Operations
Security model
Every authority PrimerPad relies on, who controls it today, what its compromise would allow, and where it must end up before production. Full detail in SECURITY_ROLES.md.
Authorities
| Authority | Controlled by (today) | What it can do | Planned final control | Multisig |
|---|---|---|---|---|
| Primer fee claimer (DBC partner) | Test wallet per network | Claims the partner share of curve-phase fees on every pool of its configs; withdraws partner surplus and migration fee (0% in v1). Immutable per config: changing it means new configs. | Squads multisig | Required |
| Primer locked-LP position owner | Same key as the fee claimer | Claims fees of the 77% locked DAMM v2 position. Cannot withdraw locked liquidity. | Squads multisig | Required |
| Leftover receiver | Same key as the fee claimer | Receives leftover base tokens after migration (zero under Primer Standard v1). | Squads multisig | Recommended |
| Config registry (PrimerPad data) | Repository data files | Decides which config a launch uses and which pools count as PrimerPad markets. | Reviewed deploy artefact | Process control |
| Operator | Hot wallet | Pays rent and fees for config creation and tests. Cannot redirect fees. | Hot wallet, minimal SOL | No |
| Migration watcher payer | Operator hot wallet | Pays migration rent. Migration is permissionless and its destinations are derived, so the payer cannot redirect liquidity. | Dedicated hot wallet | No |
| Pool creator | Each launch creator | Claims the creator fee share; owns the 23% locked position; can transfer the creator role. | The creator | User-owned |
| Base token mint / metadata authority | None | Revoked at launch (immutable authority option). | None | n/a |
| Helius API key | Server environment | RPC quota and chain reads. No funds. | Secret manager | n/a |
| Quote issuers (Stable, Ondo) | External | Freeze authority; Ondo can pause transfers or enable a transfer hook. | External, monitored | n/a |
| Meteora (program upgrade, TokenBadge operator) | External | Upgrades DBC and DAMM v2; issues and can close TokenBadges. | Trusted dependency | n/a |
SOURCE CODE Verified in the DBC source: fee_claimer is written only by create_config (no update instruction); migration_damm_v2 needs only a payer signer; the two migrated positions are minted to config.fee_claimer and virtual_pool.creator.
Before production
Production configs must be created with a Squads vault as fee claimer and leftover receiver. Pools on development configs keep paying the development address forever, because the fee claimer cannot be changed.
Key hygiene
- Key files live under a gitignored directory and are never committed.
- Helius endpoints are read from server-side environment files; logs redact the API key; the browser bundle never contains them.
- The development mainnet test wallets had their seed phrases displayed during setup. They are treated as exposed and test-only: smoke-test amounts only, never promoted to treasury.
- Production keys are generated offline, with the treasury as a multisig from day one.
Browser launches
The Create page never holds a private key. A launch takes one wallet signature and four steps:
- Build. The server compiles the Meteora createPool instruction for the certified config of the chosen market, with an optional first buy in the same transaction. It generates a fresh keypair for the new token's mint and simulates the whole transaction against the live program before returning it. A launch that would fail is rejected here, with the program logs.
- Sign. The wallet shows the transaction and the creator signs it as fee payer and pool creator.
- Co-sign. The mint keypair travels between the two server calls only inside an AES-256-GCM sealed token that expires after ten minutes. On submit the server checks that the fee payer is the wallet from the build step, that the transaction creates that mint, and that it calls the DBC program with a PrimerPad config. Only then does it add the mint signature and send.
- Confirm. The page polls the signature status. Resubmitting the same transaction cannot create a second token: the mint address is fixed by the sealed key.
The browser reaches Solana through /api/rpc, a read-only proxy that allows only balance, account, blockhash and signature-status methods. The Helius URL and key stay in server environment variables. Token metadata is served from /api/token/<mint>, which reads name and symbol from the token's on-chain Metaplex account rather than from the request.
See also: Transaction safety, Failure modes