Docs

What a proof means, word by word. The FAQ answers the questions people actually ask; this page is the reference.

Scope statement

A FairProof proof attests that LP tokens of a specific LP mint, in a specific amount, were moved into a program vault until a specific date, and that the launch token’s authorities were renounced at lock time and are re-checked at read time. It does not attest that the LP mint is the main or only pool for the token, that the pool holds most of the liquidity, or that the LP supply cannot grow after locking. It says nothing about the people behind the token.

source: docs/pre-mainnet-review.md:510-514, 537-544; web/verify/README.md:366-371

Everything FairProof states is a statement about chain state as of a slot. Authorities live on the token mint, not on the proof: a renounce read today is a snapshot, not a promise about tomorrow, which is why the page re-reads them every time and prints the slot it read them at.

FairProof is not a scanner and not a score. A scanner covers every token; FairProof only speaks about tokens whose founder chose to use it. A token with no FairProof proof is Not Verified — a statement about the absence of a proof, not about the token.

Verdict semantics

The four labels are code constants — Locked & Fair, Lock Expired, Not Fair, Not Verified — and the chip on the page is the status with underscores replaced by spaces: FAIR, EXPIRED, NOT FAIR, NOT VERIFIED. No label is a bare “verified”.

source: web/verify/src/verify.ts:149-154; web/page/src/render.ts:276

Locked & Fair: All ten checks pass: the proof exists and is authentic, the vault is authentic and still holds the recorded LP, the mint account is real, the LP mint is real, the lock is still active by chain time, mint authority renounced, freeze authority renounced, no Token-2022 control surface, and the locked share meets the minimum. source: web/verify/src/verify.ts:12-25, 169-180
Lock Expired: The unlock time has passed or the LP has been withdrawn. LP is withdrawable. This is never shown as Locked & Fair. source: web/verify/src/verify.ts:26, 826-829
Not Fair: The proof is real and the lock is active, but a gate fails: live authority, a Token-2022 control surface, locked share below minimum, or the “LP” is the launch token itself. source: web/verify/src/verify.ts:27; web/verify/README.md:108
Not Verified: No proof exists for this mint, or the proof is tampered or inconsistent, or something could not be read. Nothing about the launch is asserted. source: web/verify/src/verify.ts:28-30; web/page/src/render.ts:225-232
Precedence: Not Verified beats Expired beats Not Fair beats Locked & Fair. No fallback can produce Locked & Fair. source: web/verify/src/verify.ts:32-33
Time: Time comes from the chain (Clock sysvar or block time), never from your computer’s clock. If only a local clock is available the result is Not Verified. source: web/verify/README.md:130-147
Read-time state decides: Renounce state is read from the token mint at verification time, not copied from the proof. Both are shown; the read-time state decides. The locked share is computed from the vault’s live balance against the LP mint’s live supply, using the program’s own integer math. source: web/verify/README.md:186-200, 124
Pinned configuration: The program id and RPC endpoint are pinned by the deployment; a URL that tries to override them is ignored and the page says so. The page never shows the green head unless the verdict is consistent, Locked & Fair, and computed under pinned configuration. source: web/page/README.md:39-72; web/page/src/render.ts:9-24, 259-268, 285-294

Linking to a proof

The proof page for a token is https://fairproof.app/<mint>, where <mint> is the token’s mint address (32–44 base58 characters) and nothing else. ?mint=<mint> and #/<mint> are also accepted. A link that names two different mints is refused and nothing is read, so a link author cannot show one mint in the visible path and have the page verify another. The check form submits to the same page.

source: web/page/src/config.ts routeFromLocation; docs/f8-runbook.md “Hosting layout”

Embedding the badge

The live badge endpoint is not serving yet. Until fairproof.app/<mint>/badge.svg answers with an SVG, embed the link, not a badge: paste https://fairproof.app/<mint> into the README, the pin and the listing. A link is what people click to see the verdict recomputed; a badge image that has no endpoint behind it would render as a broken image wherever it is pasted. The snippets appear here when the endpoint is live.

What your browser talks to

The RPC endpoint. The proof page has no backend. Your browser asks the RPC endpoint pinned by the deployment for the accounts it needs and runs the verifier locally; the page shows which endpoint it used. That provider sees the requests your browser makes, the way any RPC provider does. No account read and no verdict passes through us: the chain data goes straight from the RPC endpoint to your browser. source: web/page/README.md:3-7; web/page/index.html:130-132; web/page/src/render.ts:538-549
Our static host. Loading https://fairproof.app/<mint> is an ordinary page request to the host that serves these files, and the mint is in that URL. The host sees that request and nothing else; we keep no logs of it and run no analytics on the proof page. source: docs/f8-runbook.md “Hosting layout” (log retention); docs/marketing/site-brief-oracle.md §7
Nothing else. These pages and the proof page carry no cookies, no analytics script, no tag manager, no session replay and no third-party embed.
Explorer links on the proof page open a public block explorer when you click them. On mainnet, devnet and testnet the link carries only the address, signature or slot and the cluster name. On a deployment pinned to a custom RPC, the link may carry the RPC origin (scheme and host only — never a path, key or query string, which are withheld); the page footer says which. source: web/page/src/explorer.ts:6-15, 39-52; web/page/src/render.ts:550-551

Custody and admin posture

Only a program upgrade could touch vaults. Plan, to be executed and published before mainnet: fee treasury, program admin and upgrade authority are to be held in a Squads V4 2-of-3 multisig with a 24-hour timelock; the program stays upgradeable under that multisig for 90 days, then immutability is revisited. This is the single largest residual risk in the design and we say so. The multisig addresses, like the program id, are published here only once they are on-chain.

source: docs/owner-decisions-20260905.md:8-11; docs/f5-audit-lite.md:98-108; docs/pre-mainnet-review.md:470-501

The admin can pause new launches and new receipts in an emergency. Pause never blocks a founder from withdrawing an expired lock. The relaxed gate mode (allowing un-renounced authorities) exists in the program, is admin-only, and is off.

source: programs/fairproof/src/lib.rs:196, 68-71; docs/f5-audit-lite.md:123-132

Review posture

Adversarially reviewed; open source at mainnet GO: a self-review checklist with six findings (four fixed in code, two closed by policy) and a line-by-line pre-mainnet review, both published with the source at mainnet GO. No external audit at launch.

source: docs/f5-audit-lite.md:159-168; docs/pre-mainnet-review.md:211-222; docs/owner-decisions-20260905.md:12

Launching

The self-serve launch app lives on its own origin, launch.fairproof.app: connect a wallet, choose the LP mint, amount and unlock date, review fee, rent and total, sign one transaction, and get the proof-page link back. It refuses to quote if the on-chain fee differs from 0.25 SOL, and it mirrors the program’s gates before you sign so a refused launch costs you nothing.

Launch fair (coming soon)

The self-serve launch app is built but not open yet: it cannot send a transaction until the mainnet GO. Launching opens to everyone at once, at GO.

source: docs/f8-runbook.md:127-139, 208; web/app/src/config.ts:17-18, 78

Glossary

Mint: The on-chain identity of a token; its address is what the proof page takes as input.
Mint authority: The key allowed to create more of the token. “Renounced” means no such key exists any more, so supply cannot be inflated.
Freeze authority: The key allowed to freeze any holder’s tokens in place. Renounced means nobody can freeze you.
Liquidity pool (LP) / LP token: The pool of the token plus SOL that lets people trade; LP tokens are the receipt for having put liquidity in. Whoever holds them can pull the liquidity out.
LP lock: Moving LP tokens into a vault that only releases them at a set date. FairProof’s vault is owned by the program, not by a person.
Rug (rug pull): A launch where the founder pulls the liquidity, prints supply, or freezes buyers, leaving holders with worthless tokens.
Renounce: Permanently give up an authority key. Irreversible.
Token-2022 / extension: Solana’s newer token standard, which can carry extra rules (fees, hooks, delegates) on a mint. Some of those rules are rug vectors even when base authorities are renounced.
Transfer hook: An extension that runs arbitrary code on every transfer; it can block transfers.
Permanent delegate: An extension that lets a named key move or burn anyone’s tokens.
PDA (program-derived address): An address only a program can sign for; FairProof’s vault and proof live at PDAs derived from the token mint.
Slot: Solana’s unit of time (about 400 ms). “As of slot N” means “when we looked”.
RPC endpoint: The server your browser asks for chain data. The proof page shows which one it used.
Soulbound receipt: A token that cannot be transferred; FairProof mints one to the founder as proof of having launched.
Verdict: FairProof’s four-state result: Locked & Fair, Lock Expired, Not Fair, Not Verified.

source: docs/marketing/product-brief.md §10

Something missing? fairproofapp@gmail.com.