Documentation & Specificationsv0.1-BETA

How questfun.xyz Works

The technical architecture, protocol invariants, and verifiable mission mechanisms linking Solana token liquidity on Pump.fun to tangible project milestones.

Protocol Overview & Core Philosophy

"Every coin starts with a mission."

Most token launches launch into a speculative void without accountability or follow-through. questfun.xyz rearchitects the launchpad model: a token cannot exist without an explicit public mission and three measurable milestones bound to it from day one.

Tangible Progress

Tokens are paired with verifiable deliverables: code commits, prototypes, audit reports, and mainnet releases.

Non-Custodial

Zero private key custody. All bonding curve transactions are signed directly by the user's Solana wallet.

Transparent History

Append-only milestone history. If a creator adjusts descriptions or scope, previous entries are preserved.

PLATFORM TOKEN

Official questfun.xyz Token ($QUEST)Contract address will be posted here and in the top ticker upon official deployment.

Solana & Pump.fun create_v2 Integration

questfun.xyz implements the official Pump.fun Solana bonding curve contract via the documented create_v2 instruction. The instruction initializes the token mint account (Token-2022 program), establishes the bonding curve PDA, and serializes the on-chain metadata via Borsh.

Pump.fun create_v2 Constants & Layout

// Pump.fun Contract Address

PROGRAM_ID = "6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P"

// 8-byte Anchor Discriminator for create_v2

DISCRIMINATOR = Buffer.from([0xd6, 0x90, 0x4c, 0xec, 0x5f, 0x8b, 0x31, 0xb4])

// Program Derived Addresses (PDAs) Derived:

1. Bonding Curve PDA: seeds=["bonding-curve", mint.toBuffer()]

2. Associated Bonding Curve: SPL Associated Token Account of Bonding Curve PDA

3. Global Config: seeds=["global"]

Independent Server Verification: After the creator broadcasts their transaction, questfun.xyz performs independent RPC checks to confirm the transaction signature on-chain, validates the mint address against the expected bonding curve program, and records the verified mint address only once confirmed.

Sign In with Solana (SIWS) Cryptographic Authentication

questfun.xyz never relies on unverified wallet headers or arbitrary address strings in request bodies. All state-mutating actions (token launch preparation, milestone edits, evidence reviews) require a cryptographically verified session token issued via Sign In with Solana.

1. Server-Issued Nonce

The server generates a cryptographically random, timestamped 32-byte nonce stored with an expiration window.

2. Domain & URI Binding

Challenge message binds to the exact application domain and URI, preventing man-in-the-middle and phishing attacks.

3. Ed25519 Signature Check

Server verifies signature against user's Solana public key using tweetnacl detached Ed25519 verification.

4. Replay-Protected JWT

Non-reusable challenge produces an HTTP-only SameSite JWT session cookie scoped to that verified creator wallet.

The Five-Step Creation Wizard

The creation wizard guides developers through a structured 5-step deployment flow ensuring inputs are validated before any on-chain gas is spent:

Connect & Authenticate Wallet

Connect Phantom, Solflare, or any Solana adapter and sign the SIWS cryptographic challenge.

Token Identity & Image Upload

Enter token name and uppercase ticker. Drag-and-drop your token image in WEBP, PNG, or JPG format (up to 5MB) or supply an external decentralized URL. Assets are verified, saved, and resolved to absolute URLs for on-chain Borsh metadata.

Define Public Mission & Three Milestones

Articulate the overarching objective and define exactly three tangible, measurable milestones. Specify deliverables (e.g. repo URL, testnet deployment, proof of reserve).

Review Parameters & Estimated Network Costs

Review token parameters, target network cluster (Devnet vs Mainnet-Beta), and estimated rent (~0.002 SOL for Token-2022 mint account). Requires explicit acknowledgment that on-chain bonding curves cannot be reverted.

Sign & Launch Bonding Curve

Client generates the fresh mint keypair, assembles the create_v2 transaction, requests wallet approval, broadcasts to Solana RPC, awaits confirmation, verifies on-chain, and publishes the live mission page.

Milestones & Contributor Evidence Workflow

Anyone in the community can contribute to a project's mission and submit evidence. For the MVP, evidence verification uses transparent, manual creator review with an immutable public audit log.

Evidence Requirements & Sanitization

• HTTPS Evidence URL: Validated URLs pointing to public GitHub PRs, live contracts on Solscan, documentation, or verifiable testnet nodes.
• Work Summary: Concise explanation of deliverables completed and how they fulfill the milestone criteria.
• Submitter Attribution: Submissions record the submitter's connected Solana wallet address.
• Non-Independent Disclosure: The UI explicitly notes that creator approvals reflect the project creator's review rather than independent decentralized consensus.

Creator Governance & Append-Only History Logs

Projects evolve, but history must never be erased. In the authenticated Creator Dashboard (/dashboard), creators can manage their projects with cryptographic safeguards:

Milestone Revision History

Whenever a milestone title or description is updated, a snapshot of the prior state and the creator's reason for change is archived permanently in the database and visible to all users on the mission page.

Public Progress Updates

Creators can publish project status updates and changelogs. Every announcement is timestamped, attributed to the creator's wallet, and broadcast to the public project feed.

Protocol Security & Anti-Exploit Principles

Zero Private Key Custody: questfun.xyz servers never hold, store, or transmit private keys. Every Solana transaction is signed client-side by your connected hardware or browser wallet.

No Automated Sniping or Auto-Buy: The launchpad does not automatically purchase tokens upon launch, nor does it operate internal trading bots, front-running mechanisms, or fee-skimming pools.

Replay Protection & Expiration: SIWS nonces expire after 5 minutes and cannot be reused. Nonces are tied to explicit host domains to eliminate signature relay attacks.

No Fake Activity or Synthetic Rankings: The explore feed and activity streams exclusively display verified on-chain launches and real database records. Metrics are never fabricated.

Frequently Asked Questions & Network Guide

What is the difference between Solana Devnet and Mainnet-Beta?

Solana Devnet is an official test network simulating mainnet conditions without real financial value. Devnet SOL can be obtained freely from public faucets. Solana Mainnet-Beta is the real, production blockchain where transactions require real SOL and the Pump.fun bonding curves trade with live market capital. questfun.xyz lets you seamlessly toggle between both clusters from the header dropdown.

How much SOL does it cost to launch a token?

Under the Pump.fun create_v2 model, launching a token costs approximately ~0.002 SOL for rent exemption of the Token-2022 mint account and associated bonding curve metadata, plus standard Solana transaction network fees (0.000005 SOL).

Where does the token image get hosted?

When you upload an image (WEBP, PNG, or JPG) in Step 2, questfun.xyz validates the format and stores it securely. The URL is resolved to an absolute public address and serialized directly into the Solana on-chain metadata via Borsh, ensuring standard wallets and explorers (Phantom, Solscan, Birdeye) render your token icon correctly.

Can a creator delete or overwrite previous milestone deliverables?

No. While creators can update descriptions to adapt to project realities, all previous revisions are recorded with the creator's stated justification in the append-only milestone audit log, preserving complete transparency for token holders.