# PumpSwap

> Not investment advice. Ratings describe on-chain configuration only and may contain errors.

Snapshot 2026-10-24, methodology v0.2. Source: Celebtir, CC BY 4.0.

## Summary

- Chain: Solana
- Category: dex
- Stage: Stage 0
- TVL: $335.9M
- Website: https://swap.pump.fun/
- Core programs controlled by a Squads multisig

## Value

- Stablecoins $20.6M, SOL $270.15M, BTC $327.61K, other $44.83M
- SOL (lp): worst rating Low. no freeze, pause or seize power; native to Solana; mint authority renounced: supply is fixed; no transfer restrictions
- USDC (lp): worst rating High. balances can be frozen by single key 7dGb…Crar; new supply can be minted by single key BJE5…5ruG

## Activity

- 24h volume: $266.43M (−20.6% over 7 days)
- 24h fees: $2.92M (−7.2% over 7 days)

## Risk summary

- High: An approved upgrade takes effect immediately. Withdrawal completion within that period is not established by these configuration facts.
- Medium: Core program code can be replaced by 3 of 4 voters of multisig 2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW.
- Medium: Funds can be frozen if the protocol is paused by 3 of 4 voters of multisig 8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at using `admin`.
- Medium: The deployed code of pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA has not been verified against its public source.
- Medium: Program 6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P, which this protocol calls with user funds, can be upgraded by 3 of 4 voters of multisig 2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW.
- Medium: Program pfeeUxB6jkeY1Hxd7CsFCAjcbHA9rWtchMGdZ6VojVZ, which this protocol calls with user funds, can be upgraded by 3 of 4 voters of multisig 2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW.

## Risk analysis

- Upgrade control: **Medium**. Squads v4 multisig, 3 of 4 voters, time lock 0 s. To improve: a multisig of 5+ voters at a 60%+ threshold → LOW, or make the program immutable.
  - Evidence: [6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc](https://solscan.io/account/6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc) `upgrade_authority` at slot 460978361
  - Evidence: [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW) `threshold, time_lock, members, config_authority` at slot 460978361
- Upgrade delay: **High**. time lock 0 s. To improve: a time lock of 24 h+ → MEDIUM; 5 days+ → LOW.
  - Evidence: [6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc](https://solscan.io/account/6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc) `upgrade_authority` at slot 460978361
  - Evidence: [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW) `threshold, time_lock, members, config_authority` at slot 460978361
- Admin powers: **Medium**. `admin` can pause, held by Squads v4 multisig, 3 of 4 voters, time lock 0 s. To improve: limit admin keys to parameters behind a 24 h+ time lock, or renounce them → LOW.
  - Evidence: [ADyA8hdefvWN2dbGGWFotbzWxrAvLW83WG6QCVXvJKqw](https://solscan.io/account/ADyA8hdefvWN2dbGGWFotbzWxrAvLW83WG6QCVXvJKqw) `admin` at slot 460978631
  - Evidence: [8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at](https://solscan.io/account/8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at) `threshold, time_lock, members, config_authority` at slot 460978633
- Code transparency: **Medium**. source public at https://github.com/pump-fun, but the deployed build is not verified. To improve: verify the deployed build against public source (OtterSec) → LOW.
  - Evidence: [pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA](https://solscan.io/account/pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA) `verified_build` at slot 460978360
- Oracle dependency: **Not applicable**. the registry lists no price feeds; the evidence is the core programs' upgrade reads. To improve: not applicable: nothing to improve.
  - Evidence: [6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc](https://solscan.io/account/6naEzKeUuFh1Jeeu51NXQgr5qkXgXtc9WKNct4xynVJc) `upgrade_authority` at slot 460978361
  - Evidence: [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW) `threshold, time_lock, members, config_authority` at slot 460978361
- Dependencies: **Medium**. callee 6EF8…wF6P is Squads v4 multisig, 3 of 4 voters, time lock 0 s; callee pfee…ojVZ is Squads v4 multisig, 3 of 4 voters, time lock 0 s. To improve: callees rated Medium need a multisig of 5+ voters at a 60%+ threshold, or to be immutable → LOW.
  - Evidence: [pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA](https://solscan.io/account/pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA) `transaction sample (46 transactions)` at slot 460978634
  - Evidence: [B5MvUwXdiW1NMM6QFFD3ssPKBujD4zMohncbM73Z2BQu](https://solscan.io/account/B5MvUwXdiW1NMM6QFFD3ssPKBujD4zMohncbM73Z2BQu) `upgrade_authority` at slot 460978680
  - Evidence: [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW) `threshold, time_lock, members, config_authority` at slot 460978361
  - Evidence: [75Uu23mqWBb8LM8vDppqC1mQAnCcBuLXhVaDezVMQLRw](https://solscan.io/account/75Uu23mqWBb8LM8vDppqC1mQAnCcBuLXhVaDezVMQLRw) `upgrade_authority` at slot 460978680
  - Evidence: [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW) `threshold, time_lock, members, config_authority` at slot 460978361

## Stage

Stage 0. Stages describe who can change the protocol and how fast. They don't measure code security.

- [x] Stage 0: core programs identified in the registry (1 core programs)
- [x] Stage 0: public source for every core program (all core programs have public source)
- [x] Stage 0: upgrade control readable for every core program (upgrade control read for all core programs)
- [x] Stage 1: upgrade control rated Low or Medium (MEDIUM: Squads v4 multisig, 3 of 4 voters, time lock 0 s)
- [ ] Stage 1: upgrade delay of the Stage 1 minimum, unless upgrades need an emergency multisig (pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA: effective time lock 0 s; needs 5 days+ or an emergency multisig of 8+ voters at 75%+)
- [x] Stage 1: admin powers rated Low or Medium (MEDIUM: `admin` can pause, held by Squads v4 multisig, 3 of 4 voters, time lock 0 s)
- [x] Stage 1: no multisig has a single-key config authority (no single-key config authority)
- [ ] Stage 1: verified builds for all core programs (not verified: pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA)
- [x] Stage 1: every factor could be read (Unknown caps the Stage at 0) (no Unknown factors)
- [ ] Stage 2: core programs immutable, or upgradeable only through on-chain governance with a long delay (upgradeable without 30 days+ governance delay: pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA)
- [ ] Stage 2: no key can move or freeze user funds (can move or freeze funds: ADyA8hdefvWN2dbGGWFotbzWxrAvLW83WG6QCVXvJKqw.admin)

## Control graph

- PumpSwap AMM → PumpSwap: core program
- admin → PumpSwap: admin account
- USDC → PumpSwap: used as liquidity
- SOL → PumpSwap: used as liquidity
- Single key → USDC: can freeze · no delay
- Single key → USDC: can mint · no delay
- Squads 3 of 4 · no delay → PumpSwap AMM: can upgrade · no delay
- Squads 3 of 4 · no delay → admin: can pause · no delay

## Permissions

- Single key [7dGbd2QZcCKcTndnHcTL8q7SMVXAkp688NTQYwrRCrar](https://solscan.io/account/7dGbd2QZcCKcTndnHcTL8q7SMVXAkp688NTQYwrRCrar)
  - Freeze tokens: USDC (Circle), no delay
- Single key [BJE5MMbqXjVwjAF7oxwPYXnTXDyspzZyt4vwenNw5ruG](https://solscan.io/account/BJE5MMbqXjVwjAF7oxwPYXnTXDyspzZyt4vwenNw5ruG)
  - Mint tokens: USDC (Circle), no delay
- Squads 3 of 4 · no delay [2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW](https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW)
  - Upgrade the code: PumpSwap AMM, no delay
- Squads 3 of 4 · no delay [8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at](https://solscan.io/account/8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at)
  - Pause: admin on ADyA…JKqw, no delay
- Held by no one: Freeze tokens (SOL (Solana (native mint)))
- Held by no one: Mint tokens (SOL (Solana (native mint)))

## Programs

- PumpSwap AMM [pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA](https://solscan.io/account/pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA): core, Upgradeable loader, controller Squads 3 of 4 · no delay, public source at https://github.com/pump-fun, not verified, last upgrade none found

## Upgrades & governance

- Upgrades: 0 so far (history still filling)
- Last upgrade: none
- Average interval: not enough upgrades

## Updates

No changes have been recorded for this protocol since tracking began.

## Dependencies and sources

- Calls [6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P](https://solscan.io/account/6EF8rrecthR5Dkzon8Nwu78hRvfCKubJ14M5uBEwF6P): Squads 3 of 4 · no delay, rated Medium
- Calls [pfeeUxB6jkeY1Hxd7CsFCAjcbHA9rWtchMGdZ6VojVZ](https://solscan.io/account/pfeeUxB6jkeY1Hxd7CsFCAjcbHA9rWtchMGdZ6VojVZ): Squads 3 of 4 · no delay, rated Medium
- Registry source for admin admin (ADyA8hdefvWN2dbGGWFotbzWxrAvLW83WG6QCVXvJKqw): https://solscan.io/account/ADyA8hdefvWN2dbGGWFotbzWxrAvLW83WG6QCVXvJKqw
- Registry source for multisig Squads v4 (2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW): https://solscan.io/account/2yMoQqQrtbhq3nQ3wFoQQawWS65qcqUXcwHEYha4rshW
- Registry source for multisig Squads v4 (8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at): https://solscan.io/account/8EujzwPFNhZ5m4Kpa2XtrumNgwCbhgWwny9YWLCKA5at
- Registry source for program PumpSwap AMM (pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA): https://github.com/pump-fun/pump-public-docs/blob/main/docs/PUMP_SWAP_README.md
- Registry entry last reviewed: 2026-10-19 by celebtir-loop-draft

Web page: /protocols/pumpswap/