Peg Launch,
explained.

What Peg Launch creates

A Peg Launch pair consists of two separate SPL or Token-2022 mints, two independent Pump bonding curves, one on-chain configuration account and one program-derived treasury vault. The tokens are not wrapped, merged or redeemable for one another. The target is maintained through market purchases: when one token becomes sufficiently cheaper, the treasury buys that token.

This is a treasury-supported soft peg. It is an active market-support mechanism rather than a collateral redemption mechanism. Price convergence depends on available treasury capital, liquidity, transaction execution, outside demand and the size of the imbalance.

Immediate A/B liquidity

Immediately after registration, the executor begins a one-time bootstrap. Fifty percent of the spendable treasury is divided between Pump bonding-curve purchases of A and B, forty percent remains for active corrections, and ten percent is isolated in an operational-reserve PDA. The purchased tokens seed a permanent Raydium CPMM A/B pool controlled by the treasury PDA.

The bootstrap advances through prepare, buy A, buy B and create-pool phases. Each completed phase is recorded on-chain, preventing a worker restart from repeating a purchase. The A/B pool is created before graduation and remains valid afterward because graduation does not change either mint address.

From form to registered pair

1. The creator connects a Solana wallet and enters metadata for Token A and Token B.
2. The creator selects an initial buy for each token and a separate custom peg-treasury deposit.
3. Peg Launch uploads metadata and asks Pump’s builder to construct both launch transactions.
4. Both transactions are simulated before the creator is asked to sign them.
5. The wallet signs both launches; the app submits them close together and confirms each mint independently.
6. After both mints confirm, a final wallet approval initializes the Peg Launch registry, assigns the restricted executor and transfers the selected SOL amount into the treasury vault.
7. The Railway worker begins reading both curves. It checks approximately every 20 seconds and prepares a rebalance when deviation reaches the configured threshold.

The mint addresses are shown before launch and again after confirmation so a partially successful launch can be recovered without accidentally creating a duplicate token.

Choosing a treasury amount

The treasury amount is independent from the creator buys. A larger treasury increases the total amount available for repeated support purchases, but it does not guarantee stability. A useful budget depends on the bonding-curve reserves, outside trading volume, desired correction speed and how long support should continue.

Corrections are sized by measured deviation. The executor may use up to 15% of the correction treasury at 5–10% deviation, 30% at 10–25%, and 50% at deviations of 25% or more. It may always choose a smaller trade, and the contract enforces the applicable ceiling.

How the worker decides to buy

For tokens still on their Pump bonding curves, the worker reads the virtual quote and token reserves and compares the two executable curve prices. If the difference is below 5%, the pair is reported as in band and no transaction is created. At or above 5%, the worker identifies the cheaper mint, obtains a fee-aware Pump quote, creates missing token and volume-tracking accounts with the executor paying their rent, and builds a buy from the treasury vault.

The complete transaction is simulated first. Only a successful simulation is submitted. The Peg Launch program then validates the executor, pair, mint, target program, instruction discriminator, quote age, deviation, expected improvement, slippage, cooldown and spending limits before signing for the treasury PDA.

Before migration, the worker supports the cheaper bonding curve while the permanent A/B pool provides a direct arbitrage route. If only one token migrates, correction execution pauses during the mixed-market phase. After both migrate, the same A/B pool remains active and the canonical A/SOL and B/SOL PumpSwap markets become available as additional price routes.

On-chain safety controls

Public protocol addresses

All addresses below are public Solana identifiers. No private key is stored in the repository or displayed by the application.

Pair configuration and vault

The configuration PDA is derived from ["config", authority]. The treasury vault PDA is derived from ["vault", configuration]. Consequently, every creator authority receives an isolated configuration and vault, while the currently deployed contract supports one registered pair per authority wallet.

The configuration stores the authority, executor, Token A, Token B, limits, daily spend accounting, last execution timestamp, failure count, pause status and PDA bumps. The vault is system-owned and can sign only through Peg Launch program-derived seeds. The Railway executor does not possess a vault private key because no such private key exists.

What automation can and cannot do

The executor signs rebalance requests and pays ordinary transaction fees plus supported setup-account rent. It cannot update pair settings, replace the authority, withdraw vault SOL or sell treasury tokens. A compromised executor could still make unfavorable permitted purchases, so the cycle, daily, mint, program, discriminator, slippage and cooldown restrictions remain important.

The production executor address is public, while its signing key is stored only as a Railway secret and in the ignored local .secrets directory. The upgrade authority is separate from the executor and should never be placed in Railway.

Risks and trust assumptions

Independent vaults prevent one pair from directly spending another pair’s treasury. Outsiders cannot call the protected rebalance instruction without the configured executor signature. Nevertheless, market participants may manipulate thin liquidity, create a temporary deviation, trade against treasury demand or repeatedly consume the daily allowance. The current deviation and expected-improvement values are supplied by the trusted worker rather than independently proven by an on-chain oracle.

For larger treasuries, additional protections should include time-weighted prices, minimum-liquidity requirements, multi-source quotes, sandwich protection, per-pair executor keys, anomaly limits and external security review. A larger treasury increases support capacity and also increases capital exposed to market and automation risk.

Managing an existing pair

The Manage Peg page lets the launch authority recover a pair using both mint addresses, inspect its configuration and vault, assign the production executor and add SOL. Adding funds does not bypass contract limits; it increases the balance from which percentage caps are calculated.

The public health endpoint at /api/peg-health reports whether the worker is enabled, whether required secrets and RPC configuration are present, its latest stage, measured deviation, error category and last confirmed signature. It never returns private keys or the paid RPC URL.

First automated rebalance

The first production rebalance was confirmed for the registered test pair after a 16.97% deviation. The vault spent 0.001861093 SOL while remaining within the 2% cycle limit. Pump’s required tracking-account rent was paid by the executor rather than deducted from the treasury.

View the confirmed rebalance transaction ↗