How it works

Bountyline is a pump.fun launcher for open-source projects. A coin is tied to one public GitHub repository, and its creator pledges a share of the coin's creator fees to bounties on merged pull requests. This page says exactly what the site does, what it signs, and what it can't do.

1. The proof file

Before a launch, the maintainer commits a file named .bountyline at the root of the repository's default branch, with one line:

wallet: <the Solana address that will launch the coin>

The site reads it from raw.githubusercontent.com when you check the repository, again on the server before uploading the coin's metadata, and again before listing the coin. Forks are refused. The coin page keeps reading the file and says if it disappears or names another wallet. Only someone with push access can add it, which is the point; it doesn't prove who that person is.

2. The launch

1. The image and a metadata JSON are pinned on IPFS (Pinata). The JSON holds createdOn: https://bountyline.fun, the coin page as its website, a line in the description, and "bountyline": { "v": 1, "repoId": <GitHub id>, "repo": "owner/name", "pledgeBps": 5000 }. The repository is kept by its numeric id, so a rename or a transfer doesn't break it.
2. PumpPortal builds the creation transaction (create + optional dev buy). Your browser checks that your wallet pays and that it only calls known programs, your wallet signs, a mint key made in your browser signs, and the transaction is simulated: if it would take more SOL than the review showed, it isn't sent.
3. The server re-reads the creation on-chain (success, pump.fun called, SOL-quoted curve, creator = fee payer, Bountyline marker in the metadata) and the proof file on GitHub before the coin appears in the list.

3. Bounties on GitHub

An open issue is a bounty when it has the label bountyline, or a label like bounty: 0.5 SOL. The coin page lists them. To claim one, a contributor opens a pull request that fixes it and writes Bountyline: <their Solana address> in its description. The amount on a label is the maintainer's word: what counts is what gets paid.

4. A payout

The creator picks a merged pull request on the coin page, checks the contributor's wallet and the amount, and signs one transaction:

1. Sweep: creator fees still held on the coin's bonding curve or PumpSwap pool move to pump.fun's creator vaults.
2. Collect: the vaults pay out to the creator's wallet; PumpSwap fees arrive as WSOL and are unwrapped to SOL.
3. Pay: a System transfer of the bounty from the creator to the contributor.
4. Memo: bountyline:1:<mint>:<PR number>, written by the SPL Memo program.

Steps 1 and 2 are optional: with nothing to collect, the bounty comes from the wallet's own SOL. Allowed programs: pump.fun, PumpSwap, System, Compute Budget, SPL Token, Associated Token, Memo. After signing, the transaction is simulated with a cap on the SOL it may take.

The server then re-reads it: signed by the coin's creator, exactly one Bountyline memo naming this coin, SOL to exactly one wallet that isn't the creator's, at least 0.001 SOL. It asks GitHub whether that pull request exists in the coin's repository and is merged, and records the pull request's title and author, whether the wallet matches the one in the pull request description, and whether the pull request was opened by the repository's owner account.

5. The ledger and the reward line

The site reads the creator wallet's transactions since launch (up to 500 new ones per pass, at most once a minute) and records every creator-fee collection, through a payout or not. The pledge owes its share of all of them. The reward line on each card is that rope: solid for what was paid, hatched for what is owed and not paid, one violet tick per paid pull request. Payouts the browser didn't report are found by the same scan.

Who enforces what