Called

A window can only be held open while the coin does not exist

Everything else here follows from that one constraint. This page explains the constraint, what it buys, and what it costs.

Why the window works

A pump.fun buy cannot be gated. Its only signer is the buyer, and the bonding curve carries no start time, no trading flag and no permitted-buyer field. Nothing in the program pauses a single launch. Any design where the coin is already live during a restricted window is theatre, because the instruction set is public and bots watch for the create event.

So this does not try to lock a coin. It holds the window open before there is a coin to lock. When the window closes, creating the coin and buying its curve happen in the same transaction, which means there is no moment where the coin exists at the opening price and someone else can reach it.

Building that transaction now to measure it.

What counts as a caller

Posting a callout on pump.fun needs an account and a connected wallet, and it is filed under that wallet address. That is the gate. Three more proofs are read off the chain at the same time, and a creator can accept any of them.

proofwhere it is readcan it be faked
posted a calloutpump.fun's public callout routeno
has traded on pump.funthe wallet's volume account, on chainno
holds PUMPthe token balance, on chainno
holds a pump.fun cointhe coin's bonding curve, on chainno
is a pump.fun creatorthe creator vault, on chainyes

The creator vault never admits anyone

It is a plain system account with no data. Anyone can send SOL to it and make a wallet look like a creator, so it is shown on every wallet and counted on none.

An empty volume account proves nothing either

The instruction that opens it takes the wallet as a non-signer, so anybody can open one for anybody. Of a sample of recent pump.fun buyers, 87 percent had the account and only 58 percent had anything in it. Only a value above zero counts, because only pump.fun's own buy writes there.

The numbers

Read from pump.fun's own accounts when this page loaded. None of them are written into the code.

The fee is the one worth explaining. pump.fun's global account says the creator fee is 5 basis points. The real one is 30, because the buy instruction does not read that field at all and asks the fee program instead. Budgeting off the global account under-funds the launch and the transaction reverts.

What this does not do

—

It cannot stop one person using many wallets

No wallet may leave a window holding more than three percent of the supply. The ceiling is denominated in tokens rather than money, because the same money buys several times more tokens at the open than at the close. It raises the cost of splitting across wallets. It does not remove it, and nothing on chain can.
—

It cannot reach the pump.fun app's own wallet

That wallet is domain-bound, so someone who only uses it inside the app cannot send from it here. Use the wallet you connect to pump.fun with.
—

It cannot undo a deposit

Each one is priced against the state the one before it left, so unwinding a deposit mid-window would silently re-price everyone behind it. Money comes back only if the window misses its minimum.
—

It does not hold your money trustlessly

While a window is open the deposit key is held by whoever runs this. Each window gets its own key rather than a shared treasury, and that same wallet is what launches the coin, so the money is isolated and visible. It is still custody.