Every pons launch pays its creator. Trading the token generates fees, and pons sends the creator's share to one address the creator nominates.
PENSTOCK is a contract that can be that address. It receives what pons pays and splits it across routes the creator defines — a team, a community wallet, a buyback, a raffle, anything with an address. Instead of one wallet quietly receiving everything, the split is on chain where anyone can read it.
A vault belongs to one token and has one owner. It holds up to 16 routes. Each route is an address and a share in basis points, and the shares always sum to 10000 — the contract refuses any other total, so a vault can never be partially defined.
The vault has no withdraw function, no sweep, and no owner escape hatch. The only way value leaves is through the routes.
Creating a vault does not make money flow into it. The token's deployer must call setFeeRedirecton the pons locker and point it at the vault. That call is deployer-only — nobody else can redirect a token's fees, including us.
isWiredUp() reads whether pons currently points at this vault. It is shown as the WIRED badge. A vault that exists but was never wired is simply an empty contract: correct, deployed, and receiving nothing.
Flush is permissionless. Anyone can call it — the creator, a route recipient, a stranger who has never heard of the project. It pulls whatever pons owes and splits everything the vault holds.
There is no reason to restrict who starts it, because starting it grants nothing. The money can only go where the routes already say, and the caller pays the gas. Restricting it would only mean fees sit uncollected when the owner is asleep.
pons takes its own share inside collectFees, before anything reaches the vault. It is expressed as a percent rather than basis points, and it is already gone by the time PENSTOCK sees the money — the vault never models it and never could.
So route shares apply to the net that lands. PENSTOCK then takes 250 bps of what arrives, on top. Every figure this interface shows is what will actually reach each route, not a gross the locker collected.
Routes cannot be changed on the spot. The owner proposes a new set, it is published on chain immediately, and it waits three days in public before it can be applied.
Once the three days elapse, anyone can apply it. The owner can cancel before then, but cannot sit on a proposal the public has already waited out and quietly let it lapse. Everyone a vault pays can see a change coming and act before it lands.
Sealing makes the current routes permanent. There is no proposal after a seal, no timelock, no owner action, no path of any kind to a different split. Not by the owner, not by us. That is a real guarantee.
It does not lock the inflow. Whether pons pays this vault is decided by setFeeRedirect, which only the token's deployer controls. They can point the fees somewhere else at any time, and sealing cannot stop them — leaving a sealed vault with permanent routes and nothing arriving.
That is why every vault shows two independent badges and never one combined verdict. ROUTES SEALED tells you where money goes once it arrives. WIREDtells you whether it is still arriving. A single "safe" badge would have to average those two facts together, and the average would be a lie in both directions.