How the money moves, and who can touch it.
Nothing here is magic and some of it is trust. This page says which is which.
Who a coin pays
Every Pons coin has a creatorFeeRecipient: an address that receives a cut of every buy and every sell, fixed at launch and never changeable. gitcat lets the person launching set that address to a vault that belongs to a GitHub account or repository instead of to themselves.
The developer does not need to agree, sign up, or know. The vault exists before they do. If they never show up, the money sits there, publicly visible, addressed to them.
How the vault is derived
GitHub gives every account and every repository a numeric id. Unlike a username, the id is immutable and never reissued. This site keys everything on that number: the vault fortorvalds is really the vault for user:1024025.
The server holds one secret seed. The vault’s private key is derived from that seed and the subject key (user:<id> or repo:<id>), so the same identity always produces the same address and nothing needs to be stored to know where a developer’s money is.
Because the id is the identity, a rename cannot steal or lose anyone’s money. If a developer changes their username tomorrow, the vault follows the account. Whoever picks up the abandoned username gets a different id and therefore a different, empty vault.
Why the vault is a plain address, not a contract
The Pons bonding curve pushes the creator fee to the recipient on every trade, inside the trade itself. If the recipient were a contract that reverted — out of gas, a bug, a paused state — every trade of that coin would revert with it. A coin bricked for life by its own fee recipient is a worse outcome than anything below.
So the vault is an externally-owned account. It can always receive. The cost of that choice is the next section.
It is custodial until swept
Every claim is logged with the GitHub account that authorised it and the transaction that paid it out, so a sweep that was not initiated through a GitHub sign-in would be visible as a balance that dropped with no claim next to it. That is auditability, not prevention. Read it as a promise with a paper trail, and size your trust accordingly.
Once swept, the money is in the developer’s own wallet and this site has nothing further to do with it. Fees keep flowing to the vault forever, so the developer can come back and sweep again whenever they like.
What signing in with GitHub proves
The claim flow asks GitHub for the read:user scope and nothing else. That lets this site learn one fact — the numeric id of the account signing in — and ask one question — whether that account administers a given public repository.
- It can see your public profile and your id, which are already public.
- It cannot read your code, private repositories, email, organisations you have hidden, or act on your behalf anywhere.
For a repository vault the bar is admin, not push. A contributor with write access could not sweep a project’s fees; only someone who could delete the repository can. That is deliberate: it puts the money with whoever is accountable for the project, and a drive-by pull request never gets near it.
Gas
The vault pays for its own sweep, out of its own balance. A small reserve is kept back to cover the transfer and the rest goes to whatever address the developer names. A vault whose balance is below the cost of a transfer cannot be emptied yet; it keeps accruing until it can.
Where the index lives
file store. Coins, claims and cached lookups are written to a JSON file on the server's disk. A redeploy or a fresh instance can lose that file, which would make the index forget which coins point at which vault.Losing the index does not lose money. Vaults are derived, not stored, and a coin’s recipient is written into the Pons factory on-chain, where anyone can read it back. What an index loss costs is the map from vault to coins on these pages, until each coin is re-registered from its launch transaction.
Losing the seed is different. A coin launched under a seed this server no longer has points at an address nobody can sign for. Such coins are shown, marked as unsweepable, and the fees they pay are stuck. That is the one failure that cannot be undone, and it is why the seed is the only secret in the system.
What this site is not
It is not endorsed by the developers it points money at, and it does not ask their permission. It is not an investment, a promise of value, or a claim that any coin will trade at all. It is a way to write a developer’s name on a stream of fees they may one day collect, and a cat that carries the bag until they do.