Security model
Roles, keys, config registration and what the protocol trusts.
This page describes who can do what in social_gate, what the protocol relies on, and how it has been tested. It is written for integrators, auditors and anyone who wants to know exactly what they are trusting.
Roles
All roles live in one account, the GateConfig PDA. Nothing else in the program is configurable.
| Role | Can | Limits |
|---|---|---|
| Admin | Replace the sponsor, approver and launcher keys, change the partner wallet, hand over the admin role. | A single address, which can be a multisig. Handing over needs both the old and the new admin to sign. |
| Launcher | Attach the gate to a new pool at launch, and register or unregister curve configurations. | Only for fresh pools of registered configurations; see Token guarantees. |
| Approvers | Sign approve_buy for one destination and one maximum amount. | Up to 8 keys. A plain approver signature approves nothing. |
| Sponsors | Their signature lets a buy through: this is fomo's key. | Up to 8 keys. Must sign and be listed in a top-level instruction. |
| Partner | Receives FOMOPRIME's share of trading fees as the curve's fee claimer. | Every registered configuration must name it. |
Roles are disjoint: a sponsor is never an approver, and the admin and launcher never hold a buy role. Every admin instruction re-checks this (RoleConflict, 6014), so a launch signature can never double as a buy approval.
Curve configuration registration
Anyone can create a Meteora curve configuration that names FOMOPRIME's partner wallet. To stop strangers from launching "FOMOPRIME" tokens on configurations FOMOPRIME never reviewed, the gate only attaches to pools whose configuration has a registration: an on-chain record created by the admin or the launcher, in the same transaction that creates the configuration.
Key rotation
A registration counts only while the key that signed it is still the admin or the launcher. Rotating a compromised launch key therefore voids every registration it made at once (RegistrationStale, 6026). Tokens that already launched are not affected.
Key handling
Some rules can't be enforced on chain, so FOMOPRIME follows them operationally:
- No protocol key ever pays fees or relays transactions for other people. On FOMOPRIME, the buyer pays the network fee.
- The backend only co-signs transactions it built itself, with one approval placed directly before one swap.
- The launcher and admin register only configurations the backend created and checked, setting by setting.
Trust assumptions
| You rely on | Why | If it fails |
|---|---|---|
| Meteora DBC and DAMM v2 | They hold the liquidity and run the curve and the open pool. | Outside FOMOPRIME's control, as with any Meteora pool. |
| Privy (user wallets) | It creates users' embedded wallets and runs the secure hardware that signs for them. | Users can export their keys at any time and keep full control of their funds. |
| fomo's signing convention | fomo buys pass because fomo lists its key in the transactions it builds. | fomo buys fail until the new key is registered. Sells and FOMOPRIME buys keep working. |
| FOMOPRIME's approver key | It signs the approvals for buys on FOMOPRIME. | A leaked key could approve buys; it can't move funds or block sells. The admin replaces it. |
| The program's upgrade authority | social_gate is upgradeable, so fixes can ship. | An upgrade can change the gate for tokens still on a curve. Graduated tokens no longer have the hook. |
Monitoring and recovery
- A monitor watches for fomo-signed buys that the gate rejected, the sign that fomo changed or rotated its keys.
- The admin can register up to eight sponsor keys, so a rotated fomo key is restored without a redeploy.
- If fomo buys ever stop, the curve can still complete through approved buys on FOMOPRIME.
Testing and review
social_gate is written in pinocchio without Anchor, allocates no heap memory and makes no calls to other programs from the hook. It is covered by unit tests and an end-to-end suite of 63 scenarios that run against Meteora's real mainnet program on a local validator, including replays of the attacks found in internal security reviews. It has not had an external audit yet.
Note