Docs
| name | value | note |
|---|---|---|
| hash | SHA-256 | Solana sha256 syscall · EVM precompile 0x02 |
| chain value | 28 bytes | SHA-256 output truncated to its first 28 bytes |
| Winternitz w | 256 | one byte per digit |
| message digits | 28 | the 28-byte truncated message hash |
| checksum | C = Σ(255 − dᵢ) | over the 28 message digits, max 7,140, 2 bytes big-endian → 2 digits |
| chains | 30 | 28 message + 2 checksum |
| signature | 840 bytes + 32 | 30 × 28-byte chain values, plus the pubSeed |
| verify cap | ≤ 3,600 steps | Σ(255 − dᵢ) over all 30 digits; the client grinds a salt until it holds |
| chain step F | sha256(QM/wots/chain ‖ pubSeed ‖ i ‖ step ‖ x)[0:28] | i and step are uint8 |
| public top | pkᵢ = chain(skᵢ, i, 0, 255) | 255 applications of F |
| key hash | sha256(QM/wots/pk ‖ pubSeed ‖ pk₀ ‖ … ‖ pk₂₉) | the only key material stored on chain |
| quantum margin | ~112-bit (estimate) | 224-bit chain values; Grover's search halves the exponent |
From 24 words to key n
| seed | derivation |
|---|---|
| master | BIP-39 seed of the 24 words: PBKDF2-HMAC-SHA512, 2,048 rounds, empty passphrase (64 bytes) |
| bunkerSeed | sha256(QM/bunker/seed ‖ master ‖ chainId u64 ‖ bunkerIndex u32) · chainId 101 Solana, 103 the devnet build, 4663 Robinhood Chain |
| keySeedₙ | sha256(QM/key/seed ‖ bunkerSeed ‖ n u32) |
| pubSeedₙ | sha256(QM/wots/pubseed ‖ keySeedₙ) |
| skᵢ | sha256(QM/wots/sk ‖ keySeedₙ ‖ i u8)[0:28] for i in 0..29 |
The signed message
| field | bytes | encoding |
|---|---|---|
| tag | 9 | ASCII QM/msg/v1 |
| chainId | 8 | uint64 big-endian · 101 (103 for the devnet build) |
| program | 32 | the bunker program id |
| vaultId | 8 | uint64 · from the registry PDA at creation |
| keyIndex n | 4 | uint32 · the key that signs |
| kind | 1 | 0 SOL · 1 SPL token · 4 rotate · 6 call · 2, 3, 5, 7 only rotate on Solana |
| asset | 32 | zero for SOL and rotations · the mint (kind 1) · the program called (kind 6) |
| amount | 16 | uint128: lamports or token units · 2⁶⁴−1 = all · 0 for kind 6 |
| to | 32 | recipient (0, 1) · zero (4) · sha256(account count ‖ keys + flags ‖ data) (6) |
| nextKeyHash | 32 | keyHashₙ₊₁: the key this bunker rotates to |
| salt | 8 | uint64 · ground until the verify walk is ≤ 3,600 steps |
| kind | what it authorizes |
|---|---|
| kind 0 | withdraw SOL to any address (the bunker keeps its rent floor) |
| kind 1 | withdraw an SPL token, classic or Token-2022 ($BUNKER is Token-2022) |
| kind 4 | rotate only: no payout, emergency re-key |
| kind 6 | one call signed by the bunker: the pump.fun fee claim, a stake, an unstake |
| kind 2 · 3 · 5 · 7 | verify and rotate, move nothing (EVM-only kinds) |
Programs
Circle can freeze USDC. Any SPL token whose mint keeps a freeze authority can be frozen, and a Token-2022 mint with a permanent delegate can move or burn tokens, in a bunker or out. SOL and coins whose mint and freeze authorities are revoked have no issuer switch. A bunker protects you from a broken key, not from the issuer.
Robinhood can freeze, pause or burn any tokenized stock, in a bunker or out, and a beacon upgrade could add an allowlist to every stock token. Paxos can freeze USDG. ETH and plain memes have no issuer switch. A bunker protects you from a broken key, not from the issuer.
pump.fun's admin key can reassign $BUNKER's creator, which sends the creator fees of later trades to the new creator; every fee earned before the admin acts stays payable only to the fee bunker, and anyone can push it in.
pump.fun's admin key can take a Bunker Mode coin over, which sends every creator fee not yet cranked into the bunker, and all later ones, to the new creator; what the bunker already holds stays, and mayhem-mode coins refuse the takeover.
The Pons V2 factory can reassign a coin's creator-fee recipient after a 3-day timelock (CREATOR_FEE_RECIPIENT_TIMELOCK = 259,200 s): fees stay in bunker mode unless Pons does that, with three days of notice on chain.
Distributed when the team triggers it; no schedule and no rate are promised; fees never pay holders who do not stake.
Unaudited. The Solana program is immutable once its upgrade authority is burned; the Robinhood Chain contracts start with small deposit caps.
Another Solana coin also trades as BUNKER. Only the mint published on the $BUNKER page is this one.