lalalune/pumpfun-source

This is a research archive, not a ready-to-use deployment kit: expect to read evidence and reconcile status files rather than run a finished program. It suits people studying how Pump.fun binaries behave and how much can be rebuilt from captured data.

The problem

A researcher wants to understand what a deployed Solana program actually does, but only compiled bytecode and account data are public. Rebuilding runnable source from those artifacts normally means piecing together hashes, compiler versions and behavior across many captures, with no clear record of what matches and what does not. This project packages captured payloads, observation slots, loader metadata and reconstruction attempts into one evidence trail, so the reader can see exactly which bytes differ and which instructions are covered. The result is a bounded map of what has been reconstructed, not a working clone.

What's different

The project's main discipline is refusing to overclaim. Whole-file identity is explicitly 0/4 for the core programs, and dependency capture images are 2/5, with only SPL Token described as a whole-file exact raw compiler output. Each program lists differing or missing byte positions, but the README warns those counts are not semantic distance or a completion score. Instead, the evidence separates raw compiler output from retained allocation images and forbids padding or byte editing to force a match project instructions.

That makes the repository useful as an audit trail. It reports that 140/150 identified instruction dispositions are bounded by existing corpora, with five partial and five unrecovered handlers, and that clean managed-source builds reproduce tested Pump, AMM and Mayhem executables and symbols completion notes. The trade-off is that the material is dense and partial: the virtual-params reconstruction is an unaccepted proposal, the Donation Relay has bound source but no fresh canonical build claim, and the security audit plus live SDK/deployment acceptance remain incomplete. Anyone expecting a turnkey reconstructed protocol will be disappointed; anyone checking claims against packages will find the paper trail deliberate.

Who should try it

Good fit: a Solana program researcher or security reviewer who wants captured artifacts, hashes and per-pass ledgers for studying Pump.fun behavior, and is comfortable tracing verdicts across status files. Also reasonable for someone building verification tooling around build identity, since the repository ships scripts and evidence packages. Poor fit: a developer who wants to fork, deploy or integrate a working Pump.fun implementation, because the README does not claim a complete reconstruction, on-chain deployment or a finished security audit. A reader looking for a tutorial or a clean high-level explanation will also struggle with the amount of bookkeeping required.

Requirements and limitations

The first thing to check is the current status file and the completion notes, because the README says selected artifacts must agree with them and historical checkpoint pointers are not current selections. Build-identity claims are tied to a build-identity audit, and the broader research lab has its own provenance and replay documentation. The supplied methods are evidence and tooling scripts, not a packaged installer; the README links the instructions rather than promising a simple setup path.

Ongoing limitations matter more than initial setup. The repository states that existing corpora do not establish exhaustive behavior, security acceptance or exact captured bytes, and that broader creation, trading, routing, parser, error, historical compiler and SDK acceptance obligations remain open. Several execution probes are explicitly stopped and excluded. No license is declared for the repository, and upstream materials retain their authorship, so reuse of captured code needs separate attention.

HotRepo's take

HotRepo recorded 142 total stars and #7 on the NEW-REPOSITORY board for Rust on 2026-10-26, one dated snapshot, not a daily growth series project snapshot. With only that single observation and insufficient comparable daily history, persistence of interest cannot be judged. Before investing time, verify that status.json matches the artifact you intend to study and accept that the reconstruction remains incomplete by design.