Contact: https://curvetix.lol/security.html
Expires: 2027-11-04T00:00:00.000Z
Preferred-Languages: en, ru
Canonical: https://curvetix.lol/.well-known/security.txt
Policy: https://curvetix.lol/security.html

# CURVETIX: event tickets on Meteora Dynamic Bonding Curves (Solana).
# Each event is a token on one DBC pool of our partner config. One ticket = 1,000,000,000 tokens / the
# event's capacity. The curve sells tickets until it holds the threshold, then the pool moves to Meteora
# DAMM v2 with its liquidity locked for good. A door pass is a burn of whole tickets with our memo.
#
# 1. What the site is
#   - A Rust server (no on-chain program of its own) that builds transactions for the visitor's wallet,
#     follows every swap on our config and checks door passes.
#   - It holds one key: the migration wallet's (pays the rent of moving sold-out curves into DAMM v2).
#     The treasury (partner fee claimer) and the dev wallet are never on the server.
#
# 2. Addresses (verify before you sign anything)
#   devnet  config     FC44S9veE1eper8wGs9tdtoQLmKCnrrN49C3odMkkD6V
#           dev        Fvgc957PFnwbpiyVEcn43LfwB6hoaUk4XiZZExxMfFLm   (launches the house event, $TIX)
#           treasury   AHB7P3qnRMseKyPmDbxTRQzNwwtxXPHQWBea25xRokWQ
#           migration  988wfF8cj4LUF4xU1TQVFMRJ4Q8wcWmhT17SXjEt9PxT
#   mainnet config     Ch8ZwKJzPGdC816hMEA5oPRJ5mC2DfscKQkwfHos9GLp
#           dev        E9jWU2CVC4YxXbzsUc3zbqHG7iaLVHkbMTbXEKPekgV4
#           treasury   oS1djoR3P5Am9gZMz923KaFE5mY6gUA4AZ8rGFZhzWq
#           migration  6iybT2zbLNzwPPQEcjvUe5Lg4da1z87g58xqDj2k1Lj
#   Every event mint the site issues ends in "tix".
#   Programs: Meteora DBC dbcij3LWUppWqq96dh6gJWwBifmcGfLSB5D4DuSMaqN, DAMM v2 cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG.
#
# 3. The curve (on chain, read it from the config account)
#   mainnet: start market cap 42.88 SOL, sells out at 48 SOL, trading fee 3% (half to the organizer),
#            anti-sniper fee 15% at a pool's first second falling to 3% over 5 seconds,
#            DAMM v2 after migration at 1%, LP locked (half partner, half organizer).
#   devnet:  the same with a 0.45 SOL start and a 0.5 SOL sell-out.
#   Names and tickers can never change (token update authority: immutable).
#
# 4. What you sign
#   - Buy: an exact number of tickets for at most the shown price plus slippage (DBC swap2, exact out).
#   - Sell back: an exact number of tokens for at least the shown amount less slippage (exact in).
#   - The last tickets: a partial-fill buy that takes what is left on the curve and returns the rest.
#   - Launch: the event's pool, co-signed by a fresh mint key, plus your optional first buy.
#   - Door pass: a burn of whole tickets from your own account with the memo
#     "curvetix:in:<mint>:<pass number>:<lock>". The lock is a hash of a secret only your wallet can
#     make (a free signed message), so a pass seen on chain can't be used by anyone else.
#   - Free messages (they move nothing): the launch session, the door of your own event, your pass key.
#   The page checks every instruction before your wallet sees it and refuses anything else.
#
# 5. Scope
#   In scope: https://curvetix.lol and its API, the transactions it builds, the door.
#   Out of scope: Meteora's programs (report to Meteora), Solana itself, social engineering, volumetric DoS.
#
# Reports: open https://curvetix.lol/security.html for the contact. Please give us a few days before
# publishing. Thank you.