Program and audits
The Sanctum program on Solana, read from the deployment file and checked on chain. Below it, the EVM contracts: code published, tests passing, not deployed yet.
01Solana program
Solana program
The live product. Its upgrade authority is the dev key, disclosed below. Loading
| Item | Value | On chain |
|---|---|---|
| Sanctum program id | – | |
| Upgrade authority | dev key | |
| IDL | published at deploy | – |
| Source | Open the repository | – |
02EVM
EVM (not deployed, source in the repo)
Sanctums for Base and Ethereum, the raid vault and the weekly challenges. Code published, tests passing, not deployed yet. Compiled with solc 0.8.28.
| Contract | Source | Status |
|---|---|---|
| SanctumFactory | src/SanctumFactory.sol | Loading |
| Sanctum | src/Sanctum.sol | Loading |
| Sanctum7702 (EIP-7702 delegate) | src/Sanctum7702.sol | Loading |
| Subscription (coverage) | src/Subscription.sol | Loading |
| Blacklist | src/Blacklist.sol | Loading |
| FeeCollector | src/FeeCollector.sol | Loading |
| BountySanctum, BountyCold (raid vault) | src/BountySanctum.sol | Loading |
| ChallengeRegistry (weekly levels) | src/challenges/ChallengeRegistry.sol | Loading |
03Audits
Audits
There is no external audit. The three internal rounds cover the EVM contracts and are published here in full, with findings and fixes. The Solana program has not been audited.
AUDIT-1
The design against the market: launch meta on Base, token economics, watcher anti-farming, the bounty as a leak meter. Records what was applied and what was declined.
AUDIT-2
The Base token contracts of an earlier design, dropped when the token moved to Pump.fun: buyback sandwiching, minter control, re-entrancy, partial fills. Kept for the record; none of it ships.
AUDIT-3
The whole contract set and the deploy script as one system, before launch, with a fresh-key rehearsal on a Base fork.
STEP3-FIXES
What changed after AUDIT-3: the bounty's locker cold key, ETH-only raids, write-once fee addresses, two-step ownership. With the tests that pin each fix.
STEP3-FIXES-2
Adds a recovery on/off switch to the Sanctum, set off for good on the bounty, which closes the last open gap. Also fixes a lock schedule in the dropped Base token design.
04Source and tests
Source and tests
The Solana program, and a Foundry project for the EVM contracts: contracts in src/, tests in test/ including fork tests against Base.