The operator and the trust model
Pivot spans three chains. No contract can read them all and create a coin on all of them, so a service, the keeper, does the part that crosses chains. That makes Pivot partly an operated service, and it is worth saying exactly what that means.
Who holds what
| What | Held by | Where |
|---|---|---|
| The creator's deposit in SOL, until it is spent | the keeper's address on Solana | Solana |
| ETH for the Pons launch and the gas | the keeper's Robinhood Chain wallet, funded by the operator and repaid from deposits | Robinhood Chain |
| BNB for the Flap gas | the keeper's BNB Chain wallet, the same key, funded by the operator and repaid from deposits | BNB Chain |
| The creator of record on pump.fun | the keeper's Solana wallet, then the fee sharing is locked | Solana |
| The creator's share of pump.fun creator fees | the creator, through pump.fun's fee sharing | Solana |
| The Pons creator fees | the coin's PivotVault, split by anyone | Robinhood Chain |
| The Flap tax | the coin's PivotFlapSplit, split by anyone | BNB Chain |
What the keeper can do
- Create the coin on the three chains, using your deposit for the fees.
- Pause new requests while one of its wallets is being refilled.
- Refuse a request or fail to complete it: then the refund rules of the launch apply, run by the keeper.
What the keeper cannot do
- Take your share of the pump.fun creator fees: it is fixed by pump.fun after one call.
- Send the vault or splitter funds anywhere but the Pivot address fixed at deployment and, in the split, your own address.
- Change the Flap tax or its beneficiary after the launch.
- Change the Pons creator tax after the launch.
- Hide a move: every step is a public transaction.
What you trust
- That the keeper completes the launch after you pay, or refunds you. The refund is a promise of the operator, not of a contract.
- That the keeper's keys are kept safe. One EVM key signs on Robinhood Chain and BNB Chain, and the floats it holds there are the operator's money, not yours.
- That the operator keeps the ETH and BNB floats topped up: when they run low, requests pause, they do not fail halfway.
- That the site you pay from is the real one: check the address and the official X account.
Limits in code
- The keeper accepts a deposit only from the Solana address named in the request, with the right reference in a memo.
- At most 12 requests and 20 uploads per hour and address.
- A pipeline step never runs twice at the same time.