Your keys

Only you sign. Your trading-wallet keys never touch our servers. For a launch wallet we hold only our half of a 2-of-2 key and cannot sign alone.

Wallets you control

Your trading wallets are Privy embedded wallets. Our servers can’t sign for them. Launch wallets are shared between you and Drill Desk, and come with a recovery kit you keep.

Checked before signing

Before any wallet signs, your browser rebuilds the transaction from your click and refuses anything else. What the server built is compared with what the click meant:

• Program. Pump.fun, the system program and the token program, and nothing else.
• Coin. The one you clicked.
• Wallets. The ones you picked.
• Amount. What you set, with the slippage you set.
• Fee. Drill Desk’s rate for the operation, and no other payment.

Anything the check does not recognise fails closed: another coin, another wallet, a bigger amount, a higher fee, or a payment you weren’t shown.

Sent once

Each transaction is sent once and never resent on its own. Accepted by the network is reported as submitted, not as landed. A landed trade that did not move what the quote said is reported as a mismatch, never as a success.

Public by design

Every launch and trade is public on Solana. Drill Desk hides no wallet, promises no anonymity and its servers trade nothing on their own and never sign. Anything automatic runs only in your own open Drill Desk tab, signed by your own wallet.

Two limits

• The checks run in Drill Desk’s own page. They stop a bad server answer, a tampered connection or a bug, but not a compromised Drill Desk app. That app could use your signed-in session, up to the full balance of your trading wallets.
• If you lose every way into your account, you can lose its wallets for good. Recovering your account restores log-in only. It does not recover a wallet. For a trading wallet, keep your Privy log-in safe. For a launch wallet, keep its recovery kit.

What is built

The transaction check and send-once apply to every trade, launch and move. Status