Security
Last updated October 21, 2026
WICK's security model is short because WICK holds nothing. This page lists what it does hold for a moment, what it talks to, and what you should check yourself.
What WICK never has
- Your private key or seed. Wallets expose only a public key and a signing prompt.
- Your SOL. Every transfer is inside a transaction you sign.
- The mint authority. pump.fun's program takes it at creation; WICK never holds it.
- A server, a database, an account system or an API key of its own.
What exists briefly in your browser
- The mint keypair. Generated in the page, signs the create transaction, then is released. It is never written to storage or sent over the network. The grinder for a
pumpsuffix runs in web workers in the same tab. - Your art and metadata, until uploaded.
- Local history. Your launches and receipt ids are kept in this browser's local storage so they list under Receipts; nothing is sent anywhere.
- An optional Pinata key, if you paste one, in local storage.
What WICK talks to
| Endpoint | Why | Risk if compromised | Mitigation |
|---|---|---|---|
| pumpportal.fun/api/trade-local | Builds the unsigned create transaction | A malicious builder could return a different transaction | Every transaction is simulated and its effects shown before you sign; your wallet shows the same effects. Compare them. |
| Public Solana RPCs | Simulate, send, confirm, read balances | A lying node could misreport a simulation | Several RPCs with failover; the final truth is the confirmed transaction on the explorer. |
| Irys / Arweave | Store art, metadata, receipt | Service outage | Launch waits; nothing partial is sent. Pinata route available as a fallback for storage. |
| jsdelivr (web3.js), Google Fonts | Library and typeface | CDN compromise | Pinned library version; fonts carry no code. |
What to check before you sign
- The address bar. WICK lives at the address published on its official channels and nowhere else.
- The preflight readout. "Leaves your wallet" should match what your wallet shows in its own simulation.
- The wallet prompt. It should show one transaction interacting with pump.fun, and the SOL delta you expect.
- After launch, the receipt. If the verifier shows a failed check, do not share the coin until you understand why.
Impersonation
Clones of launchpads are common. Signs of a fake: a different domain, a request for your seed phrase, a "fee" or "gas top-up" transfer to a wallet before launch, or a $WICK address that does not appear on this site. WICK will never ask you to send SOL anywhere except inside the create transaction you sign.
Reporting
Security issues can be reported through the repository linked in the footer. Please do not test against live launches by other people.