only, no # inline scripts, no third-party scripts, no frames). # - No cookies, no accounts, no tracking. Wallets connect through the # Wallet Standard; the site never asks for a seed phrase or private key. # - Uploaded pictures are decoded and re-encoded as plain PNG. # - Rate limits on every write endpoint. # # ===================================================================== # 7. STAY SAFE # ===================================================================== # - The only DERBY site is https://solderby.fun. Check the domain before you sign. # - DERBY will never DM you, never ask for your seed phrase and never ask # you to "validate" or "sync" a wallet. # - Read what your wallet shows. A DERBY trade only swaps on the Meteora # DBC program; a launch also creates the mint, metadata and pool. # - Memecoins are risky. A race purse is a reward, not a promise of profit. # # ===================================================================== # 8. REPORTING A VULNERABILITY # ===================================================================== # - Report privately through a Contact above. Include steps to reproduce # and, if relevant, transaction signatures. # - Please do not test against other users' funds, do not run denial of # service, and give us reasonable time to fix before disclosure. # - In scope: this website and its API, transaction building, race and # payout logic, the house wallet's operations. # - Out of scope: Meteora's programs (report to Meteora), wallets, # third-party terminals, social engineering, missing best-practice # headers without a working exploit. # - Valid, original reports that put funds at risk may be rewarded from # platform fees, at DERBY's discretion and by severity.