Send 100% of $LUMA to 4fT…x9Qe
signed with the owner key
Lose 3%,
not the wallet.
The check ships inside the coin.
No extension. No blocklist bot. A Refract coin carries its own prism check in its token program. Before any balance changes, the transfer is measured on five channels and only the share that looks like normal use gets out. Same rules in every wallet, on every site, even after you've signed something you shouldn't have.
See the prism ↓status: prism, vault and make-whole programs are a spec; the simulator and Workshop run it. Launches today are pump.fun coins with 100% of creator fees locked to the treasury.
A signature is all a drainer needs.
Drainers don't crack wallets. They talk you into one signature, and an ordinary token treats that signature as the whole story.
A regular SPL or Token-2022 coin
- Asks
- Was it signed by the owner?
- Knows
- That the key matches. Nothing about where the tokens are going or how much of you that is.
- Does
- Moves everything. About 400 ms later the wallet is empty.
A Refract coin
- Asks
- How much, to whom, how new, how fast, signed by what?
- Knows
- The full shape of the transfer before a single balance changes.
- Does
- Passes, dims, holds, blacks out or rejects it. The token program enforces the verdict.
White light in. Sorted light out.
Refract doesn't care whether a transfer was signed; a drainer always has that part covered. It cares what the transfer looks like, and it lets out only the share that looks like you.
Someone signs
A transfer, an approval, an account close. Could be you, could be a page holding your signature. The coin doesn't try to guess which.
The coin pauses it
Refract's token program calls the prism before it touches any balance. At this point nothing has moved.
Five channels are read
Size, recipient, age, pace and signer: five numbers that describe the transfer, not the person who signed it.
One verdict, enforced
Pass, dim, hold, black out or reject, applied inside the same instruction. There is no admin switch.
Same key, same coin, two very different transfers
measured under the Balanced profileYou, selling 40%
normal useA drainer holding your signature
drainerIt lives in the mint, not the wallet.
Nothing to install, no list to keep updated. The check is part of the coin, so every copy of the coin, in every wallet, carries it.
- 1Glass
The prism check
Compiled into the token program. Runs before any token leaves a wallet, and before any approval is recorded.
- 2Channels
Your profile
Five limits, one per channel. Fixed per coin at launch and public for anyone to read.
- 3Fan
The verdict: pass, dim, hold, reflect or black out
- 4Plinth
The keyless vault
Pool liquidity and fees, held by a program account with no private key to steal.
Five ways a transfer can leave.
Pass
Swaps into the pool, addresses you've paid before, small sends. Most days you'll never notice the prism.
Dim
An “unlimited” approval becomes a few percent that lapses within the hour.
Hold
Big moves to brand-new addresses wait in escrow until the timer ends or your anchor key steps in.
Reflect
Your anchor key sends a held transfer back home. The signing key can't stop it.
Black out
A reflected destination joins the blackout list and can't receive any Refract coin.
Your private keys.
Who owns your account.
Tokens you never sent.
The token program checks every verdict, and no admin key exists that could switch it off.
Sign a drain. Watch it fail.
Five tricks drainers really use, staged against a demo wallet holding a coin on the Balanced profile. Pick one, play the person who signs it by accident, and watch what the prism lets out.
Everyone clicks the wrong button once. Approve it and see what actually leaves.
Your wallet
4.20M $LUMA · Balanced profileA pool nobody can pull.
The prism protects holders. The vault protects the pool: LP is minted into a program account that has no key at all, so there's nothing to rug with.
A usual launch
- LP
- Sits in the deployer's wallet, or is “burned” on their word.
- Fees
- Go wherever the team sends them, off-chain.
A Refract vault
- LP
- Minted straight into a program vault. No private key, no upgrade authority.
- Fees
- 1% per trade, split on-chain inside the same transaction.
Where each 1% trading fee goes
split by the vault program, every tradeThe vault and make-whole programs are part of the Refract spec and aren't deployed yet. Coins launched here today trade on pump.fun, with 100% of their creator fees locked to the Refract treasury on-chain.
If 3% still gets out.
The prism keeps losses small. The make-whole pool is how small losses get paid back, with no forms and no support tickets.
Reflect
Your anchor key calls the held part home. The destination goes on the blackout list, with the reflection as proof.
Trace
The make-whole program finds every transfer to that address over the past 72 hours, across all Refract coins.
Repay
Matched losses are repaid from the pool in the same coin, up to the Balanced fresh allowance. Anyone can run the crank for a small fee.
Choose how tight the glass is.
Each coin picks a profile at launch. Holders can tighten their own wallet further; nobody can loosen it past the coin's setting. Each grid is 100 tokens a drainer just got you to sign over to a fresh address.
Sealed
Treasuries, team wallets, cold bags.
- Fresh allowance
- 1% / 24h
- “Fresh” means younger than
- 14 days
- Known allowance
- 20% / 24h
- Hold window
- 90 min
- Approval cap
- 1% · 30 min
Balanced
defaultThe default for every new coin.
- Fresh allowance
- 3% / 24h
- “Fresh” means younger than
- 7 days
- Known allowance
- 50% / 24h
- Hold window
- 45 min
- Approval cap
- 3% · 1 h
Active
Market makers and busy traders.
- Fresh allowance
- 8% / 24h
- “Fresh” means younger than
- 3 days
- Known allowance
- 100% / 24h
- Hold window
- 15 min
- Approval cap
- 8% · 12 h
Questions people ask first.
Where exactly does the check run?+
In the coin's token program. A wallet extension only protects the people who installed it; a Refract coin is checked on every transfer, from any wallet, on any site.
Can a drainer with my signature cancel the hold?+
No. A hold ends one of two ways: the timer runs out, or your anchor key reflects it. The signing key has no instruction that can shorten, cancel or redirect a hold, so a stolen signature is worth the allowance and nothing more.
What is an anchor key?+
A second key whose only powers are “reflect this hold” and “black out this address”. By default it's a passkey on your phone; it can also be a hardware key or a multisig. It can't spend or trade. Replacing it takes a 72-hour notice the current anchor can veto.
Will this slow down my trading?+
Swaps into the coin's own pool are never held, and that's where most transfers go. The prism only steps in for wallet-to-wallet sends to addresses it doesn't know, above your daily allowance.
I'm moving everything to my own new wallet. Now what?+
Wait out the hold, approve it with your anchor key so it settles right away, or register the new address ahead of time; once the notice period passes it counts as known.
Can the creator pull the liquidity?+
In the Refract vault design, no: LP is minted into a program account with no key, no admin and no upgrade authority. Coins launched today trade on pump.fun, whose curve and pool are pump.fun's own programs, so the creator never holds LP there either.
Isn't this just a blocklist?+
Only at the very end. The prism judges the shape of a transfer, so it stops drainers no list has seen yet. An address joins the blackout list only after an anchor key reflects a transfer to it.
What's live today?+
The launchpad (pump.fun coins with 100% of creator fees locked to the Refract treasury on-chain), the wallet scanner, the drain simulator and the Workshop. The prism, vault and make-whole programs are a published spec and aren't deployed.
Put the prism in the coin.
Launch a coin today, or shape a profile in the Workshop and test it against real drain patterns: tight windows for team wallets, looser ones for market makers, holds that grow with size.