Overview
A drainer doesn't break your wallet. It asks you to sign one transaction that moves everything, and on SPL and Token-2022 a valid signature is the only thing the token program checks. Spectron moves the decision into the token itself.
Spectron tokens live in their own token program, and the lock is part of it: it's written into the token address, not bolted onto a wallet. Before any balance changes, the program runs the coin's lock check on the whole outflow and enforces its answer. Every copy of the coin, in every wallet and on every site, goes through the same check.
- 01
A wallet signs
A transfer, an approval, a close. Maybe it's you, maybe it's a drainer holding your signature. The token can't tell, so it doesn't try.
- 02
The token holds the door
The Spectron token program calls its lock before a single balance changes. At this point nothing has moved.
- 03
The lock reads the spectrum
Five readings of the outflow: how much, to whom, how new that address is, what already left today, and who signed.
- 04
One answer, enforced
Through, capped, held, snared or refused. The token program applies it in the same instruction. No admin can switch it off.
The lock check
The check runs on four instructions: transfer, transfer-from (delegated), approve, and close. It answers with an amount, not a yes or no, and returns one of five answers:
| Answer | What happens |
|---|---|
| Through | The full amount moves now. |
| Capped | An approval is rewritten to the coin's cap and given an expiry. |
| Held | Part moves now; the rest goes into an escrow account for the hold window. |
| Snared | The destination is on the snare list. Nothing moves. |
| Refused | The instruction isn't allowed at all (owner changes, closing a funded account). |
The check can't move a token you didn't send, can't read or use your key, and has no admin path. Its 64 bytes of per-holder state (the rolling 24h window and a known-address bloom filter) are written alongside your balance.
The five readings
Spectron's name comes from this step. Every outflow is broken into five readings, its spectrum, and the answer comes from the readings, not from the signature. A drainer always has a valid signature; it almost never has a normal-looking spectrum.
| Reading | What the lock looks at |
|---|---|
| How much | The share of your balance this moves or approves. |
| To whom | Whether you've sent to this address before. |
| How new | The age of the destination's first on-chain activity. |
| How fast | What has already left your wallet in the rolling 24h window. |
| Who signed | The owner key, a delegate, or your guardian. |
signed · Swap 50% of $MOAT for SOL
- How much
- 50% of the balance
- To whom
- the coin's own pool
- How new
- 400 days on chain
- How fast
- nothing sent today
- Who signed
- the owner key
signed · Transfer 100% of $MOAT to 7Hq…9Lzx
- How much
- 100% of the balance
- To whom
- never sent to before
- How new
- never seen on chain
- How fast
- 0 of 2% used today
- Who signed
- the owner key. It's all they need.
Spend shapes
A spend shape is six numbers, written into the coin at launch. A holder can tighten them for their own wallet, but never loosen them past the coin's values.
| Field | Strict | Standard | Open |
|---|---|---|---|
| fresh.allow (per 24h) | 1% | 2% | 10% |
| fresh.youngerThan | 14d | 7d | 2d |
| known.allow (per 24h) | 25% | 50% | 100% |
| hold | 60m | 30m | 15m |
| approvals.cap | 1% | 2% | 10% |
| approvals.expires | 1h | 1h | 24h |
An address is known if it's older than youngerThan by first on-chain activity, if you've sent to it before the window, or if you pre-registered it and the 72h notice passed. Everything else is fresh.
Each grid is 100 tokens signed away to a fresh address. Red cells get through today; the rest wait in escrow.
Holds and recall
Held funds sit in a per-transfer escrow account owned by the lock program. An escrow opens in exactly two ways: the hold window ends and anyone can settle it to the destination, or your guardian signs a recall and it returns to you.
The signing wallet has no instruction to shorten, cancel or redirect its own hold. That's the whole trick: a stolen signature buys the drainer the spend shape and a timer, and your guardian gets a push the moment the escrow opens.
Guardians
A guardian is a second key that can do exactly two things: recall a hold and snare its destination. By default it's a passkey (secp256r1) on your phone, bound the first time you receive a Spectron coin. It can also be a multisig or a hardware key.
Rotating a guardian takes a 72-hour notice, during which the old guardian can veto. Holders with no guardian still get the spend shape and the hold; their holds simply settle when the window ends.
The snare list
When a guardian recalls a hold, the destination is written to a shared snare list with the recall as proof. Every Spectron coin reads the same list, so an address caught draining one coin can't receive any of them. An address is removed if no further recall hits it within 180 days, or by appeal with a signed proof of ownership of the funds.
Treasury vaults
When a coin launches, its pool's LP tokens are minted directly into a vault: a program-derived account with no private key. The vault program has no admin and no upgrade authority. There is no instruction that withdraws LP.
Every trade pays a 1% fee, split by the vault program in the same transaction:
| Share | Goes to | |
|---|---|---|
| 0.4% | Pool depth | Added to the coin's own LP, inside the vault. |
| 0.3% | Restitution | Pays back verified drains that got past the lock. |
| 0.2% | Creator | Streams to the launcher. Vests; can't be pulled at once. |
| 0.1% | $SPEC buyback | Bought on the pool and burned. |
Restitution
The restitution pool collects 0.3% of every trade across all coins. When a recall snares an address, the restitution program matches every outflow to that address in the previous 72 hours on any Spectron coin and repays the senders in the same coin, up to the Standard fresh allowance per holder.
- 01
Recall
A guardian recall snares the address, with the recall as proof.
- 02
Match
Every outflow to it in the last 72h, on any Spectron coin, is found.
- 03
Repay
Senders are repaid from the pool in the same coin.
Any wallet can run each step and earn a small bounty; there's no team in the loop.
Limits and threat model
Being honest about what the lock doesn't do:
- It protects Spectron coins only. Your SOL and other tokens are still as exposed as they were.
- If an attacker has both your key and your guardian, they can wait out a hold. Keep them on different devices.
- A patient drainer can take the fresh allowance every day. That's why it's small, and why restitution exists.
- Selling into the pool is never held. A drainer that swaps your tokens for SOL inside your own wallet still has to get the SOL out.