Documentation

Introduction

hashcrash is a memecoin launchpad on Solana where your holdings are private. Coins launch on pump.fun's bonding curve like any other coin. The difference is what you get back. Instead of tokens sitting in a public wallet, you hold a private note: an encrypted record that says how many tokens you own, which only you can read.

Notes live in a shared pool. The pool publishes a Merkle tree of note fingerprints, called commitments, and a list of spent tags, called nullifiers. When you sell, your wallet builds a zero-knowledge proof that you own one of the notes in the tree, without saying which one. A Solana program checks the proof and pays you out.

The design comes from Zcash, which has run shielded payments in production since 2016. hashcrash applies the same idea to memecoin holdings.

Quick start

1. Connect a wallet. Open Wallet and connect Phantom, Solflare or Backpack. This only shares your address.
2. Launch or buy. Use Launch to create a coin, or pick an existing coin and choose "Buy privately".
3. Hold your note. Your wallet stores the note's secret. Your bag no longer appears on any holder list.
4. Sell to any address. When you sell, choose where the SOL goes. A fresh address keeps your buy and sell wallets unlinked.

Your notes are tied to your wallet's keys. If you can restore your wallet, you can restore your notes. If you lose your seed phrase, nobody can recover them, including us.

Launch status

Live now: public launches. The Launch page creates real coins on pump.fun through your own wallet, using the hashcrash server that ships with this site.

Not live yet: the hashcrash privacy program. Private launches, private buys and sells, sending notes and wrapping all need it, so they stay switched off until it's deployed and audited. The Explorer pool stats and the Fees page read zero until then.

The official program address will be posted on this site first. If anyone offers hashcrash tokens, a presale or an "early access" deposit before then, it isn't us.

Launching a coin

The Launch page creates a coin on pump.fun. You provide a name (up to 32 characters), a ticker (up to 10 letters or numbers), a description, an image and optional links. You then choose a mode.

Private launch (coming with the privacy program)

The coin is created on pump.fun as normal. Your optional dev buy is routed through the hashcrash vault in the same transaction, so the tokens land in the vault and you receive a private note. On pump.fun, the dev wallet shows no bag, which removes the most common signal snipers watch for.

Public launch (live)

A plain pump.fun launch, with hashcrash as the form. Your dev buy sits in your wallet as usual. Holders will be able to buy privately once the privacy program is live.

Running the deployer

Launching needs the small hashcrash server in this folder, because pump.fun requires coin metadata pinned to IPFS and a create transaction built by PumpPortal. Run node server.js, add a Pinata key to .env, and open http://localhost:3000. The README walks through it.

What you sign

One transaction. It uploads nothing secret, moves only the SOL you chose for the dev buy plus fees, and never gives hashcrash control of your wallet. Your wallet shows the exact amounts before you approve.

Buying privately

A private buy goes through the hashcrash program instead of straight to pump.fun:

1. Your wallet creates a fresh secret and a partial commitment: a fingerprint of everything in your note except the amount.
2. You send SOL to the program along with the partial commitment.
3. The program buys on pump.fun's bonding curve, and the tokens land in the vault.
4. The program finishes the commitment with the exact amount the curve paid out, and appends it to the tree.
5. Your wallet reads the amount from the transaction and saves the complete note.

Finishing the commitment on chain matters, because you can't know your exact output in advance on a moving curve. It also means nobody can sneak in a note for more tokens than the vault actually received.

Selling

To sell, your wallet picks a note and builds a proof that says: this note is in the tree, I know its secret, here is its nullifier, and I'm selling this many tokens. The program then:

1. checks the proof against a recent tree root,
2. checks the nullifier hasn't been used, then records it,
3. sells the tokens from the vault on the bonding curve (or the DEX after graduation),
4. sends the SOL to the address you chose,
5. adds a new note for any tokens you didn't sell.

Partial sells work: sell 30% of a note and the other 70% comes back as a new note with a new commitment, unlinkable to the old one.

Sending notes

You can send tokens to another hashcrash user without anything touching a public wallet. Your wallet spends your note and creates two new ones, one for the recipient and one for your change. The recipient's note is encrypted to their key and posted with the transaction, and their wallet finds it by scanning.

From the outside, a send looks like one nullifier going in and two commitments coming out. The coin, the amount and both parties stay hidden.

Wrapping pump.fun coins

Any coin already on pump.fun can be held privately. Wrap sends tokens from your wallet into the vault and gives you a note for the same amount. Unwrap spends a note and sends real tokens back to any address.

On pump.fun's holder list, every wrapped holder shows up as one address: the hashcrash vault. The more people wrap a coin, the less anyone learns from that list.

Wrapping is a visible step, because the wallet you wrap from is public. For the best privacy, buy privately in the first place rather than buying publicly and wrapping afterwards.

Graduation

When a pump.fun coin fills its bonding curve, it migrates to a regular DEX pool. hashcrash follows it. Private buys and sells for a graduated coin are routed to that pool instead of the curve, and existing notes stay valid because they record tokens, not curve positions.

Trading the graduated coin directly on the DEX, outside hashcrash, is public as usual.

Viewing keys

Like Zcash, hashcrash separates spending from seeing. Your wallet can export:

• an incoming viewing key, which shows the notes you received,
• a full viewing key, which also shows what you spent.

Neither key can move funds. Share one with an accountant or tax tool when you need to prove your history, and keep it private otherwise, because anyone with it can read everything it covers.

Architecture

hashcrash has four parts:

• The hashcrash program on Solana. It holds the commitment tree, records nullifiers, verifies proofs and controls the vault.
• The vault, a program-owned account for each coin's tokens. Only a valid proof can move tokens out of it.
• The wallet client, which runs in your browser. It creates notes, scans for incoming ones and builds proofs. Your secrets never leave your device.
• Relayers, optional services that submit sell transactions for you so your fee-paying wallet isn't linked to the sale.

// one private sell, end to end
wallet   : note, merkle_path  ->  proof, nullifier, change_commitment
relayer  : submit(tx)                          // optional
program  : verify(proof, root, public_inputs)
           require(root in recent_roots)
           require(!nullifier_exists(nf))
           create_nullifier_account(nf)
           tokens -> curve or dex -> SOL -> recipient
           tree.append(change_commitment)

Notes, commitments and nullifiers

A note is the private record of a holding:

note = { mint, amount, owner_pk, rho, r }

mint      the coin's mint address
amount    number of tokens
owner_pk  your note public key, derived from your wallet
rho       unique value per note, used for the nullifier
r         random blinding value

The commitment is a hash of the note. It goes into the tree when the note is created and reveals nothing about what's inside:

cm = Poseidon(mint, amount, owner_pk, rho, r)

The nullifier is published when the note is spent. Only the owner can compute it, because it needs the owner's nullifier key, and it can't be matched back to the commitment:

nf = Poseidon(nk, rho)

The program stores every nullifier as its own small account. If the account already exists, the note was already spent, and the transaction fails. That gives double-spend protection without revealing which note was spent.

The commitment tree

Commitments are appended to an incremental Merkle tree of depth 26, which holds 67,108,864 notes. It uses Poseidon hashing, which Solana supports as a native syscall, so each append costs little compute.

The program keeps a ring buffer of recent roots. A proof can reference any recent root, so your proof stays valid even if other people add notes while you're building it.

One tree serves every coin. A small launch with 30 holders still hides inside the crowd of every note for every coin.

Proofs

hashcrash uses Groth16 proofs over the BN254 curve. Solana verifies these natively with its alt_bn128 syscalls, for roughly 200,000 compute units, well under the 1.4 million limit per transaction. Proofs are generated in your browser in a few seconds.

What the sell circuit proves

public:  root, nf, mint, amount_out, recipient, relayer_fee, cm_change
private: note = {mint, amount, owner_pk, rho, r}, nk, merkle_path,
         change note fields

constraints:
  cm = Poseidon(note)               and  cm is in tree(root) via merkle_path
  owner_pk = derive(nk)             // you own the note
  nf = Poseidon(nk, rho)            // correct spent tag
  amount = amount_out + change.amount
  cm_change = Poseidon(change note)
  recipient, relayer_fee bound      // relayer can't redirect funds

Trusted setup

Groth16 needs a one-time setup ceremony. hashcrash will reuse a public universal ceremony for the first phase and run an open, circuit-specific second phase that anyone can join. As long as one participant destroys their share, nobody can forge proofs. Zcash's newest pool uses Halo 2, which needs no ceremony, but Solana has no native support for the curves Halo 2 uses yet.

Relayers

Every Solana transaction has a fee payer, and that wallet is public. If you sell from the same wallet you bought with, anyone can link the two. Relayers fix this.

A relayer submits your sell transaction and pays its network fee. In return, it takes a small tip from the sale proceeds, which you set. The proof binds the recipient and tip amount, so a relayer can't change where the money goes or take more than you agreed.

Relayers are planned for a later release. Until then, sell from a wallet you're happy to have linked, or fund a fresh fee-paying wallet first.

Program interface

This is the planned instruction set. Names and arguments may change before launch.

Every instruction that creates a note also posts the note encrypted to its owner, so wallets can find their notes by scanning the program's transactions.

What stays visible

Privacy tools work best when you know exactly what they hide. Here's the full list.

Practical tips: don't sell the exact amount you bought straight away, use a fresh address to receive SOL, and remember that a coin nobody else holds privately gives you little crowd to hide in.

Security

• Audits. The program and circuits will be audited by independent firms before launch. Reports will be published here.
• Open source. Program, circuits and wallet code will be public so anyone can check them.
• Bug bounty. A public bounty will open at launch.
• Key safety. Proofs are built in your browser. Your secrets never go to a server.
• Compliance. Viewing keys let you prove your own history. Deposits may be screened against sanctions lists.

Roadmap

1. Phase 1, launch. Private and public launches on pump.fun, private buys and sells, wrap and unwrap, explorer.
2. Phase 2, relayers. An open relayer network so sells don't reveal the fee payer.
3. Phase 3, private SOL. Hold SOL as a note too, so buys don't reveal the paying wallet.
4. Phase 4, in-pool trading. Swap one private coin for another without leaving the pool.

Glossary

Note

A private record of a holding: coin, amount and owner, encrypted to you.

Commitment

A hash of a note that goes into the public tree. Reveals nothing.

Nullifier

A spent tag published when a note is used. Stops double-spends.

Merkle root

One hash that sums up the whole tree. Proofs refer to it.

Groth16

A compact zero-knowledge proof system that Solana can verify natively.

Vault

The program-owned account holding the real tokens behind every note.

Relayer

A service that submits your transaction and pays its fee for a small tip.

Bonding curve

pump.fun's pricing formula. The price rises as more tokens are bought.

Graduation

When a coin fills its curve and moves to a regular DEX pool.

Viewing key

A read-only key that shows your note history without letting anyone spend.

Questions

References

• Zcash protocol specification, the source of the note and nullifier design
• Groth16 paper, "On the Size of Pairing-based Non-interactive Arguments"
• Poseidon hash, the hash used for commitments and the tree
• groth16-solana, Groth16 verification on Solana
• Solana documentation