How it works
Trust model
What is enforced on chain, what the keeper enforces, what Fuelgauge checks, and what it cannot promise.
Fuelgauge is built so that the important promises hold even if Fuelgauge itself disappears or turns bad. The table separates what the chain enforces from what Fuelgauge's keeper does.
#Promises and who keeps them
| Promise | Enforced by |
|---|---|
| Creator fees go 95% to the vault and 5% to the burn, nowhere else | pump.fun fee sharing, with its admin revoked when the split is set (on chain). A listing requires exactly these two shareholders |
| Vault SOL only goes to listed payees, within each cap | Squads spending limits, one destination each (on chain). On a locked vault no other transaction can execute (on chain) |
| No hidden spending limit or transfer was added during setup | Fuelgauge reads every transaction the vault has ever made. The setup must be exactly the published budget plus the lock |
| An editable vault cannot change without notice | Squads time lock of at least 24 h (on chain). Pending changes are shown; a change that runs flags the coin |
| The keeper cannot redirect funds | Spending-limit destinations (on chain); the keeper is never a vault member |
| A line with a proof URL pays only while the URL answers | The keeper (off chain); the URL is public |
| The sunset waits for the idle period and a complete history | The keeper (off chain). The chain caps it at most 25 SOL a week per coin |
| Sunset SOL only buys and burns the coin | The keeper (off chain); each coin's sunset wallet is public |
| The 5% buys and burns $GAUGE | The keeper (off chain); the burn wallet and its log are public |
#Checks on every listing
Before a coin is listed, and every few minutes afterwards, Fuelgauge checks on chain:
- the coin is a SOL-paired pump.fun coin, and the lister is its creator;
- its fee split pays exactly the vault and the burn, with at least 5% to the burn, and pump.fun has locked it;
- the vault is a Squads multisig with no config authority, threshold 1, and exactly the members its mode requires;
- the Fuelgauge keeper is not a member;
- every budget line and the sunset line exist as spending limits matching the published budget exactly (payee, amount, period, who may use them);
- the vault's transaction history is exactly its setup, all executed, with nothing executed afterwards.
A coin that fails a required check is shown as Checks failing. The keeper stops paying its lines and stops its sunset until it passes again; pump.fun payouts to the split still happen, since they can only reach the vault and the burn.
#If the keeper's key were stolen
The keeper holds one key on its server. With it, an attacker could:
- pay automatic lines early, but only to their own payees and within their caps;
- move each coin's weekly sunset cap into that coin's sunset wallet, which the attacker would also control. This is the reason no coin can set a sunset cap above 25 SOL a week.
It could not:
- reach any other wallet;
- change any vault;
- touch a manual line;
- move anything on a locked vault except through those limits.
#If Fuelgauge disappeared
- The split keeps paying the vault and the burn; anyone can trigger pump.fun's payout.
- The vault keeps its spending limits. The creator can still pay manual lines with any Squads tool; automatic lines stop being paid automatically.
- A locked vault can never be emptied by anyone. Its SOL leaves only through its lines.
#What Fuelgauge cannot promise
- That a team builds what its budget names. The gauge measures payments, not delivery.
- That a payee spends money well. Follow the payee wallets.
- That a coin's price does anything. See Risks.
#Security review
Before launch, an independent review of the money paths found two critical issues:
- a creator could withdraw through an ordinary vault transaction;
- a creator could add hidden spending limits during setup.
Both are fixed: vaults lock by default, and every listing reads the vault's full history. Eight smaller findings are fixed too. Each fix has a test, including the real attacks run against the real programs.