The vault, the key, and what the purser is allowed to do

The vault

Every token gets a vault contract at a deterministic address, computed from the token address before anything is deployed. The vault holds whatever the fee stream delivers: ETH, USDG, or a tokenized equity, depending on the quote currency chosen at launch.

The vault has one owner, the creator. Withdrawing is owner-only: withdraw(to, amount) for the native currency and withdrawToken(quote, to, amount) for anything else. The only other outbound path is refuel, which the purser can call for its own gas and which is capped per window.

The operator key

The purser is a key. It is generated when a launch is onboarded, and the vault records its address as operator. The operator can call claim, sweep, refuel and the ladder builder. It cannot call withdraw, cannot change the owner, and cannot change the fee-stream recipient.

Handing the key to its creator is a planned feature of the manage page, which is not built yet. When it ships, exporting will copy the key rather than transfer it — both parties hold it afterwards — and the page will say so before and after. Until then the key is held by the service that generated it, and the creator’s control is setOperator, which replaces it.

Permissionless claiming

Claiming the token's accrued fees from Pons into the vault is a public function. The purser calls it on a schedule; anyone may call it sooner. Whoever calls pays the gas; proceeds always land in the vault. This is what keeps the stream moving if the purser is stopped or out of gas.

Refuel cap and window

The purser pays its own gas from the vault, up to a cap per rolling window. Both are properties of the vault rather than of any venue: the cap is fixed when that launch's vault is deployed and the window is a constant on the vault itself, so every venue a purser builds into shares the one allowance. A refuel that would exceed the cap reverts rather than sending part of it. The launch page shows today's usage against the cap and when the window resets.

Sweeps: waiting on Pons vs nothing to sweep

A sweep moves anything the claim left behind in Pons escrow into the vault. Two outcomes look similar and are not. Nothing to sweep means the escrow held zero, so no transaction was sent. Waiting on Pons means fees have accrued but Pons has not yet made them releasable; the sweep will succeed after the Pons epoch closes. The launch page labels each sweep attempt with which one it was.

The strategy menu

The creator chooses what the purser does with collected fees: build ladders in the token's own pool, hold fees in the quote currency, or spread ladders across the board where the token trades. Ladder parameters — band, rung count, per-rung size, venue allowlist — will be set on the manage page, which is not built yet; today they are chosen when a launch is onboarded. A change applies to the next build, never retroactively.

Exit paths

There are three, and each is one transaction from the creator. Withdraw moves value out of the vault to any address. Stop operator sets the operator to zero, halting the purser. Hand back points the fee stream at any address you choose, after which the vault receives nothing further. None of these requires anyone at Purserfi, and none of them needs this site to be up.