Pump Sdk Core

Build and extend the core Pump SDK — an offline-first TypeScript SDK that constructs Solana TransactionInstructions for token creation, buying, selling, migr...

Security Scan

The skill's declared requirements and runtime instructions are coherent with its stated purpose (a Solana-focused TypeScript SDK); it only asks for a Solana RPC URL and contains no install steps or other unexpected privileges.

Purpose & Capability

The skill describes an SDK that supports both an offline builder and an online wrapper that makes RPC calls. Requesting a single SOLANA_RPC_URL environment variable is consistent with the OnlinePumpSdk's behavior, but slightly at odds with the 'offline-first' emphasis in the description — the env var is only needed for the online features.

Instruction Scope

SKILL.md contains development/runtime guidance for building TransactionInstruction objects and for when to use RPC (getMultipleAccountsInfo). It does not instruct the agent to read unrelated files, request other credentials, or transmit data to unexpected endpoints.

Install Mechanism

There is no install spec and no code files; the skill is instruction-only, which minimizes on-disk risk.

Credentials

Only SOLANA_RPC_URL is required. That is proportionate to the documented OnlinePumpSdk functionality. The skill does not request private keys, tokens, or unrelated service credentials.

Persistence & Privilege

The skill is not force-included (always:false) and uses default autonomous invocation. It does not declare behavior that modifies other skills or system-wide settings.

Assessment

This skill appears internally consistent: it documents an offline instruction builder plus an online wrapper that needs a SOLANA_RPC_URL to make RPC calls. If you install it, only provide a Solana RPC endpoint you trust (it will allow the skill to read on-chain accounts via that RPC). The skill does not request private keys or other credentials, but if you do not want the agent to be able to make network calls, omit SOLANA_RPC_URL or disable autonomous invocation. For extra caution, review the upstream npm/GitHub package source (metadata references https://github.com/nirholas/pump-fun-sdk) before using it in production.

Pump SDK Core — Instruction Building & On-Chain Interaction

Build, extend, and maintain the core Pump SDK — an offline-first TypeScript SDK that constructs Solana TransactionInstructions for token creation, buying, selling, migration, and creator fee collection across three on-chain programs (Pump, PumpAMM, PumpFees) plus the Mayhem program.

Context

The SDK is published as @pump-fun/pump-sdk (npm) and powers the Pump protocol — a Solana-based token launchpad with bonding curve pricing, automatic AMM migration after graduation, tiered fees, and creator fee sharing. The codebase uses Anchor for IDL-based instruction building and supports both Token (SPL) and Token-2022 token programs.

Key Files

• src/sdk.ts — PumpSdk class with all instruction builders and account decoders
• src/onlineSdk.ts — OnlinePumpSdk class extending offline SDK with live RPC fetches
• src/index.ts — barrel re-export module defining the public API surface
• src/state.ts — TypeScript interfaces for all on-chain account state
• src/pda.ts — Program Derived Address derivation for all programs
• src/idl/pump.ts, src/idl/pump_amm.ts, src/idl/pump_fees.ts — Anchor IDL definitions

Architecture

• Offline SDK (PumpSdk): Builds instructions without a live connection. Uses Anchor Program instances initialized with a dummy keypair and connection. Exported as a singleton PUMP_SDK.
• Online SDK (OnlinePumpSdk): Wraps PumpSdk with a real Connection for fetching account state via getMultipleAccountsInfo. Provides "BothPrograms" methods that aggregate data across bonding curve (Pump) and AMM (PumpAMM) programs.
• Three program IDs: PUMP_PROGRAM_ID, PUMP_AMM_PROGRAM_ID, PUMP_FEE_PROGRAM_ID, plus MAYHEM_PROGRAM_ID for mayhem-mode tokens.

Instruction Builder Pattern

Every instruction method returns TransactionInstruction[] (not transactions), allowing callers to compose them into transactions freely. Methods follow a naming convention:

• *Instruction — single instruction
• *Instructions — multiple instructions (e.g., ATA creation + buy)

Account Decoders

The SDK decodes raw AccountInfo<Buffer> into typed interfaces using the Anchor coder:

• decodeGlobal, decodeBondingCurve, decodeFeeConfig, decodeSharingConfig, etc.
• Nullable variants (e.g., decodeBondingCurveNullable) handle missing or undersized accounts gracefully.

Slippage Calculation

maxSolCost = solAmount + (solAmount × slippage × 10 / 1000)
minSolReceived = solAmount - (solAmount × slippage × 10 / 1000)

Patterns to Follow

• Always return TransactionInstruction[] from instruction builders, never full Transaction objects
• Use getMultipleAccountsInfo to batch RPC calls (2–3 accounts per call)
• Support both Token (SPL) and Token-2022 programs via tokenProgram parameter
• Handle account extension (extendAccountInstruction) for bonding curves that need more space
• Validate shareholder arrays: max 10 shareholders, shares must total 10,000 bps, no duplicates, no zero shares
• Use typed error classes from src/errors.ts for validation failures
• Keep the offline SDK connection-free; all RPC calls belong in OnlinePumpSdk

Common Pitfalls

• Circular dependency between sdk.ts and onlineSdk.ts
• Buy instruction passes { 0: true } as a flags argument — this is intentional, not a bug
• BONDING_CURVE_NEW_SIZE = 151 — accounts may need extension before certain operations
• BondingCurve.complete === true means the token has graduated to AMM — bonding curve operations will fail
• The createInstruction (v1) is deprecated in favor of createV2Instruction (Token-2022)