Security and trust

What you can check on-chain, and what you have to take on trust.

Checkable on-chain

• That $CONATUS was created by a given wallet, and that this wallet is the one collecting the creator fees.
• Every collection, every buy and every burn, by transaction signature.
• That the burned tokens are really gone: the supply of the mint falls by the burned amount.

Taken on trust

• The rule is applied by a program, not by a contract. The runner is run by the team. If it stops, nothing happens. If the team changes it, the rule changes. The code is public so that you can see what it does today.
• The dev wallet is an ordinary wallet. Whoever holds its key can move what is in it, including the energy reserve. The journal shows what the runner did, not what a key could do.
• The energy count is kept by the runner. It is visible after the fact in the claim transactions.

Risks

• Key risk. The key sits in a file on the machine that runs the runner. Use a wallet used for nothing else and keep only the SOL it needs. Anyone who gets the key can take what is there.
• Machine risk. If the machine is off, the creature is asleep.
• Price risk. The reserve is small compared with a real sell-off.
• RPC risk. A public RPC can be slow or refuse requests. The runner retries and says so.
• pump.fun risk. The runner depends on pump.fun's programs and on their fee rules, which pump.fun can change.

What the code is built to avoid

• No sell instruction and no transfer to any address.
• It stops at start if the key is not the creator of the coin.
• It spends only the energy it counted from collected fees, never other money in the wallet, and burns only the tokens a reflex bought.
• Test mode by default.