Test results
Five layers are tested: the Robinhood Chain and BNB Chain contracts on forks of the real chains, the Solana transactions by simulation on live mainnet state, the engine and the keeper's logic in node, the keeper's BNB path on a fork, and the whole launch pipeline in dry run. Some contract tests cover the vault's keeper-only trading functions, which Pivot does not use in a launch.
Robinhood Chain contracts on a mainnet fork
14 tests, all passing, against the real Pons V2 contracts. Run forge test in contracts/.
| Test | What it proves |
|---|---|
| Keeper launches and wires the vault | One call launches the coin on Pons, creates the vault, funds it, and the coin opens at 1.68 ETH of virtual quote |
| Only the keeper launches, inputs are checked | Fee above 10 %, share above 100 %, a deposit below the Pons fee, a caller that is not the keeper: all revert |
| Keeper buy matches the curve maths | The tokens received match the constant-product formula within 0.3 % |
| Keeper sell returns ETH and cash | Half the tokens return a bit over half the ETH, as a convex curve should, and the proceeds are added to the vault's cash |
| Keeper cannot spend more than the cash | A buy above the maker cash reverts |
| Only the keeper can trade | buy, sell, sweep and retire revert for anyone else |
| Sweep only goes to the pool | ETH and tokens reach the pool address and nowhere else |
| The pool can rescue the funds without the keeper | With the keeper key out of the picture, the pool address sweeps all the cash and inventory to itself, a stranger still cannot, and the pool cannot trade |
| Fees split between creator and pool | After 2 ETH of trades at a 3 % creator fee and a 50 % payout share: 0.037 ETH to the creator's address, 0.037 ETH to the pool |
| Without a creator address all fees go to the pool | The pool receives all of it |
| Retire after graduation | Cannot retire early, retire after a 5 ETH buy sends the cash and inventory to the pool, buy then reverts |
| Initialize twice | Reverts, only the launcher can initialize a vault |
| Dev buy | The creator holds the tokens of a 0.5 ETH buy made in the launch transaction, the vault and the launcher hold none, the reserves match the curve maths. Without a creator address, or with less value than the buy, it reverts |
BNB Chain contracts on a mainnet fork
12 tests, all passing, against the real Flap Portal. Run forge test --match-contract PivotFlapForkTest in contracts/.
| Test | What it proves |
|---|---|
| Launch wires the splitter and the tax | The token address ends in 7777, buy and sell tax are the creator's fee, the Flap commission receiver is the Pivot address |
| The tax splits half and half | After a buy and a sell, harvest pays exactly half of the tax to the creator's address and the rest, plus the Flap commission, to the Pivot address; the splitter is left empty |
| No creator address | All of the tax goes to the Pivot address |
| A first buy | Its tokens go to the Pivot address and the launcher keeps nothing |
| Graduation, then the pool | Buying until the curve graduates, then trading on the pool: the tax keeps reaching the splitter |
| Only the keeper, bad inputs | A caller that is not the keeper, a tax below 1 % or above 10 %, a creator share above 50 %: all revert |
| The implementation and the clones cannot be initialised again | initialize reverts for anyone but the launcher, and once done |
| Flap minimum tax | 1 % launches, 0.99 % is refused |
| Dev buy | The creator holds the tokens, the pool holds none, and the size matches the curve model; without a creator address it reverts |
| Dev buy above the graduation size | The buy is capped at 800M tokens and the unspent BNB comes back to the creator, not to the pool |
Flap's own refusal of a tax below 1 % (error 0x929d8da4) was found by trying 0.1 %, 0.25 %, 0.5 %, 0.75 % and 0.99 % on the real Portal.
Keeper path on a fork
node keeper/test-rh-fork.mjs runs the keeper's own Robinhood code against an anvil fork:
- launch through the launcher with a 1 ETH vault,
vault.buy(0.4 ETH)returned 189,189,189 tokens and the engine predicted 189,189,189,vault.sellof half returned 0.2121 ETH and the engine predicted 0.2121,- the engine's decision on the resulting pair,
vault.sweepreached the pool address.
node keeper/test-bnb-fork.mjs runs the keeper's own BNB code against an anvil fork of BNB Chain: the live flap_launch step with the salt mined in JavaScript, which produced exactly the token address the Portal created; the 3 % tax read back from the Portal; a buy and a sell by a trader; harvest paying 0.0408 BNB to the creator and 0.0426 BNB to the Pivot address (half plus the Flap commission); a second launch; and the dry-run simulation. It uses fresh addresses: the well-known test accounts of anvil are swept by bots on the real chain.
node keeper/test-devbuy-fork.mjs runs the keeper's pons_launch and flap_launch steps live on anvil forks with a dev buy: the creator ends with 44.6M tokens from a 0.08 ETH buy on Pons and 800M from a 20 BNB buy on Flap (the curve's cap), nothing stays in the vault or the launcher, and a launch without a dev buy leaves the creator with nothing and costs only gas.
Solana transactions on live state
node keeper/check-solana.mjs reads a live pump.fun curve and simulates, with signatures disabled and nothing sent:
- a buy of 0.5 SOL on the live curve,
- a sell by a real holder of that coin,
- a
create_v2for a brand new mint, - a
create_v2followed bycreate_fee_sharing_configin one transaction, so the sharing config is created for a coin that exists only inside the simulation.
All four simulate without error. The script also checks that the curve is a constant product on the initial invariant and that the supply is one billion.
The whole pipeline in dry run
node keeper/launch.mjs keeper/sample-launch.json against an anvil fork and live Solana state: the Pons launch is simulated by the real launcher, the pump.fun creation is simulated on mainnet, the fee sharing is planned and the coin is registered, in the order pump.fun, Pons, Flap, fee sharing, register.
Engine, keeper and pipeline in node
66 tests, all passing. Run npm test.
- Curves, fees and graduation points match the on-chain constants.
- The pipeline runs in the order pump.fun, Pons, Flap, fee sharing, register.
- A failed pump.fun creation refunds in full and runs nothing else. A failed Pons launch leaves the coin on pump.fun and refunds minus costs. A failed Flap launch leaves it on pump.fun and Pons and refunds minus costs, BNB spent included.
- A transient failure is retried. After a crash the pipeline resumes and never repeats a finished step. Overlapping passes never send a step twice.
- A deposit below the amount, or from another wallet, does not start a launch. A request without a deposit expires.
- The rate is the median of the sources and a source that disagrees raises a flag.
- The Flap curve opens at the price the real Portal reports and matches its buy quotes within 0.1 %, and graduates after about 16 BNB.
- The mined salt gives an address ending in
7777, equal to the CREATE2 address of the Portal clone. - The float check flags a low balance, sizes the top-up in SOL, and while a wallet is low the API pauses new requests and says why.
- The Flap metadata upload sends the image, returns the CID and fails loudly.
- The API validates parameters, quotes a deposit, refuses to quote when the rate sources disagree, applies rate limits, and moves a request to done once a deposit arrives.
- The metadata upload posts the image and fails loudly on a bad answer.
- A public request cannot ask for an alignment buy, maker cash or a different pump.fun fee share.
- A browser run of the launch page with mocked Solana and Robinhood wallets and a local keeper: logo bytes reach the uploader, the Solana wallet is asked for the right transfer with the memo, the page follows the six steps to "is live on three chains" and links the Flap token on BscScan.
What the tests do not cover
- A live run with real funds on any chain.
- The keeper through a long outage or an RPC failure.
update_fee_shares_v2on a new coin.- An independent audit. See status.