What is deployed, and
what it promises

Deployed

Nothing yet. The cardr_vault program has no mainnet address, no explorer record and no verified build. When it ships, the program ID and the verified source hash will be listed here.

It is designed with no admin, no config account and no upgrade path: the upgrade authority is revoked at deploy, so the code you read is the code that runs.

Binding

bind(name, symbol, grader, cert, card) reserves a certificate and records the pairing against the SPL mint the launch will create, derived from the name, symbol and creator wallet before the coin exists.

• A cert can be bound once. Its record is a PDA seeded by grader and cert, so a second attempt fails with CertTaken.
• A mint can be bound once. Re-binding fails with AlreadyBound.
• An empty cert is rejected. The certificate is the only field anyone can independently verify.
• There is no setter. The account is write-once by construction, not by policy.

card_of(mint) reads it back, and mint_for_cert(cert) goes the other way.

Fees

The vault PDA is set as the launch’s creator fee recipient. recycle(mint) is permissionless and pays the caller nothing. It:

• claims the creator fees owed to the vault for that pool,
• burns any token side directly with the SPL burn instruction,
• spends the whole SOL side buying the coin on its own pool,
• and burns the output in the same transaction.

The swap builder is public so it can be diffed, and a test pins the burn so a refactor cannot redirect the buys.

What it cannot do

• There is no withdraw, no rescue, no sweep and no admin. SOL enters and the only exit is the swap.
• It cannot change a binding, and it cannot bind on your behalf.
• It cannot hold the card. The slab is physical and stays off chain.

Known edges

• The launch has to match the bind. Name, symbol and wallet all feed the mint derivation. Get one wrong and fees route to a coin nobody bound.
• The binding is a claim, not custody. It proves which certificate a coin refers to and that nobody changed it. It does not put the slab behind the coin.
• A missing pool fails the swap. If the coin has no pool yet, recycle fails rather than stranding the SOL. Nothing is lost; it can be called again.
• Unaudited. Read the source. Size your position like the code has a bug in it, because it might.