a specter has returned to fogo: the specter of code that runs without an operator
sato is an spl token on fogo. lowercase name, lowercase symbol, nine decimals. it is an asset. it does not launch and graduate and migrate.
issuance happens through one program, an anchor program on the fogo svm, set as the only mint authority at deployment and locked there. when fogo arrives, the program computes how much sato to mint and keeps the fogo as reserves. the price of the next sato is p(fogo) = (S/K) · e^(fogo/S), with S = 500 fogo and K = 21,000,000. the only variable is fogo, the cumulative net fogo ever paid in.
cumulative supply is the integral of that price: minted(fogo) = K · (1 − e^(−fogo/S)). it approaches K but never reaches it. there is no graduation event, no liquidity migration.
sells run the same function in reverse. anyone holding sato can burn their tokens against the program's reserves and receive fogo priced by the inverse curve, less the fee. the program holds every lamport of net fogo ever paid in.
a 0.3% fee is taken on every buy and every sell. it stays in a separate vault pda permanently. it cannot be withdrawn, governed, voted on, or redirected. it isn't a treasury. it is a counterweight: a small automatic tax on round-trip activity that prevents the curve from being a free thing to abuse, and prevents anyone, including us, from extracting value from it. there is no instruction in the program that reads from it.
three constraints keep the curve hard to game. a single buy is capped at 5 fogo, so no one can vacuum a meaningful share of supply in one transaction. selling within 30 slots of your last buy reverts (≈ 12 seconds, the wall-clock parity of sato's one-block guard on ethereum), which makes flash arbitrage uneconomic. and for the first 3000 slots after deployment (≈ 20 minutes, again parity with sato's 100-block window), every buy receives a random multiplier between 0.9 and 1.1, sourced from the slot-hashes sysvar combined with the buyer pubkey and the buy amount: a tax on the bots tuned for the exact deployment slot, costing them an average of 10% on a fixed-multiplier strategy.
a consequence of S = 500 is that the early curve is intentionally flat. the first hundred fogo of cumulative buys move the price by less than 25%. the first thousand move it about 7×. only as the curve approaches its asymptote, somewhere past 2,300 cumulative fogo, does the price reach roughly 100× the launch price. early buyers pay nearly the same price as one another; late buyers pay much more. this is the math, not a defect of it.
eventually the curve fills. when 99% of K has been minted by the fair-curve count (entropy bonuses do not accelerate this), the self-deprecation flag flips on-chain and locks. from that moment forward, sato can't mint more tokens. the program cannot create another unit even if everyone involved wanted it to.
issuance ends. the token does not.
trading continues on whatever venues exist on fogo: vortex pools, exchanges, peer-to-peer transfers, things that haven't been built yet. the bonding curve program stays online and continues to accept sells, paying fogo out of its reserves. sells reduce supply by burning the tokens they consume; no buy can bring that supply back. the cap, once hit, is one-way.
what changes is who makes the market. during issuance, the curve is the market. after issuance, the holders are. price on secondary pools is set by liquidity providers, not by a function. the curve becomes two things at once: a permanent floor, deterministically buying sato back for fogo as long as the reserves hold, and a permanent on-chain record of how the supply got distributed in the first place.
we did not pre-mint. we hold no allocation, no admin role, no pause function, no upgrade authority. the bpf upgrade authority is set to None at the genesis slot. there is nothing to extract from the program other than by selling sato back through the inverse curve like anybody else. if everyone who shipped this disappeared tonight, the program would run tomorrow against the same rules and the same prices. that is what we mean by "no operator." that is the only feature.
port notes (fogo svm vs ethereum + uniswap v4):
solana / fogo has no v4 hook concept, so the curve is one self-contained anchor program rather than a hook attached to a poolmanager. native fogo replaces ether as the reserve asset and as the inflow currency. cooldown is 30 slots (≈ 12s) instead of 1 ethereum block. entropy window is 3000 slots (≈ 20m) instead of 100 ethereum blocks. randomness reads the slot-hashes sysvar instead of blockhash(prev). all sato-faithful quirks are preserved: eth_cum underflow clamp, mint_for saturation-to-zero on rounding, 2001-bucket entropy distribution, sells continuing past self-deprecation.
token mint: deploy pending
program: deploy pending
genesis slot: deploy pending