Shaw, the founder of Eliza Labs, says he is close to reconstructing Pump.fun’s closed-source Solana smart contracts from their publicly deployed on-chain code, a process that could give developers and security researchers a more readable view of how several core Pump.fun programs operate.
In an Oct. 25 post on X, Shaw said the reverse-engineering work was about 90% complete and that he expected to finish the remaining work that night. He added that if the contracts’ original source code was not released, he planned to publish a reconstructed version himself.
The effort is documented in a public GitHub repository linked to Shaw, called pumpfun-source. It covers four programs associated with Pump.fun: the main Pump program, PumpSwap, Pump Fees and Mayhem. The repository includes deployment information drawn from Solana’s blockchain, partial decompiled handlers, and testing intended to compare rebuilt binaries against the programs already deployed on-chain.
The work remains incomplete. The repository says none of the four programs has yet been rebuilt byte-for-byte from the original deployed binaries. Some reconstructed components have passed tests, but the compiled output still differs from the on-chain versions. That leaves a substantial distinction between a readable approximation of a contract and a complete reproduction that can be treated as equivalent code.
Aiming for byte-for-byte reproduction
Shaw has described the project as a “pixel-level” reconstruction rather than an attempt to build a competing functional version of Pump.fun’s contracts. The stated goal is to produce source code that compiles into binaries matching the deployed Solana programs byte-for-byte.
That standard is unusually strict. Smart-contract reverse engineering commonly produces a practical interpretation of what code does, allowing researchers to inspect instructions, account checks and transaction flows. Recreating the exact original binary requires matching compiler behavior, layout choices, program logic and even defects embedded in the deployed version.
Shaw said the reconstruction should retain any original flaws instead of correcting them. Fixing an apparent defect could make a rebuilt program safer or cleaner, but would also cause it to diverge from the contract currently running on Solana. In this case, the project’s value depends on accurately showing the deployed code’s behavior, including behavior that may be undesirable.
Solana programs are publicly available as deployed bytecode, even when their human-readable source code is withheld. A closed-source contract therefore limits accessibility and auditability rather than making its logic permanently invisible. Reverse engineering translates the lower-level program into a form that developers can inspect, test and debate more easily.
A successful reconstruction would not by itself establish that Pump.fun’s programs contain vulnerabilities. It could, though, give independent security researchers a more useful starting point for examining how the contracts handle fees, swaps, account permissions and other functions.
AI tools speed up the reversing process
Shaw attributed much of the project’s speed to large language models used alongside open-source reversing tools. His proposed workflow has an AI agent run decompilation tasks, compare rebuilt bytecode with the on-chain versions, identify differences and submit code changes through pull requests.
The approach reflects a growing use of AI coding systems in software auditing, but it also carries clear limitations. A model can accelerate repetitive interpretation and debugging work, while the final result must still be validated against the original binary. In smart-contract work, a plausible-looking explanation of code is insufficient if it does not reproduce the actual behavior of a deployed program.
Shaw promoted ChatGPT Max, which he said costs $200 a month, for frequent reversing work. He also named GLM-5.3 and Kimi K3.1 as possible alternatives. In his posts, Shaw said Gemini had performed poorly for this particular task and argued that Claude’s compliance restrictions could limit reverse-engineering prompts unless older models, including Opus 4.8, were used.
Those assessments are Shaw’s views on the tools rather than independent benchmarks. The public GitHub repository provides a more concrete measure of progress: its diff-testing records show active comparison work, while its own documentation acknowledges that the bytecode does not yet fully match the deployed programs.
Public review could bring competing risks
The prospect of reconstructed Pump.fun code creates two competing security outcomes. Greater public visibility could help independent researchers identify weaknesses and pressure developers to address them. Publishing a faithful reproduction before any flaws are patched could also lower the barrier for malicious actors to study potential attack paths.
The balance depends heavily on whether any serious issue is found, how quickly it can be verified, and whether Pump.fun’s developers respond with fixes before exploit details spread. No public response from Pump.fun or its founder, Alon, had been issued at the time of the materials supplied for this report.
Shaw argued that closed-source Solana contracts have become common and said more than $40 million had been stolen over the previous year through severe vulnerabilities in closed-source contracts. He did not provide supporting evidence for that figure in the supplied materials, and the claim should not be read as an assessment of Pump.fun’s contracts.
The episode also challenges the assumption that a platform’s contract source must be available for competitors to copy its position. Pump.fun has faced repeated fork attempts over the past year, yet those projects have generally struggled to sustain attention. In consumer crypto applications, distribution through wallets and trading interfaces, liquidity, brand recognition and user habits can matter as much as contract logic.
Slop.cash links reconstruction to private bounties
Shaw has connected the work to slop.cash, a planned project that he said will launch on Umia Finance with a focus on internet security and private bug bounties. He said creator trading fees from a related meme coin are being used for token buybacks and are intended to fund a bounty pool for contributors working on byte-level reconstruction.
Under that plan, the rebuilt Pump.fun source would be added to the platform after a mainnet upgrade. Private bounties can give researchers a channel to report sensitive findings without immediately publishing exploit details, although their effectiveness depends on clear disclosure rules, credible payouts and a workable process for affected developers to patch code.
For Pump.fun users and Solana traders, the immediate takeaway is narrower than claims of a code “leak” or a proven security failure. The public effort may eventually produce a useful research artifact, but the repository currently describes an unfinished reconstruction rather than a completed audit. Until byte-for-byte equivalence is demonstrated and qualified security reviewers examine the result, the code should be treated as a work in progress rather than a definitive account of Pump.fun’s deployed contracts.
For deeper context on Solana security and smart contracts, explore Toobit Academy’s guide on smart contracts and how they work.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
