pumpfun-source

Reconstructed Rust source for Pump.fun's Solana programs, with captured binaries, reproducible builds and local differential tests.

Progress as of 27 October 2026: all four core programs still differ from their captured binaries. The selected Donation Relay reconstruction reproduces its complete meaningful ELF and, through a separate loader deployment, its captured payload.

Current main-Pump parallel research snapshot preserves the verified intermediates and in-progress source beyond the maintained checkpoint.

Main Pump: 71.9% of function windows matched; 51.6% of original text covered. Complete reconstruction remains unfinished.

Reproduce the selected Pump ELF with its archived Rust/linker recipe.

Across the latest verified checkpoints, 2,901 / 3,338 inferred function windows match (86.9%). Their matched windows cover 3,855,184 / 5,213,128 original text bytes (74.0%). One of five programs has complete meaningful-ELF identity; all four core contracts still differ from their captured binaries.

These percentages measure bounded binary-recovery progress, not a claim that 86.9% of the engineering work is finished. Complete reconstruction also requires all remaining code, calls, data, relocations and build provenance.

“Windows” are inferred original machine-function ranges, including framework and runtime helpers. Complete normalized matches mask specified call/address operands; they do not prove the referenced callees or data match. Each original window counts once. Raw equality means that local body is byte-equal, not that the whole program is identical.

Pump and AMM rows describe the verified maintained sources. Fees and Mayhem rows are the latest qualified research frontiers, distinct from their maintained selections in repro/status.json. The maintained Mayhem initializer now has its own current-source build and signed validation, separate from the larger research frontier. Upstream Relay's canonical selection remains the authority for its exact result.

Relay reproduces all 818,280 meaningful ELF bytes. Its separate signed local loader replay reproduces the 830,448-byte captured payload, including 12,168 loader-allocated zero bytes. This does not establish the original historical source or build recipe.

The latest Metaplex research packet matches all 707,448 bytes of the captured meaningful ELF and all 1,251 function windows. A separate 86,543-byte zero extension matches the captured allocation; it is not part of the stripped compiler artifact. This dependency result remains unpromoted and does not change the core-program totals above. The parallel-lane review records the other packets and their baseline/validation limits. The independent Utilize recovery adds the retained unstripped compiler output, empty-target build/dependency receipts and two separately signed replays of that same 147-case corpus. Its alternative source is an unpromoted compiler-context diagnostic.

The qualified current Mayhem Buy/Sell quote composition reaches 432/441 normalized windows while retaining all 100 raw matches, the complete initializer and the prior Legacy Buy ownership body. Two builds agree; 6,636 fresh trade pairs and 69 initializer pairs pass with 13,440 checked signed records. Both quote helpers match completely: 1,256 and 1,120 bytes, with twenty ordered immediate callees and twenty typed references checked in total. Nine bodies remain, with every function classified in the 441-row inventory.

The recursive direct-call audit retains compatible counterparts for 414 of those 432 matched bodies. Eighteen lack direct-call closure: ten depend on missing business handlers, while eight trace to an allocator specialization mismatch. Data and indirect-call identity remain separate obligations. The formerly unnamed O0075 is now statically attributed to SweepFeesAdmin; its body remains unmatched and sweep execution remains outside the active scope.

The native historical-macro composition also reproduces 432 normalized windows and 85 raw-local matches in its own recipe. Its earlier Legacy Buy source does not replace the qualified 432/100 checkpoint or add to that checkpoint's raw count.

The portable Linux recipe reproduces both full artifacts across two fresh dependency builds. It preserves 432 normalized / 84 raw-local bodies with default section order. Rechecking both fresh outputs retains the same 414-window direct-call relation; a fresh cache alone does not repair the remaining call targets.

The AMM handler shape controls isolate account-copy expansion, arithmetic error flow and native-key evaluation order. Nine source/compiler controls preserve their 432-window search baseline; one separately compiled variant also preserves all 100 qualified raw matches. They add no complete function match and have no fresh runtime qualification.

The current-parent AMM event composition adds the complete 1,784-byte normalized sell-event body, retaining all prior matches. Two builds agree; all 17,462 maintained cases and 26 focused event pairs pass. Its 641-window research artifact remains bound to its former 640-window parent; the maintained 647-window checkpoint is reported above. The parent's other supplemental matrices were not rerun on this artifact.

Pump Round37 passes 10,468 full cases plus 7,636 focused executions, with 18,100 paired diagnostic-log cases. AMM passes 17,462 full cases plus the separate account, fee, CPI, boundary and error-order matrices recorded in its checkpoint. The independent Pump/AMM migration-pair replay checks 65 signed inputs in four program combinations: 260 executions and 195 comparisons, with no differences. This remains bounded composition evidence. These corpora overlap and must not be summed as unique scenarios. Tests use captured programs in local VMs; they do not establish current-chain acceptance.

The current Mayhem initializer recovery adds the complete 960-byte normalized initializer, including its five immediate callees and four typed data references. Two current-framework builds agree; 6,636 fresh trade pairs and 69 initializer pairs pass, with ten successful creations. That checkpoint has 430/441 normalized matches and eleven unmatched windows. The complete per-window inventory separates raw-equal, normalized-only and unmatched bodies. A separate historical macro composition reaches 430/141, kept outside the current row.

The current-source Legacy Buy ownership composition preserves that 430/100 frontier and improves the partial handler to 13,784 bytes against 13,848 original bytes. Its 50 immediate callee shapes and seven Source records agree; two builds and 486 signed replay pairs pass. The full body remains unmatched, so this adds no window to the table.

The earlier Mayhem trade-origin and validator recovery adds the complete 1,296-byte normalized quote validator with its eight immediate callees and fourteen typed data references checked. It reaches 429 normalized and retains all 100 raw matches. Three partial trade handlers now reproduce 21 Source records and three CPI error origins. Two qualified builds agree, and 65 fresh case pairs pass. At that checkpoint twelve bodies, an allocator specialization and whole-ELF identity remained unresolved; older runtime receipts keep their original artifact bindings.

The BuyV2 sizing follow-up preserves that frontier and restores the original typed sizing failure for all three quote families. Its 6,636 fresh trade comparisons agree in functional results and complete non-compute logs. The BuyV2 body remains unmatched.

A same-IR compiler diagnostic produces identical Mac and Linux LLVM objects for one earlier initializer control. This narrows that investigation without adding a function match.

The quote backend replay holds the saved Rust IR fixed: v1.54 reproduces the reference helper's masked 1,120-byte body, while v1.52 emits 1,288 bytes and v1.44 rejects the IR. The original quote helper still differs in sixteen instruction slots; this diagnostic adds no recovered function or runtime coverage.

An allocator-context experiment reproduces the missing reserve helper through a zeroed-allocation probe. It identifies a compiler condition to recover through justified source; the probe remains a diagnostic and the current reconstruction counts are unchanged.

The historical parser follow-up reproduces that allocator form with an earlier Anchor event-parser template and current event types. It is a mixed-source compiler experiment; original Mayhem source remains unproven. The earlier current-source composition now preserves all 429 normalized matches and reaches 139 raw-local bodies, with one additional matching allocator call. Repeated native builds agree; 6,636 fresh trade and 69 initializer comparisons pass. Its 39 additional raw bodies cover 33,968 original text bytes. This remains a diagnostic, so the established checkpoint counts in the table above are unchanged.

The current-source historical macro composition reproduces that same artifact with the complete historical Anchor macro and historical event definition, removing the manually rendered parser. Two native root builds agree; the upstream-gated control reproduces the parent. The target runtime is still current Anchor, and no new original matches or target executions are claimed.

The latest Fees Extend recovery reconstructs the 750-instruction handler through ordinary Rust ownership and error propagation. Fees now has 582 normalized / 200 raw-local matches, preserving all 21,079 readonly bytes and the earlier recoveries. Two fresh normal Cargo builds agree; all 17,331 fresh comparisons pass. Sweep, Crank, CreateDonation, absolute layout and complete ELF identity remain unresolved.

The Fees frame and inlining archive preserves another 1,675 new or updated research files beyond the earlier checkpoints. It includes a current-source Crank build, measured stack-lifetime improvements, and Create call-graph recovery. The full recovery chain contains 88,263 current files. These experiments retain their individual status and add no accepted matches.

The latest PumpSwap optional-u64 and Context recovery matches 651 windows and 148 raw bodies, fixes all 123 short optional-u64 differences, restores the CreatePool and V2 wrapper boundaries, and recovers typed creator-payout call structure. All 17,462 corpus cases and retained supplemental suites pass; 134 AMM windows remain.

Remaining priorities are the 291 Pump, 134 AMM, 3 Fees and 9 Mayhem unmatched windows; deeper call/data/relocation identity; original build provenance; and uncovered behavior such as authentic fixed-admin AMM create_config success. The historical 150-handler audit remains a separate bounded classification; newer function matches do not retroactively certify every handler.

See remaining work, current reconstruction review and the research history for evidence and limitations.

Dependency evidence and selection status. Allocation-image equality is separate from unchanged compiler-output equality.

Use Python 3.12. Clone without line-ending conversion to preserve evidence hashes:

git clone --config core.autocrlf=false https://github.com/lalalune/pumpfun-source.git
cd pumpfun-source
python3 scripts/verify_evidence.py
python3 scripts/test_tooling.py
python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/python scripts/local_validation.py

Build and compare instructions: tooling guide and scripts index. Source is in programs/, captured comparison inputs in evidence/, and reproducibility records in repro/ and research/. See also scope, security policy and audit scope.

This repository's own code and documentation are released under the MIT License. Third-party and vendored materials (for example the Apache-2.0 Solana SDK files under programs/pump-amm/vendor, imported research and retained crate archives) keep their original licenses, and upstream Pump IDLs and binaries remain with their original authors.