Security

Where your SOL is

What StakeStage controls, what it doesn't, and how to report a vulnerability.

Artist coins live on pump.fun

  • Every artist coin is created on pump.fun from StakeStage, with the artist's wallet as its creator. It trades on pump.fun's bonding curve and later in its PumpSwap pool — on StakeStage and on any app that supports pump.fun.
  • StakeStage has no program of its own holding funds. When you buy or sell here, your wallet signs a pump.fun transaction; the SOL goes between your wallet and pump.fun's curve or pool. StakeStage never holds your SOL or tokens.
  • Each coin has a fixed supply of 1,000,000,000. The artist's first buy is in the launch transaction, so nobody can buy before them.
  • pump.fun is run by a separate company. Its programs, fees and rules are theirs and can change; StakeStage can't pause, reverse or block trades.

pump.fun program: 6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P

What StakeStage controls

  • Its share of creator fees. pump.fun pays each coin's creator a fee on every trade. The artist splits it 50% to themselves and 50% to the platform wallet (HP31…THKc). Paying it out sends each share straight to its owner.
  • The card key (BV8g…wcpg) lives on the StakeStage server. It mints each collectible card once — one per wallet per release, checked against the holder snapshot — and switches minting off for that card. It can't move SOL or tokens.
  • The site. Profiles, releases, holder-only content and which coins are listed. Only coins with the fee split set are listed; pump.fun locks the split once it's set, so neither the artist nor StakeStage can change it later.

Bug bounty

Found a way to break StakeStage? Tell us privately and we'll pay for it. In scope: this website (sign-in, trading and launch transactions it builds, holder-only content, card minting, APIs). Out of scope: pump.fun's own programs and apps (report those to pump.fun), wallet apps, spam or denial of service, social engineering, and issues that need a compromised device.

CriticalMaking the site send fans' SOL or tokens anywhere they didn't sign for, or taking over the card-minting key.Up to 1.5 SOL
HighForging collectible cards at scale, taking someone's fee share, or reading holder-only content without holding.Reward by impact
MediumWrong prices or balances shown that could mislead a buyer; signing in as another wallet.Reward by impact
LowSmaller issues with a real security impact.Thanks + credit

Rewards depend on severity and the funds at risk. The first reporter of an issue gets the reward.

Rules

  • Test on devnet or your own local copy. Never touch other people's funds or data.
  • Show the problem with the smallest possible proof; don't exploit it further.
  • Report privately and give us time to fix it before telling anyone. We reply within 72 hours.
  • If you follow these rules in good faith, we won't pursue legal action against you.

How to report

Email stakestage.security@gmail.com with the steps to reproduce, the impact, and your Solana address for the reward.

Questions about coins and risks? Read Safety and risks before you buy.