Repo Recon
Sample the public CPMM source and map declared tooling and sensitive source patterns.
Audit the entire AMM, reproduce execution, or prove deployed-bytecode equivalence.
A constant-product pool connects two token vaults, an LP position, and protocol configuration.
A pool is a separate object from the token mint.
LP ownership is a separate security question.
Protocol configuration and token extensions interact.
A token can have a pool without having durable liquidity. Inspect the exact pool, its assets, control paths, and evidence about who can remove liquidity.
Walk through the flow. Each step gives you one practical question to investigate.
A pool connects two assets. Verify both mint addresses and their token programs before relying on a pair label.
Conceptual flow, not a live transaction trace. Use the sources below for implementation details.
Match the program to Raydium’s canonical references and verify the actual pool and vault relationships.
Look for Official program reference + pool accountRead position ownership and any claimed lock mechanism independently. A concentration report cannot substitute for an LP review.
Look for LP mint or position + owner or lock-program evidenceReview fee and operational authority paths in the applicable configuration. Source inspection alone does not establish current on-chain settings.
Look for CPMM configuration + deployed account statePublic CPMM program source. Raydium’s other products have different programs and coverage.
Resolving its default branch and pinning one commit.
Read-only · No account connection · No code executionSample the public CPMM source and map declared tooling and sensitive source patterns.
Audit the entire AMM, reproduce execution, or prove deployed-bytecode equivalence.
Review a supported pool asset’s mint when you provide that mint.
Accept a pool address as a mint or verify liquidity ownership and locks.
We’ll prefill the target. You review the scope before anything runs.
Live launches require verified holder access.Is this CPMM, CLMM, or another program?
Where is the independent LP ownership or lock evidence?
Which administrative paths can affect the pool?
Are both token configurations supported by the intended integration?