How it works
- Open. Anyone opens a round: name, ticker, picture, a clock (10 to 60 min by default), a cap, a minimum and per-wallet limits. The opener pays a small launch bond and the round's account rent.
- Queue. While the clock runs, anyone but the opener deposits SOL into the round's escrow, a program address that holds only that round's money.
- Fire. When the clock ends with at least the minimum queued, anyone can fire. One transaction creates the coin on the launch venue, locks its creator-fee split, and buys it with the whole queue at one price.
- Claim. Each wallet claims its tokens pro rata, plus its share of any SOL above the cap. Tokens can stay in the round to earn the queue's fee share.
- Or refund. Below the minimum at the clock's end, or with no fire before the deadline (30 min after the clock), no coin is created and every deposit comes back.
Rules the program enforces
Each rule is a check inside the named instruction. If it fails, the transaction fails and nothing moves.
- open_round
A round's terms are fixed at open.
Name, ticker, picture hash, clock, cap, minimum and per-wallet limits, plus a snapshot of every protocol setting, are written once. Later admin changes only affect future rounds.
- open_round
A limit on open rounds per opener wallet.
TooManyOpenRounds. The opener pays a launch bond that covers the coin's accounts at fire.
- deposit
The opener's wallet can't deposit.
OpenerCannotDeposit. The opener could use other wallets; per-wallet limits bound how much each can take.
- deposit
Deposits only while the clock runs.
WindowClosed at or after end_ts. The chain's clock (unix timestamp) is the only clock the program reads.
- deposit
Per-deposit minimum, per-wallet maximum, and a ceiling.
BelowMinDeposit, WalletMaxReached, RoundFull. The ceiling is the cap times the oversubscription factor.
- deposit
No withdraw before fire.
There is no withdraw instruction. A full queue can't be faked and pulled at the last second.
- cancel_round
The opener can cancel only an empty round.
HasDeposits once anyone is in.
- fire
No early fire.
WindowNotOver before end_ts, even with a full queue. Anyone can fire after it; the caller gets nothing for it.
- fire
Fire needs the minimum.
MinNotReached below it. The round refunds instead.
- fire
Create, fee lock and buy in one instruction.
The coin is created with a fresh address chosen at fire, its creator-fee split is locked (admin revoked), then the whole queue buys at once. Nothing can run between those steps.
- fire
A floor on tokens bought.
SlippageExceeded if the venue would return fewer tokens than the program computes from the fresh curve and the highest accepted venue fee.
- fire
A deadline to fire.
FireDeadlinePassed after end_ts + the fire grace. Then the round is refundable.
- refund
Refunds need nobody.
Anyone can refund any position once the round missed its minimum or passed its fire deadline. Refunds can't be paused. Each deposit comes back exactly.
- claim
Pro rata, floor rounding, same price for everyone.
Each position gets floor(tokens × deposit / total) and floor(excess × deposit / total). Rounding dust stays in the round.
- claim
Only the depositor claims their tokens.
NotPositionOwner: nobody can force your tokens out of the vault and stop your fee share.
- set_pause
The admin can pause opening, deposits and fire. Never refunds or claims.
A pause can only lead to refunds. There is no admin withdraw of any kind.
Where the SOL goes
Escrow SOL can only go to: the coin's purchase (and its account rent, paid from the opener's bond, never from deposits), the treasury (the protocol fee, once), the depositors (refunds and excess), the round's two fee vaults (their rent, from the bond), and the opener (what is left of the bond).
Worked example, cap 20 SOL, minimum 3, ceiling 3 × cap, 1 % fee: 200 wallets queue 50 SOL. The round buys with 20 SOL: 0.2 SOL fee, 19.8 SOL spent on the coin, 30 SOL stays for the queue. A wallet that put in 1 SOL gets 0.6 SOL back and 2 % of the tokens bought.
Fees and the creator-fee split
- Protocol fee, at fire
- 1 % of the buy
- Coin's creator feesSet by the program at fire; Yub can't change them later. The launch venue's own admin can (see Risks).
- queue 60 % · opener 30 % · Yub 10 %
- Highest venue trade fee the fire floor accepts
- –
- Per wallet, at most
- 15 % of the cap
The creator fee rate itself is set by the launch venue and varies with the coin's market cap. As an illustration only, not a promise: at a 0.30 % creator fee, 100,000 USD of trading pays 300 USD in creator fees: 180 to the queue, 90 to the opener, 30 to Yub.
Fairness: what the opener can and can't do
Yub is “buy” backwards, and the order is the point: buyers first, the coin second, the dev last. The opener (the dev of the coin) can't deposit from the opening wallet, and their share of creator fees only exists once the coin trades after fire. What that order does and doesn't cover:
Can't: deposit from the opening wallet, change terms after open, cancel once anyone has deposited, fire early, redirect fees, touch the escrow, or act in fire, refund or claim in any special way.
Can: deposit from other wallets. Each one is held to the per-wallet maximum, pays the queue's one price and gets its pro-rata share like everyone else (rounded down to the token's smallest unit, as for all); deposits above the cap are still accepted, up to the ceiling (a multiple of the cap), and everyone is scaled down pro rata, so filling the cap first locks nobody out. Filling the ceiling does: once the total reaches it, every later deposit is refused. That takes a handful of wallets at the per-wallet maximum and the whole ceiling in SOL, bought at the queue's price (see Risks). Round pages show the share of the largest wallet and of the five largest, and flag wallets funded from the same source in the last 24 hours (information only).
Bots can't buy before the queue, can't buy cheaper than the queue, and can't know the coin's address before fire. They can buy right after the queue, at a higher price, and sell their claimed tokens like anyone.
Risks
Read these before you deposit. They are real, and none of them is solved by this page.
- There is no audit. No security audit of the Yub program has been done. It is new code that holds up to a round's ceiling in SOL per round. A bug could lose deposits.
- Whoever holds the program's upgrade authority can replace the program, and a replaced program could do anything with the SOL in escrow. On this devnet preview that authority is the deployer's devnet key, a single wallet; on mainnet it is a single owner hardware wallet. The program may be made immutable later, and until then you trust that wallet. Its address is on the status page, read live.
- Yub depends on the venue the coin is created on. Coins are created and bought on a third-party launch venue. If that venue changes or stops, rounds refund and nothing launches. Its own admin can also change a coin's creator-fee sharing after the fact.
- An opener with many wallets can hold a large share of their own queue. Each of those wallets is held to the per-wallet maximum and pays the same price as everyone else, no earlier; but together they can own much of the coin bought, and enough of them can fill the round's ceiling, after which nobody else can deposit. Round pages show what the largest wallets hold.
- Launch limits are conservative at first and may change. The admin can change them for future rounds; a round's own terms are fixed when it opens.
- Market risk. Coins can lose most or all of their value right after launch. Anyone can sell claimed tokens at once; buyers after the queue pay more and may sell into the queue.
- Locked time. Your SOL is locked until fire or refund: at most the window plus the fire grace.
- Opener statements. Names, pictures, descriptions and terms are written by openers. Yub doesn't check them; the program only enforces the round's parameters.
Questions
Can I take my SOL out before the clock ends?
No. That's on purpose: withdrawals would let someone show a full queue and pull out at the last second. Your SOL is locked until fire or refund, at most the window plus the fire grace.
What if the queue is bigger than the cap?
Everyone gets in. At fire the round buys with the cap; the rest is paid back pro rata at claim. A wallet that put in 1 SOL of a 50 SOL queue on a 20 SOL cap buys with 0.4 SOL (minus the 1 % fee) and gets 0.6 SOL back.
Who fires the round?
Anyone. Yub's crank fires within about a minute after the clock; the round page has a Fire button too. Firing pays the caller nothing.
Why does the opener get nothing at launch?
Their wallet can't join the queue, so they hold no tokens at block 0. Their upside is a share of the coin's creator fees for as long as it trades: they come last.
What does keeping tokens in the round do?
The queue's share of the creator fees is paid to tokens still in the round's vault, in proportion to how many each wallet keeps. Take them out any time; from then they stop earning it.
Does Yub have a token?
Yub has no token.
What happens if Yub's server goes down?
Every action (deposit, fire, refund, claim) is built in your browser and sent to the program on devnet. Round pages and Mine read the chain directly when the server is down; the chat and queue lists wait for it.
Verify it yourself
- Open a round page and copy its round account, escrow and fee vault addresses from the terms table.
- Look them up on an explorer: every deposit is a transaction to the escrow; the round account holds the terms.
- Program: shown on the status page. Its upgrade authority and admin are on the status page, read live.
- After fire, the fire transaction shows the coin created, the fee split locked and the single buy, in that order, in one instruction.