Current handoff and the exact CA-only prerequisites: START_HERE.
PONPS is a community-directed protocol for a token launched on Pons v2. Its creator fees fund one protocol-owned isolated 3× PONS position on Robinhood Lighter. Participants choose its Long or Short direction in recurring browser-based votes.
Risk notice: this software can execute real transactions and leveraged trades. Its current policy allows 100% slippage. There is no guarantee of profit, execution or loss prevention. The strategy runs off-chain, but buyback/burn uses a deployed lifecycle adapter contract. Never commit real .env files, wallet keys or Lighter API keys.
10-minute browser vote + ETH claims every 10s → finalized result → ETH/USDG → Lighter deposit → one add or reversal of PONS
Each round lasts 10 minutes and is followed by a 20-second break. One browser profile gets one equally weighted vote per round, identified by a signed HttpOnly cookie. No wallet, signature or token balance is required. PostgreSQL enforces one ballot per browser/round even across simultaneous requests and server restarts. This is not hardware identification or Sybil protection: clearing cookies or using another browser permits another identity. A tie leaves the last decisive direction in force. When the opposite side wins, the next creator-fee order closes the whole existing side and opens the voted side with the new 3× allocation in one net reversal order.
At every new live +10% ROE level the bot sends a reduce-only order for 3% of the remaining Long or Short. This realizes profit three times more frequently without consuming the position materially faster than the former 30%/10% ladder. The minimum tradable core remains until a contrary vote authorizes a full reversal. Confirmed net profit, after trading fees and cumulative funding, follows:
Lighter secure USDG withdrawal/claim → USDG/WETH → unwrap → Pons curve or graduated V4 pool → atomic PONPS burn
There is no artificial maximum-position notional. The worker checks the Pons escrow every 10 seconds and claims every non-zero creator-fee amount, with no claim threshold. Claims accumulate in the dedicated treasury during the voting round. Once the round finalizes, all executable ETH above the protected 0.01 ETH reserve (after unavoidable transaction gas) is routed to the single PONS position in the winning direction. If the route estimate cannot satisfy Lighter's live order minimum, that round is skipped and the funds roll into the next round. At 100% slippage the estimate is not a guaranteed minimum; downstream operations validate actual receipts.
Prepare .env once with the treasury and Lighter credentials listed in .env.example. The official Robinhood RPC requires no API key. When Pons returns the PONPS contract address, run:
npm run launch -- 0xYOUR_PONPS_CONTRACT_ADDRESSThe command first validates all required credentials and the Docker daemon, then saves the checksummed address with mode 0600, verifies the launch, deploys the immutable Pons lifecycle buyback adapter for that CA, creates local database credentials if needed, builds the containers, runs migrations and starts the stack. It does not replace any other secret in .env.
Open http://127.0.0.1:4174. Preflight remains fail-closed until it proves the Pons launch/recipient and lifecycle adapter, pinned Robinhood contracts, live ETH→USDG and USDG→WETH routes, Lighter account ownership/API signer, active PONS market 44, isolated 3× state and treasury gas reserve.
For a new, funded treasury without a Lighter account, run npm run onboard:lighter
to simulate the initial 1 USDG deposit on a local fork. The operator can then run
npm run onboard:lighter -- --execute to perform the real onboarding and fill the
account/API-key fields. See onboarding limits, prerequisites and recovery.
This does not start trading or replace the CA launch step.
Alternatively, create the Lighter account manually from the same EOA used as Pons creatorFeeRecipient, then create a dedicated Lighter API key at robinhoodchain.lighter.xyz/apikeys. API key indices 0–3 are reserved by Lighter interfaces; use 4–254.
TOKEN_ADDRESS=
PONS_BUYBACK_ADAPTER_ADDRESS=
TREASURY_PRIVATE_KEY=
LIGHTER_ACCOUNT_INDEX=
LIGHTER_API_KEY_INDEX=
LIGHTER_API_PRIVATE_KEY=Leave the two address fields blank before first launch; the launch command fills them. The official public Robinhood RPC handles chain reads and transaction submission, including adapter deployment. Alchemy is neither required nor used; a legacy ALCHEMY_API_KEY in .env is ignored. Currently there is one configured RPC, so retries do not provide independent-provider redundancy. Production browser voting does not query wallet balances or blockchain history. Any future indexer must use an archive/official path with adaptive chunks down to the provider-supported range.
Net realized profits accumulate until at least 1 USDG, the documented minimum for a Lighter secure withdrawal. A claimable secure withdrawal is completed through withdrawPendingBalance; the USDG is then converted to WETH, unwrapped, and sent to the immutable lifecycle adapter copied from the reviewed ABCD implementation. The adapter buys on the Pons curve before graduation or the registered Uniswap v4 pool afterwards and burns the received PONPS in the same transaction.
Pons quote-only fees are swept automatically when the creator wallet is authorized. A sweep requiring an internal conversion or Pons-native buyback is deliberately left to Pons' official sweep operator, as required by the contracts; the already-credited escrow balance is then claimed automatically.
All swap/order execution now uses the requested 100% slippage. ETH→PONPS buyback and USDG↔ETH/WETH swaps may have a zero minimum output. New lifecycle adapters allow 100% pool price movement. Lighter buy orders allow up to twice the reference price; sells use the smallest positive price tick (zero is invalid). This does not guarantee a fill, bypass venue restrictions or preserve value. Positive actual output/burn, gas reserve and explicit test budgets remain required. Existing immutable adapters with the old 5% impact limit are not silently replaced; launch/preflight rejects that mismatch.
Funding first obtains an indicative, non-executable exact-output price quote, then requests a bounded exact-input transaction at 100% tolerance. Only that second transaction can be submitted. This avoids Relay's no routes found response for 100% exact-output swaps. The actual USDG receipt must cover the deposit; otherwise execution stops without repeating the swap. Existing test journals retain their original recorded slippage on resume.
To check the current treasury's 1 USDG→WETH→ETH route without spending real funds, run TEST_USDG_WETH_FORK=1 node --test test/usdg-weth-fork.test.js (requires Anvil). It uses the actual forked wallet balances, a live Relay quote, production route validation and localhost-only transactions. It does not test Relay's hosted confirmation/indexing or the final PONPS purchase. Buyback tests: npm run test:contract and npm run test:contract-fork.
npm run verify
npm run test:local-stack
npm run test:contract-fork
npm run test:live-readonly
# or all of the above:
npm run test:all
npm run preflight
npm run prod:status
npm run prod:logs
npm run pause -- --reason=PROVIDER_UNAVAILABLE
npm run resume -- --approved-by=NAME --reason='verified recovery reason'PostgreSQL is authoritative. Redis supplies locks and pub/sub. Unknown external outcomes are reconciled from persisted transaction/order references rather than blindly retried. The local-stack test starts disposable PostgreSQL and Redis instances itself; Docker is not required. The fork test executes the graduated Pons V4 buy-and-burn against a local fork of current Robinhood mainnet state and never broadcasts a transaction.