MOLE PAD DOCS

A Solana launchpad on pump.fun where a new coin starts underground. Wallets dig its field for rights; a right is a seat in the one pooled first buy that creates the coin. Bots can only buy after.

• OVERVIEW
• LIFECYCLE
• THE DIG GAME
• RIGHTS
• SURFACING
• REFUNDS
• FEES + $DIG
• COMPROMISES
• TRUST
• VERIFY
• PARAMETERS
• ACCOUNTS
• INSTRUCTIONS
• ERRORS
• RISKS
• FAQ

OVERVIEW

A pump.fun coin is public from the transaction that creates it, so a coin cannot be hidden on pump. On Mole Pad it does not exist on pump at all for its first minutes. It is a burrow: the program stores only a salted hash of its name, ticker and metadata link, and a hash of the dig field's seed (the round code).

While the burrow is underground, wallets dig its field through the dig service. A dug cell shows how many buried treasures touch it. A dig that hits a treasure returns a right signed by the pad's attestor. The wallet funds the right: it locks up to the right's cap in the burrow's escrow.

At the timer, or as soon as every right is funded or the escrow is full, anyone sends surface: one instruction creates the coin on pump.fun and makes one pooled buy with the whole escrow (the diggers and the dev deposit, one price). Everybody then claims tokens in proportion to what they locked. A burrow that cannot surface refunds everybody in full.

The pad promises that diggers enter first, in one transaction. It does not promise that there are no bots: anyone can buy the coin on pump.fun right after the surfacing transaction.

LIFECYCLE

THE DIG GAME

The field is a grid of 4-24 x 4-24 cells with at least four cells per treasure. Its layout is a pure function of the seed: treasure i sits at the first sha256("mole/cell/v1" || seed || i || generation || counter) mod cells that is free.

• Sign in: your wallet signs a plain text message (no transaction, no SOL moves) and you pass a Cloudflare Turnstile human check. The wallet must hold at least 0.01 SOL: it is only read, never spent. The session lasts 30 minutes.
• Digs per hour: a token bucket per wallet. Every new wallet starts with 6 digs. Holding $DIG raises how fast digs come back: 6 an hour for every wallet; 9 from 100K $DIG, 12 from 1M, 18 from 10M (balance read on chain). Moving one bag of $DIG from wallet to wallet gives nothing: each new wallet still starts at 6.
• Per network: at most 10 sign-ins and 60 digs an hour from one IP address, whatever the wallets.
• Hints: an empty cell shows how many buried treasures touch it (8 neighbours), like minesweeper.
• One right per wallet per burrow. The creator cannot dig his own burrow.
• Rights expire: a found treasure must be funded within 180 s. Unfunded, it is re-buried at a cell anyone can recompute from the seed after the reveal.
• Everything is public: every dig (wallet, cell, time, result) and every re-bury is in the burrow's dig log while it is underground.

RIGHTS AND THE ESCROW

A right is an Ed25519 signature of the attestor over "mole/right/v1" || program || burrow || index || wallet || cap || expiry. claim_right checks it, creates the Right account (one per wallet per burrow) and moves your deposit into the escrow: min(amount, cap, room left), at least 0.02 SOL. Deposits are final until the burrow surfaces or is cancelled.

SURFACING

One instruction, alone in its transaction (only compute budget next to it): it checks the metadata against the committed hash, creates the coin with create_v2 (mayhem, holder rewards and cashback off) and buys once with the budget. The buy never offers more than the lamports that buy 15 % of the supply on the fresh curve; what it did not spend goes back pro rata (SOL back). Measured: a full 5 SOL escrow is capped at about 4.875 SOL = 14.84 % of the supply at 1.175 x the start price. The program asserts the escrow holds at most 15 % of the supply after the buy.

It is permissionless: the keeper sends it with the metadata the dig service keeps, and the creator can send it from the receipt the site gives at launch (name, ticker, link, salt).

NO SHOW, NO LOSS

A burrow that cannot surface is cancelled and every lamport goes back: each right gets 100 % of its deposit plus the Right account's rent, the creator gets the dev deposit, the rent deposit and the launch fee. Measured cost of a cancelled burrow to its creator: transaction fees only.

FEES AND $DIG

• Launch fee 0.02 SOL to the treasury, taken at surfacing (refunded on cancel).
• Rent deposit 0.05 SOL pays pump.fun's create and first-buyer rents (about 0.0102 SOL); the rest comes back with the dev share.
• Creator fees of every surfaced coin are split on chain: dev 40 %, $DIG buyback 20 %, treasury 40 %.
• The $DIG share sits in the dig pot. buy_dig spends it on $DIG through a price guard (median of recent observations, max impact 1 %) and burns every token bought.

COMPROMISES, IN PLAIN WORDS

• "Hide the coin for 10 minutes on pump" is impossible. A pump coin is public from its create transaction. So the coin is not created at all until it surfaces; until then it is a hash.
• The first buy is one pooled buy, not a race. Diggers do not buy one by one before the public; they all sit in one buy in the creating instruction, at one price. Bots buy right after it.
• The dig game runs off chain. The field, the hints and the rights come from the dig service. The seed is committed before the first dig and revealed after, so every hint can be checked; it cannot be made impossible to cheat while the round runs.
• Rights are capped, not free. A cap per right, a cap per burrow (at most 5 SOL) and one right per wallet stop a whale from taking the launch.
• Bot farms are slowed, not stopped. A wallet signature, a human check, 0.01 SOL in the wallet and per-network limits make each extra digger cost something. A farm with many funded wallets, many IP addresses and solved checks can still dig, and one right per wallet does not stop it from collecting many rights.

TRUST POINTS

• The dig service (attestor) knows every seed while burrows are underground and decides who gets a right. It could tip a friend or sign a right without a dig. Checkable after the fact: the round code, the public log, the rights list and the on-chain reveal show any right without a matching treasure dig. The program bounds it: rights only up to the burrow's cap, one per wallet, the escrow cap, at most 15 % of the supply, only while underground.
• The keeper surfaces, reveals, pushes claims and refunds, and collects fees. Every one of these is permissionless; anyone can do them from the burrow page.
• The guardian can veto (cancel) an underground burrow, which refunds everybody. It cannot touch a surfaced coin.

ADMIN CAN

• Pause new burrows and new deposits (claims and refunds keep working).
• Change parameters, with a 1-day timelock the guardian can cancel; every burrow keeps the parameters it opened with.
• Rotate the attestor or the guardian (3-day timelock), set the $DIG mint once, upgrade the program (the upgrade authority is a trust point like every upgradeable program).

ADMIN CANNOT

• Move escrow, Fees or dig pot funds: no instruction lets it.
• Create a right, change a burrow's caps or seed, or stop a refund.

IF THE PAD CLOSES

The site shows a SUNSET banner and stops taking new burrows. Underground burrows either surface or are cancelled by the rules above; claims, refunds and the dev share stay open on chain forever.

VERIFY ON CHAIN

1. The program id is Dig3eAVxdv5Cd6Pek741FfMAB1Te3wcVYqghMRH3gTCK. Config PDA ["config"].
2. A burrow is the PDA ["burrow", round code]. Its meta_hash = sha256("mole/meta/v1" || len || name || len || ticker || len || uri || salt).
3. After surfacing, field_seed is on the burrow account and sha256(seed) == round code (checked by reveal_field).
4. Open any surfaced burrow and press VERIFY FIELD: your browser recomputes the layout from the seed and replays every dig and re-bury of the public log.
5. The surfacing transaction has one instruction of this program: create_v2 and the buy are its inner instructions. Open it from the burrow page.
6. The coin's pump.fun creator is ["fees", mint] of this program; its curve is created in the same instruction as the buy.

PARAMETERS

Live from the config account (version -). Each burrow copies them when it opens.

ACCOUNTS AND SEEDS

INSTRUCTIONS

ERRORS

What the program answers when it refuses, from its IDL.

RISKS

• The metadata becomes public at surfacing; a copycat can launch the same name after us (not before: it is hashed with a salt).
• Bots can buy in the same block right after the surfacing transaction. They pay a higher price than the diggers (about 1.36 x the start price after a full escrow).
• The dig service knows the seed during the round (see Trust points).
• A bot farm with many funded wallets and IP addresses can still win many rights; each one is capped.
• If pump.fun raises its create rents above the rent deposit, surfacing fails until the parameter is raised; the burrow is then cancelled with full refunds.
• Ticker $DIG is also used by another live coin. Check the CA posted here and on our X.

FAQ

DO I PAY TO DIG?

No. Signing in is a signed message, digging is off chain. The wallet needs 0.01 SOL in it to sign in, but nothing is taken. You pay only when you fund a right (your deposit + about 0.0016 SOL account rent, returned at claim).

WHY ONLY 6 DIGS WITH 10M $DIG?

A new wallet always starts with 6. $DIG makes digs come back faster (up to 18 an hour) and lets a wallet that keeps holding store up to its tier. That way one bag moved between wallets is worth nothing.

WHAT IF NOBODY SURFACES IT?

Anyone can cancel it after the window, and every right is refunded in full. The keeper does it on its rounds.

CAN I WITHDRAW A DEPOSIT?

No, deposits are final until the burrow surfaces or is cancelled. That stops a seat being parked and pulled at the last second.

WHY CAN'T I SEE THE COIN WHILE IT IS UNDERGROUND?

Because it does not exist yet. Only its hash is on chain; the name and picture appear when it surfaces.