The operator and the trust model
Hinge spans two chains. No contract can read both and create a coin on both, so a service, the keeper, does the part that crosses chains. That makes Hinge partly an operated service, and it is worth saying exactly what that means.
Who holds what
| What | Held by | Where |
|---|---|---|
| The creator's deposit in ETH, until it is spent | the keeper's address on Robinhood Chain | Robinhood Chain |
| SOL for the pump.fun creation | the keeper's Solana wallet, funded by the operator and repaid from deposits | Solana |
| The creator of record on pump.fun | the keeper's Solana wallet, then the fee sharing is locked | Solana |
| The creator's share of pump.fun creator fees | the creator, through pump.fun's fee sharing | Solana |
| The Pons creator fees | the coin's HingeVault, split by anyone | Robinhood Chain |
What the keeper can do
- Create the coin on both chains, using your deposit for the fees.
- Refuse a request or fail to complete it: then the refund rules of the launch apply, run by the keeper.
What the keeper cannot do
- Take your share of the pump.fun creator fees: it is fixed by pump.fun after one call.
- Send the vault funds anywhere but the Hinge address fixed at deployment.
- Change the Pons creator tax after the launch.
- Hide a move: every step is a public transaction.
What you trust
- That the keeper completes the launch after you pay, or refunds you. The refund is a promise of the operator, not of a contract.
- That the keeper's keys are kept safe.
- That the site you pay from is the real one: check the address and the official X account.
Limits in code
- The keeper accepts a deposit only from the MetaMask address named in the request, with the right reference in the transaction data.
- At most 12 requests and 20 uploads per hour and address.
- A pipeline step never runs twice at the same time.