Risk disclosure

Last updated: 2026-11-04 (terms version 2026-11-04)

Using Pack can lose you money, and in some cases all of it. This page lists the main risks plainly, it does not list every risk, and it is part of the terms of service. Use Pack at your own risk, and only with money you can afford to lose.

1. Risks for everyone

1.1 Rewards and bond returns depend on trading volume and can be lost entirely. Fees come only from trading, so low volume means small fees and no volume means none: holders can receive little or nothing, and a bond buyer can get back less than the price, or nothing. No one tops up a shortfall: not Pack, not the creator and not the Treasury.

1.2 Creators can stop activity or sell at any time. A creator can stop working on a coin, stop promoting it, sell their own coins or leave, and Pack does not check whether a creator keeps working. A bond freezes the creator share and the fee redirect (section 4.4), but it does not stop a creator from selling or ending the project.

1.3 Changes to launchpad rules during a bond are borne by users. A launchpad can change its fee rates, fee rules, token types or programs without notice and without asking Pack. If the fees that reach Pack fall or stop, Pack keeps routing whatever arrives, does not make up the difference and does not change or extend a bond, so holders and bond buyers bear the result.

1.4 SOL/USD value fluctuates. Fees, bond prices and payouts are in SOL or another fee asset, so a bond that returns a gain in SOL can still be a loss in dollars. The value of reward assets (tokenized stocks, cards, NFTs, tokens) also changes and can fall to zero.

1.5 Pack is an infrastructure and escrow provider, not the issuer of bonds or coins. Pack does not issue, underwrite, back or guarantee any coin, bond or reward asset, and it is not the counterparty to your bond. If a coin fails, a creator leaves or the issuer of a reward asset freezes it, Pack does not repay you.

1.6 You are responsible for compliance in your own jurisdiction, including eligibility for tokenized stocks. Pack has no geographic restrictions and no geo-blocking, and it does not check who you are or where you are, so rewards can be sent to you even where you may not be allowed to hold them. Whether you may use Pack, buy a bond or hold a tokenized stock is for you to find out, and so are the tax and reporting results.

1.7 Raffles use verifiable randomness and carry no guaranteed outcome. Verifiable randomness (VRF) lets anyone check that Pack did not pick the winner, but it does not make you win. You can enter many raffles and never win, and a prize can be worth less than the fees that paid for it.

1.8 Smart-contract, wallet and keeper risk. Every program, Pack's and anyone else's, can contain bugs, and a bug in a program or a compromise of the keeper can cause a permanent loss of funds. Pack never holds your keys and cannot reverse a transaction or recover a lost wallet, so beware of lookalike websites and tokens and of anyone who asks for your seed phrase.

1.9 Third parties and automation can fail. Launchpads, swap routers, marketplaces, price sources, RPC providers, randomness providers, Jito bundles, wallets and the Solana network can fail, change or be congested, and then a swap can fill worse than quoted, a bundled transaction can fail to land, and Pack may delay or skip a payout, a buyback or a burn. Circuit breakers pause a unit when something looks wrong, and resuming a unit that moves funds needs a manual decision, so a pause can last a while (terms, section 9.2).

2. Raffles and reward assets

2.1 ORAO's upgrade key is one keypair, not a multisig. Raffles use the ORAO VRF service by default: the random value is the combination (XOR) of the signatures that ORAO's three authorities make over a seed that Pack derives from the published snapshot hash, and all three authorities must answer for a request to complete. The upgrade key of the ORAO program is held by one keypair that belongs to the ORAO operator. It is not a multisig, so whoever holds that key can replace the program, and on chain that same key is also ORAO's fee treasury and one of the three authorities.

2.2 A raffle is only as fair as ORAO's control of these keys. Whether the other two authorities are run by independent parties is not verified. Anyone who controls all three authorities, or who can replace the program, could change how random values are produced, or work out a result before it is requested and so choose a favourable snapshot. ORAO's program was last deployed on 2024-06-10 (read on 2026-10-12).

2.3 Pack's daily check can miss a change for up to a day. Pack checks the ORAO program's last deploy and its upgrade authority every day and pauses raffles automatically if either changes; while raffles are paused, prizes and funds stay in the prize vault, and raffles resume only after Pack has reviewed the change. A raffle drawn between a change and the next check would use the changed program, and the check does not show that ORAO behaves correctly, only that the program was not redeployed and its upgrade authority did not change. For every raffle Pack publishes on the coin page the ORAO request (the transaction signature and the request account), the randomness proof and the snapshot hash, so that anyone can check the random value.

2.4 Raffles can be slow, and the emergency fallback is weaker. A request costs Pack a small fee and normally completes within seconds, but if ORAO does not answer or one of the three authorities stops, the raffle is delayed and Pack may send a new request, pause the raffle or use the fallback. Commit-reveal (a published commitment plus the hash of a later block) is the emergency fallback: Pack switches to it only through a deliberate, logged change, never automatically, and labels the raffle "commit-reveal" on the coin page. It is weaker than ORAO, because a block producer can influence the block hash and an operator who tries many snapshot variants can publish only the one whose later block hash suits them, and it shows only that a block existed, not that its hash could not be predicted.

2.5 Cards can be frozen, moved or burned by their issuer, and delivery depends on the issuer's servers. The card collection has permanent freeze, transfer and burn delegates that Pack does not control, so the issuer, or whoever controls those accounts, can freeze, move or burn any card, including a card in Pack's prize vault, without Pack's signature, and a freeze blocks a winner's claim. There is no on-chain pack program, so a won card reaches the prize vault only if the issuer's servers deliver it, and the interface and its terms can change or stop at any time. If a won card cannot be transferred to you, Pack redraws the raffle and you have no claim on that card, and Pack may disable the card module and does not offer redemption of the physical card (terms, section 5.4).

2.6 Tokenized stocks can be moved, paused, frozen or halted by their issuer. The issuer, or whoever holds its authority keys, can move tokens out of any holder's account, pause all transfers, freeze accounts and halt trading of a single asset, and it can switch on a transfer hook later. Pack checks for an active transfer hook or a transfer fee before it buys and again at payout, and skips an asset that fails, but it cannot stop the issuer from acting between two checks. Balances can be displayed scaled by an issuer multiplier, so the amount in your wallet can differ from the raw token amount, and Pack buys only from a short allow-list of assets, on the order of tens of assets, which can change (terms, section 5.5).

2.7 Payouts can skip you. Pro-rata payouts only reach holders who already have a token account for the reward asset and go to the top 2,000 holders by balance (current setting), so open the account for each reward asset before payouts run. If you miss a payout, your share rolls into the next one and opening the account later does not recover it, and coins held in bonding curve vaults, AMM pools and similar accounts earn nothing. A payout runs only when a module's balance reaches its threshold, so on a quiet coin payouts can be slow (terms, section 5.2).

2.8 A reward asset can fail the asset audit and be skipped, and its price can be worse than the quote. An asset that is not transferable, has a Token-2022 transfer fee or hook, lacks real liquidity or cannot be paid to a frozen Pack account is skipped for that payout, and if every asset in a module fails, Pack holds the funds, raises an alert and that module pays nothing until it is resolved. Pack buys at market prices through swap routers and marketplaces, so the price paid can differ from the quote, what you receive can be worth less than the fee that paid for it, and cards and NFTs can be hard to sell. Issuers of reward assets can freeze, restrict or stop supporting them, and burned coins cannot be recovered (terms, sections 5.1 and 5.3).

2.9 Prizes must be claimed, and creators can change rewards. The prize stays in the prize vault until you claim it from the coin page, you pay the network fee and any account rent, and a prize not claimed after 30 days (current setting) goes back into the coin's next raffle and you can no longer claim it. A creator can change a coin's modules or creator share after you buy it: the change takes effect 24 hours after it is submitted and is shown on the coin page, and that 24-hour public delay is the only notice you get (terms, section 4.2).

3. Risks for creators

3.1 On pump.fun, "permanent" is not absolute. Routing the creator fee through pump.fun's fee-sharing is permanent for the creator and for any third party (the list of recipients can be written once, and the recipient cannot be changed afterwards), but pump.fun's own administration can still take over a coin's creator authority or convert a coin to Holder Rewards. Either one ends or redirects the flow to Pack and Pack cannot prevent it; Pack reads the coin's configuration again every cycle and pauses the coin if the setup changes, but a pause does not undo the change (terms, section 4.3).

3.2 Only some coins are accepted, and routing can be hard to undo. On pump.fun Pack accepts only coins of the Creator Fee type that are quoted in SOL, and on Meteora only when the creator fee is paid in the quote asset; a launchpad can change its token types or rules at any time, and a regular coin can be converted later (section 3.1). Depending on the launchpad, routing a coin's creator fee to Pack may be permanent, and the launch screen shows the rule before you sign (terms, section 4.4).

3.3 Changes take 24 hours and can be blocked, and selling your share gives up the upside. A change to modules or to the creator share takes effect 24 hours after you submit it, while a bond exists you cannot change the creator share or redirect the coin's fees, and you cannot create an offering while a creator share change is pending. If you sell your creator share through Fee Bond and the routed fees end above the price, the difference goes to buyers, and you also pay the issuance fee (section 4.9).

3.4 Launch costs are yours and are not refunded. On either launchpad, your wallet signs the launch transaction and pays the network fees and the account rent, and Pack does not refund them. In simulations in October 2026 the launch cost about 0.011 SOL on pump.fun and between 0.014 SOL and 0.027 SOL on Meteora, before any dev buy or priority fee, and those figures are not a quote because costs differ by launchpad and settings.

4. Fee Bond risks

4.1 No fixed return: you can lose part or all of the price. A bond buyer receives the actual fees routed to the bond, pro rata to the units held, and the creator sets the price, not Pack. The example is 10 units at 1 SOL each (a price of 10 SOL), 100% of the creator share sold, a 7-day bond and all units sold; the numbers show the arithmetic, they are not a forecast, and they are before network fees and SOL/USD moves (section 1.4).

4.2 The fee flow can stop, and the yield is whatever the launchpad pays. If people stop trading the coin, no fees arrive, maturity still happens on schedule and nothing extends the bond, repays buyers or replaces the missing fees, and launchpad rule changes during the bond are borne by buyers as well (section 1.3). The yield is whatever the launchpad pays out and the keeper deposits, and on pump.fun a payout can also be triggered by third parties, which does not change what bond buyers receive.

4.3 A sale below the minimum sold is cancelled and fully refunded. The creator sets a minimum sold percentage, never lower than 25%, and if less than that sells by the end of the sale window you can refund 100% of the price, but network fees are not refunded and until the sale closes your funds sit in escrow and cannot be taken out early. If the sale reaches the minimum but not all units sell, the bond covers only that fraction of the creator share (if 2/3 of the units sell, it covers 2/3 and the creator keeps the other 1/3).

4.4 A bond sells only the creator share. Holder reward modules and the protocol share (35% of the creator fee) are never sold, so with the default creator share of 20% a bond that sells out receives at most 20% of the creator fee the launchpad pays for that coin. The creator share and the fee redirect are frozen from offering creation until maturity or cancel (the bond program, the keeper and the API all enforce it), which does not stop the creator from selling their coins or ending the project (section 1.2) and does not protect against launchpad changes (section 1.3).

4.5 Size caps apply before an external audit: 10 SOL per offering and 100 SOL total outstanding across Pack. The program enforces both caps and a purchase that would break a cap fails, and Pack raises them only after an external audit. The caps limit how much can be lost in total, not the chance of a loss on your bond.

4.6 Positions are non-transferable in the first release of Pack, so there is no early exit. You can claim the yield that has accrued at any time (it accrues daily), but you cannot get your price back before the bond matures, and a bond lasts 1 day to 30 days (default 7 days). If you lose access to the wallet that bought the position you lose the position, and Pack may add transferable units later and promises nothing about that.

4.7 The pack_bond program has not been externally audited, and AI review is not an audit. Pack's process includes tests, fuzzing and independent reviews, including AI-assisted review, which reduce risk but do not replace an audit. Pack intends to commission an external audit once bond volume justifies it, with no date set and nothing promised, and until then the size caps in section 4.5 apply.

4.8 Trusted off-chain inputs and keeper downtime. The pack_bond program trusts two inputs that come from outside it: the keeper attests the coin record (creator, launchpad, fee asset and creator share), and the keeper posts the $PACK price feed, which the program rejects if it is older than 900 seconds (current setting) or moves too far in a single step. The keeper also deposits the yield, because the program cannot see launchpad fees, so if an input is wrong or the keeper is down, amounts can be wrong or late, and since maturity still happens on schedule a long outage can reduce or delay what the bond pays (both inputs are documented on the /security page). A stolen or wrong keeper key can record a wallet it controls as the creator of a coin and open an offering in that coin's name, and if you buy into that offering the proceeds go to that wallet when the sale closes: the size caps bound the amount, and a new or changed record can open an offering only 24 hours after the change, but the program cannot tell such a record from a true one. The keeper may also deposit a last share of fees after the bond matures: if you close your position before that deposit, your part of it is not paid to you and goes to the Treasury with the rest of the vault's remainder, so wait for the last deposit before you close.

4.9 The creator pays an issuance fee of 2.5%, with a 50% discount when paid in $PACK, and the discount may silently not apply. The fee is 2.5% of the amount raised, taken from the proceeds at close, and buyers do not pay it, and paid in $PACK it is 50% lower (1.25%) and the $PACK is burned. If $PACK is not live or the price feed is stale (currently older than 900 seconds) when the sale closes, the close still goes through and the full 2.5% fee is charged in SOL, with no error shown at close, although the app warns the creator beforehand. To pay in $PACK the creator deposits the maximum discounted fee when creating the offering, the actual amount is burned at close and the excess (or the whole deposit, if the sale is cancelled) is refunded, and because the $PACK price can move and anyone can close a sale once it has ended, the amount burned and the time of the close are not in the creator's hands.

4.10 A bond is denominated in the coin's fee asset, and amounts are rounded. That is SOL for pump.fun coins and SOL-quoted Meteora pools, or the pool's quote asset (for example USDC) for other Meteora pools, and you bear its price moves; bonds in assets other than SOL are not available until Pack sets a size cap for that asset, and Pack has not set any. Amounts are calculated in whole lamports and payouts round down, so small remainders (dust) stay in the vault and are swept to the Treasury after all claims are made.

5. $PACK, the Binder and everything else

5.1 $PACK has no governance and no promise of returns. Holding $PACK gives you no vote and no claim on Pack's revenue, Treasury or assets, and its price can fall to zero. Other tokens use the same $PACK ticker, so check the contract address before you buy; the official address is shown on the pack.fund home page and posted on @packprotocol (opens in a new tab), and anything else is not Pack.

5.2 Buyback-burn can stop, and a dev buy can be sold. A circuit breaker stops buybacks after repeated swap failures or abnormal slippage, and resuming needs a manual decision, so a stop can last a while; burning reduces supply but promises no effect on price. If the creator wallet makes a dev buy of $PACK, Pack discloses the amount and the wallet publicly, and the dev buy can be sold later.

5.3 The Binder is not live, and nothing is promised about it. It is planned for a later phase, and Pack sets aside 10% of each coin's creator fee for a Binder pot. Pack does not promise when or whether the Binder launches, what it will cost, how many there will be, who can take part or what the pot will pay, and if the Binder is never launched, 100% of the Binder pot is used to buy back and burn $PACK (terms, section 8.5).

5.4 Not advice, and reporting a vulnerability. Pack provides software, and nothing here or in the app is financial, investment or tax advice, or an offer to invest. Report a vulnerability through the /security page, where rewards are set case by case and no amount is promised.

5.5 Software "as is", no guarantee, and you carry the risk. Pack is an interface and open code, provided "as is" without warranties, and it can contain bugs that lose funds. It is not an exchange, a broker, a custodian or the issuer of any coin or bond. No reward is guaranteed, Pack's liability is limited as far as the law allows, and you indemnify Pack for claims that arise from your own use (terms, sections 9.3 to 9.8).

5.6 Pack can change or stop. Pack may change, pause or stop the website, the API or any feature at any time (terms, section 9.11). You are responsible for the laws, taxes and eligibility rules of your own country (terms, section 2.6).