How it works

# the program

  program     anchor 1.0.2 on solana mainnet
  language    rust, ~1,200 LOC
  tests       13 anchor integration + 10 rust unit tests
  cluster     mainnet
  upgradeable yes (initialize gated to upgrade authority only)

# three instructions

initialize(bank, mint)

One shot. The deployer (upgrade authority) initializes the singleton bank PDA with the $WBULL mint address. Gated by an Anchor ProgramData upgrade authority constraint. No one but the deployer can call it.

wrap_bull(tier_index)

  inputs   caller signs + nft_mint keypair signs
  effects  1. checked transfer: 1M $WBULL from caller -> vault PDA
           2. init nft_mint, mint 1 to caller's ATA
           3. CPI: CreateMetadataAccountV3 + CreateMasterEditionV3
           4. CPI: VerifySizedCollectionItem  (joins the MCC)
           5. init BullAsset PDA (records tier, wrapped_at, nft_mint)
           6. bank.total_wrapped += 1

unwrap_bull(tier_index)

  preconds caller holds 1 of this NFT in their ATA
  effects  1. checked transfer: 1M $WBULL from vault -> caller
           2. close vault (rent refunded to caller)
           3. burn NFT, close NFT mint + ATA
           4. close BullAsset (rent refunded)
           5. tier_index pushed to bank.free_tiers (LIFO)

# the vault trick

The whole product hinges on a single PDA derivation:

  vault.authority = PDA(["vault", nft_mint])

The vault's authority is derived from the NFT mint address, not from the wrapping wallet. When the NFT trades on Magic Eden / Tensor, the new owner immediately has authority over the vault via the program. The locked tokens are atomically bound to the NFT.

# PDAs at a glance

  ["bank"]                        BullBank (singleton: mint, counters, free_tiers)
  ["bull", tier_le]              BullAsset (per bull record)
  ["nft_mint", total_wrapped_le] nft mint address (deterministic from bank state)
  ["vault", nft_mint]            vault authority (the key trick)
  ["collection_authority"]       MCC update authority

# Token2022

$WBULL is a Token2022 mint (the pump.fun standard). The program accepts both classic SPL and Token2022 via Anchor's InterfaceAccount + transfer_checked. There is no transfer fee, no transfer hook, no permanent delegate. The mint's extensions are limited to metadataPointer and tokenMetadata, both benign for the wrap mechanic.

# royalty

Every wrapped NFT carries a 5% (500 bps) secondary sale royalty pointing at the onchain royalty treasury. The creator is verified: false by design. Wrap is permissionless so the treasury can't sign every mint. Magic Eden / Tensor still honor seller_fee_basis_points regardless.

# renderer

Offchain. ~2,400 lines of pure JS that take a base58 nft_mint pubkey and return a 24×24 SVG. Anyone can run it. The visual is deterministic from the mint, so the art cannot be retroactively altered, even by us. See /art.