How Enftees works

How it works

1. 01
   Launch

   You create a pump.fun coin from the Enftees launch page and pick a listed collection. One transaction does two things: pump.fun create with the coin's creator set to a router PDA derived from the mint, then Enftees register_coin, which checks the bonding curve really names that router as creator and locks in the collection and NFT policy.
2. 02
   Trade

   People trade on the pump.fun curve, later on PumpSwap. pump.fun accrues creator fees for the coin's creator, which is the router. Only the program can sign for the router.
3. 03
   Sweep

   Anyone calls claim_fees and harvest. The router pulls its fees from pump.fun and splits them 80% to the collection vault, 20% to the treasury. When a vault can afford a floor listing, the keeper calls sweep; the program only lets SOL out if a verified NFT comes in under the posted cap.
4. 04
   Settle

   Each NFT is charged to the coin whose fees paid for it, and that coin's policy decides what happens: raffled to its holders, or burned. Both are permissionless to finish.

Fee split

Every lamport that reaches a router is split the same way, forever: 80% to the paired collection's vault, 20% to the protocol treasury. The split is a constant in the program. Nothing goes to the coin's creator directly; your upside as a creator is the coin.

The router is a system-owned PDA with seeds ["router", mint]. It is rent-funded at launch so tiny fee claims never fail, and it has no owner key.

What happens to the NFTs

Only fees earned by trading count. claim_fees measures how much the router gained during the CPI into pump.fun; only that amount is credited to the coin. SOL sent to a router or vault any other way is a donation: it still buys NFTs, but buys no say over them.

Burn money and raffle money never mix. A vault is shared by every coin paired with its collection, so one NFT can be paid for by several coins. A sweep only succeeds when every coin charged for it has the same policy.

The vault rule

A vault is a system-owned PDA (["vault", collection]) that holds SOL and can only turn it into NFTs of one collection. Every sweep must pass all of these checks in the same instruction, or it reverts:

• The marketplace program and the instruction discriminator must both be on the allow-list (Tensor / Magic Eden buy instructions).
• The vault's token account for the NFT must go from 0 to 1, with no delegate or close authority set.
• The NFT's Metaplex metadata must carry a verified collection equal to the listed collection.
• SOL spent must be ≤ the floor cap and ≤ the caller's max. The cap is posted by the keeper and expires after an hour.
• The vault must still be owned by the System Program afterwards, so no CPI can hijack it.

Raffles

1. Open. The keeper snapshots holders (excluding the bonding curve, pool and protocol accounts), builds a Merkle tree of ticket ranges and calls open_raffle with the root and a link to the full list.
2. Challenge. For 30 minutes the snapshot is public and no draw can happen. Anyone can fetch the list and recompute the root. A bad root can be replaced, which restarts the window.
3. Draw. Anyone calls request_draw. The program pins the raffle to a slot 8 slots (~3s) in the future, whose hash does not exist yet.
4. Resolve. Anyone calls resolve_draw. The program reads that slot's hash from the SlotHashes sysvar and derives the winning ticket from hash, root and prize address.
5. Deliver. Anyone submits the winner's leaf and Merkle proof with claim_prize; the vault sends the NFT to the winner's token account.

If nobody resolves within ~512 slots the hash ages out of the sysvar; resolve_draw then re-pins to a fresh future slot and increments a public repin_count, so a raffle always settles and any withholding is visible.

Trust model

What we don't paper over:

• Holder snapshot. The Merkle root is the keeper's word. The challenge window makes a bad root visible, but nothing on-chain rejects one.
• Slot-hash randomness. Nobody can predict the hash at request time, but the leader of the pinned slot could skip their block to shift to the next slot's hash. For high-value collections, swap in Switchboard or ORAO VRF (same state machine, different resolve step).
• Keeper discretion. The keeper picks which listing to buy, within the floor cap. It could buy the priciest listing under the cap.
• Admin allow-list. The admin chooses which marketplace programs the vault may call. Every addition waits 48 hours before it works; disabling is instant.
• Token standards. v1 sweeps classic Metaplex NFTs. pNFTs and Metaplex Core need extra transfer paths and are on the roadmap.

Programs & accounts

FAQ