02 / Hooks / launch-shield
Launch Shield
Time-boxed limits on routed execution while a market is being activated.
01
Behavior
- Per-wallet cooldown between routed buys (optionally sells).
- Maximum routed buy and sell size during the protected window.
- Maximum routed buys per slot; optional denial of same-slot buy→sell round trips.
- Window starts at market activation or a fixed timestamp and lasts at most 30 days.
Limitation. Applies to trades routed through Pump Hooks only. A transaction that trades on Pump directly is not affected.
02
Callbacks
ABI v1 · wire values frozen| # | Callback | Subscribable | Default | Semantics |
|---|---|---|---|---|
| 0 | BeforeBuy | yes | ● | Routed buy, before the Pump CPI. Can deny. |
| 1 | AfterBuy | — | Routed buy, after the Pump CPI. Sees executed amounts; can still fail the transaction. | |
| 2 | BeforeSell | yes | ● | Routed sell, before the Pump CPI. Can deny. |
| 3 | AfterSell | — | Routed sell, after the Pump CPI. | |
| 4 | BeforeSwap | yes | Either side, before the Pump CPI. Can deny. | |
| 5 | AfterSwap | — | Either side, after the Pump CPI. | |
| 6 | BeforeLiquidity | reserved | Reserved (wire value 6). | |
| 7 | AfterLiquidity | reserved | Reserved (wire value 7). | |
| 8 | BeforeFeeAction | reserved | Reserved (wire value 8). | |
| 9 | AfterFeeAction | reserved | Reserved (wire value 9). | |
| 10 | OnGraduation | reserved | Reserved (wire value 10). | |
| 11 | OnStrategySignal | reserved | Reserved (wire value 11). |
03
Capabilities
granted at install; enforced by the executor| ■ | READ_MARKET | Read market config, venue reserves and the trade context |
| ■ | VETO_ROUTED_SWAP | Deny a routed trade in a before-callback (reverts the transaction) |
| ■ | WRITE_HOOK_STATE | Persist its 48-byte slot state on the market |
| □ | WRITE_USER_STATE | Update the trading wallet's per-market state |
| □ | AWARD_POINTS | Credit XP / points in the wallet's per-market ledger |
| □ | TREASURY_SIGNAL | Emit treasury allocation intents for the strategy vault |
| □ | STRATEGY_EXECUTION | Bound or request vault strategy execution (TWAP, orders) |
| □ | ORACLE_READ | Read an external oracle account (reserved; not granted in V1) |
| □ | EXTERNAL_CPI | Call an external hook program (reserved; no permissionless CPI hooks in V1) |
| □ | EMIT_SIGNAL | Emit or consume signed strategy signals |
04
Config schema
48 bytes · little-endian| Field | Type | Offset | Unit | Preset | Description |
|---|---|---|---|---|---|
| startTs | i64 | 0 | timestamp | — | Protection start (0 = market activation) |
| durationSecs | u32 | 8 | seconds | 3600 | Length of the protected phase |
| cooldownSecs | u32 | 12 | seconds | 30 | Per-wallet cooldown between routed buys |
| maxBuyQuote | u64 | 16 | lamports | 1 SOL | Max routed buy size (0 = none) |
| maxSellQuote | u64 | 24 | lamports | — | Max routed sell size (0 = none) |
| maxBuysPerSlot | u16 | 32 | count | 4 | Routed buys per slot (0 = none) |
| flags | u16 | 34 | flags | 1 | bit0 deny same-slot round trips, bit1 cooldown applies to sells |
05
Identity
Module ID
1 (0x0001)
Version
v1
Developer
Pump Hooks
Program
91kRNewiED… (built-in)
Priority range
0–999 · default 100
Markets
bonding-curve · pumpswap
Source
crates/hook-runtime/src/modules/launch_shield.rs
Verification
source in this repository; reproducible-build verification not yet published
Audit
unaudited
06