Security
Where your SOL is
What StakeStage controls, what it doesn't, and how to report a vulnerability.
Artist coins live on pump.fun
- Every artist coin is created on pump.fun from StakeStage, with the artist's wallet as its creator. It trades on pump.fun's bonding curve and later in its PumpSwap pool — on StakeStage and on any app that supports pump.fun.
- StakeStage has no program of its own holding funds. When you buy or sell here, your wallet signs a pump.fun transaction; the SOL goes between your wallet and pump.fun's curve or pool. StakeStage never holds your SOL or tokens.
- Each coin has a fixed supply of 1,000,000,000. The artist's first buy is in the launch transaction, so nobody can buy before them.
- pump.fun is run by a separate company. Its programs, fees and rules are theirs and can change; StakeStage can't pause, reverse or block trades.
pump.fun program: 6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P
What StakeStage controls
- Its share of creator fees. pump.fun pays each coin's creator a fee on every trade. The artist splits it 50% to themselves and 50% to the platform wallet (HP31…THKc). Paying it out sends each share straight to its owner.
- The card key (BV8g…wcpg) lives on the StakeStage server. It mints each collectible card once — one per wallet per release, checked against the holder snapshot — and switches minting off for that card. It can't move SOL or tokens.
- The site. Profiles, releases, holder-only content and which coins are listed. Only coins with the fee split set are listed; pump.fun locks the split once it's set, so neither the artist nor StakeStage can change it later.
Bug bounty
Found a way to break StakeStage? Tell us privately and we'll pay for it. In scope: this website (sign-in, trading and launch transactions it builds, holder-only content, card minting, APIs). Out of scope: pump.fun's own programs and apps (report those to pump.fun), wallet apps, spam or denial of service, social engineering, and issues that need a compromised device.
Rewards depend on severity and the funds at risk. The first reporter of an issue gets the reward.
Rules
- Test on devnet or your own local copy. Never touch other people's funds or data.
- Show the problem with the smallest possible proof; don't exploit it further.
- Report privately and give us time to fix it before telling anyone. We reply within 72 hours.
- If you follow these rules in good faith, we won't pursue legal action against you.
How to report
Email stakestage.security@gmail.com with the steps to reproduce, the impact, and your Solana address for the reward.
Questions about coins and risks? Read Safety and risks before you buy.