How it works

Cosign is a pump.fun launcher. Each coin comes with a vault: a Squads v4 multisig that holds the dev buy and receives the coin's creator fees. Nothing leaves it without enough signatures and a time lock, and the site shows every proposal while the lock runs. This page says exactly what the site signs, what it reads, and what it can't do.

1. Before the launch

You pick 2 to 5 keys (Solana wallets), a threshold of at least 2, a time lock from 24 hours to 30 days, and the share of the dev buy that goes into the vault (50, 75 or 100 %). Your browser makes two new keys: the coin's mint key, and a one-time create key for the multisig. The multisig's address comes from that create key, so it is known before anything is signed.

The image and a metadata JSON are pinned on IPFS (Pinata). The JSON holds createdOn: https://cosign.market, the coin page as its website, a line in the description, and "cosign": { "v": 1, "multisig", "vault", "members", "threshold", "timeLockSec", "devShareBps" }. pump.fun stores the metadata address at creation, and an IPFS address is the hash of its content: this promise can't be edited afterwards. The server derives the multisig and vault from the create key's public half; your browser derives them too and refuses to go on if they differ.

2. The launch

PumpPortal's Local API builds the creation transaction (create + dev buy in one transaction, so nobody can buy before you). Before your wallet opens, the site checks that you pay for it and that it calls only pump.fun, the token programs, Metaplex, the system and compute-budget programs, and PumpPortal's router (identified on an explorer). Your wallet signs, then the mint key. The signed transaction is simulated: if it would take more SOL than the review showed, it isn't sent. After it lands, the server re-reads it on-chain (success, pump.fun called, mint present, coin trading against SOL, the payer is the creator, metadata written by Cosign, vault derived from its multisig) before listing the coin. It also records the dev buy: what your token balance gained in that transaction.

3. The seal

Two transactions, built in your browser with the official Squads and pump.fun SDKs, signed in one wallet prompt, sent in order:

1. Vault. multisig_create_v2 on Squads v4 with your keys (all permissions), your threshold and time lock, no config authority and no rent collector, signed by you and the create key. Then the dev tokens move from your wallet to the vault's token account (created if needed).
2. Fees. On pump.fun's fee program: create_fee_sharing_config, then update_fee_shares with the vault as the only shareholder at 10,000 bps. pump.fun lets a split be set once and locks it (adminRevoked). A sweep of the curve's creator-fee bucket goes first when it isn't empty.

The vault transaction goes first on purpose: fees routed to the vault of a multisig that doesn't exist yet could never be spent. If the second transaction doesn't land, the coin shows “Partly sealed” and its page offers the creator to send it again. Until the multisig exists, the create key stays in your browser (localStorage, for this coin only) so a closed tab can finish the seal; it is deleted once the multisig exists, and it has no power over the multisig after creation.

Both transactions were simulated on mainnet as the real creator of a real pump.fun coin before this site was published (807 and 892 bytes with 5 keys, under Solana's 1,232; Squads' creation fee read as 0 SOL; the fee split came out with the vault at 100 % and adminRevoked: true). See the README.

4. Spending from the vault

Cosign has no key and no button that moves funds out. The keys use the Squads app (or any Squads v4 client): create a vault transaction, propose it, approve it with enough keys, then execute it. Squads refuses to execute before approval time + time lock. Rule changes (keys, threshold, time lock, spending limits) are config transactions and wait out the same lock. Creator fees reach the vault when someone calls pump.fun's permissionless distribution; any visitor can do it from the coin page, paying only the network fee.

5. What the site reads

• The multisig account: keys, permissions, threshold, time lock, config authority, transaction indexes.
• The 25 most recent transactions and proposals. Vault transactions are decoded instruction by instruction: transfers of this coin, of other tokens and of SOL are named with their destination; anything else is shown as “a program Cosign doesn't decode”, never as harmless. Batches aren't decoded and count as exits.
• What the vault holds (SOL and this coin), what the launching wallet still holds, and pump.fun's fee split for the coin.
• The coin's price and market cap from its bonding curve or PumpSwap pool.

A coin is “Sealed” when the multisig exists with no config authority, the fee split sends 100 % to its vault and is locked, and the vault holds at least the promised share of the dev buy. The page also lists how today's multisig differs from the promise in the metadata (keys, threshold, time lock). The same data is public JSON at /api/coin/<mint>.

Who enforces what