1. Collateral Isolation
Each Punk uses a canonical asset-specific vault authority and associated token account. The backing record stores the asset, mint, locked amount, tier, and lifetime sequence, preventing one live voucher from being substituted for another.
2. Ownership and Counterfeit Rejection
Unwrap does not trust the website or a marketplace indexer. The program decodes the live Metaplex Core account, verifies its collection and backing relationship, and requires the transaction signer to be the current asset owner.
3. Atomic Redemption
Token release, Core burn, vault closure, and backing-record closure happen in one Solana transaction. If any cross-program invocation fails, the entire state transition rolls back.
4. Token Policy
Initialization supports legacy SPL Token and a narrow Token-2022 metadata-only allowlist. Mint and freeze authorities must be revoked. Transfer fees, hooks, permanent delegates, pausing, confidential transfers, and other behavior-changing extensions are rejected.
5. Remaining Launch Requirements
- Local-validator and devnet tests covering wrap, transfer, wrong-owner rejection, unwrap, and tier reuse.
- Inspection of the final pump.fun mint and its actual token-program extensions.
- Independent security review of the deployed source and binary.
- A disclosed multisig and upgrade-authority policy.