Inside the prism.
The Refract standard on one page: the prism check, its five channels, profiles, holds, anchor keys, the blackout list, keyless vaults and the make-whole pool. Plus what exists today and what doesn't yet.
Overview
On SPL and Token-2022, the only question a transfer has to answer is “did the owner sign?” A drainer never needs to break a wallet: it gets one signature on a transaction that moves everything, and the token program agrees.
Refract moves the decision into the coin. A Refract coin lives in a token program that runs the prism check on every outgoing transfer before any balance changes, and enforces what it decides. The rule set is fixed per coin, so it applies identically in every wallet, every dApp and every bot.
The design assumes your key will sign something bad one day. Everything here is about limiting what that one signature is worth.
The prism check
The check runs on four instructions: transfer, delegated transfer, approve and close. It answers with an amount rather than a yes/no, in one of five verdicts:
| Verdict | Effect |
|---|---|
| Pass | The full amount moves now. |
| Dim | An approval is cut down to the coin's cap and given an expiry. |
| Hold | The allowed share moves now; the remainder sits in escrow for the hold window. |
| Black out | The destination is on the blackout list. Nothing moves. |
| Reject | The instruction isn't allowed at all: changing the account owner, closing an account that still has a balance. |
The check can't move tokens you didn't send, never sees your key, and has no admin path. It keeps 64 bytes of state per holder next to the balance: the rolling 24-hour counters and a compact filter of addresses you've paid before.
Five channels
A prism splits white light into bands. The check splits a transfer the same way, into five readings, and rules on those rather than on the signature, which a drainer always has.
| Channel | What it measures |
|---|---|
| Size | The share of your balance this moves or approves. |
| Recipient | Whether you've paid this address before the current window. |
| Age | How long ago the destination first appeared on-chain. |
| Pace | How much already left your wallet in the rolling 24 hours. |
| Signer | Owner key, delegate, or your anchor key. |
You, selling 40%
normal useA drainer holding your signature
drainerProfiles
A profile is six numbers written into the coin at launch. Holders can make their own wallet stricter, never looser than the coin.
| Field | Sealed | Balanced | Active |
|---|---|---|---|
| fresh.allowPctPer24h | 1% | 3% | 8% |
| fresh.youngerThanDays | 14 d | 7 d | 3 d |
| known.allowPctPer24h | 20% | 50% | 100% |
| hold.minutes | 90 min | 45 min | 15 min |
| approvals.capPct | 1% | 3% | 8% |
| approvals.lapseHours | 30 min | 1 h | 12 h |
An address is known if you paid it before the current window, if its first on-chain activity is older than the fresh threshold, or if you registered it and its 72-hour notice has passed. Every other address is fresh. Swaps into the coin's own pool are always passed.
Holds and reflection
Held tokens go to an escrow account owned by the prism program, one per held transfer. It opens in exactly two ways:
The allowance moves at once. It's 3% on Balanced, small on purpose.
Your anchor key signs and the escrow returns home. The destination is blacked out.
Nobody objected, so anyone can settle the escrow to the destination.
The signing wallet has no instruction that shortens, cancels or redirects its own hold. A stolen signature buys a drainer the allowance and a timer; your anchor key gets a notification the moment the escrow opens.
Anchor keys
An anchor key can do two things: reflect a hold, and black out the destination of a reflected hold. It can't spend, trade or approve. By default it's a passkey (secp256r1) on your phone, bound the first time you receive a Refract coin; a hardware key or a multisig works too.
Replacing an anchor takes a 72-hour notice, during which the current anchor can veto. Holders who never set one still get the profile and the hold; their holds simply settle when the window ends.
The blackout list
Reflecting a hold writes its destination to a shared blackout list, with the reflection as proof. Every Refract coin reads the same list, so an address caught draining one coin can't receive any of them.
An entry expires after 180 days without another reflection, or earlier on appeal with a signed proof that the funds were legitimately the address owner's.
Keyless vaults
At launch a Refract coin's LP tokens are minted directly into a vault: a program-derived account with no private key. The vault program has no admin and no upgrade authority, and there is no instruction that withdraws LP.
Each trade pays a 1% fee that the vault program splits in the same transaction:
| Share | Goes to | |
|---|---|---|
| 0.45% | Pool depth | Added back to the coin's own LP, inside the vault. |
| 0.30% | Make-whole | Repays verified drains that got past the prism. |
| 0.15% | Creator | Streams to the launcher; never claimable in one go. |
| 0.10% | $REFRACT buyback | Bought on the pool and burned. |
Make-whole pool
The pool collects 0.30% of every trade across all Refract coins. When a reflection blacks out an address, the make-whole program traces every transfer to it in the previous 72 hours, on any Refract coin, and repays the senders in the same coin up to the Balanced fresh allowance per holder.
Each step (reflect, trace, repay) can be run by any wallet for a small bounty. No team sits in the loop.
What's live today
| Piece | Status |
|---|---|
| Launchpad | Live. Creates a pump.fun coin and, in the same transaction, locks 100% of its creator fees to the Refract treasury via pump.fun's fee-sharing program. Verified on-chain after every launch. |
| Projects | Live. Listed straight from the chain: every coin whose locked fee split pays the treasury. |
| Wallet scanner | Live. Reads mainnet for open approvals, permanent delegates, foreign close authorities and frozen accounts, and can revoke approvals for a connected wallet. |
| Simulator and Workshop | Live. Both run the model on this page in your browser. |
| Prism, vault and make-whole programs | Spec only. Not deployed, not audited. pump.fun coins are standard Token-2022 mints and do not carry the prism check. |
Limits
What the prism doesn't do, stated plainly:
- It only protects Refract coins. Your SOL and every other token are as exposed as before.
- Someone holding both your key and your anchor can wait out a hold. Keep them on different devices.
- A patient drainer can take the fresh allowance every day. That's why it's small, and why the make-whole pool exists.
- Pool swaps are never held. A drainer that sells your tokens for SOL inside your wallet still has to get the SOL out, and SOL isn't protected.
- None of the Refract programs are deployed or audited. Don't send anything anywhere because of this page.