face/sig
vaultchecks floororigin

The coin that needs your face.

A wallet key alone moves nothing. Anything leaving your vault takes your face, and Solana checks it before the coin goes anywhere.

fee —burn — floor —price —
face/sig
vaultno face enrolled
BuySell
You pay
SOL
Tokens land in your vault.
No face needed to buy.
This one takes your face. All four checks have to pass.
$SIGreading the pair
price—
market cap—
liquidity—
24h volume—
24h—
burned—
floor—

A wallet key moves nothing.

A stolen seed phrase is enough to drain any ordinary wallet, because the key is the whole identity. Here the key signs, and then the chain asks for a second signature your passkey will only produce when your face is in front of the sensor. The key alone gets refused.

Buy in one click

Money coming in needs nothing. Buy, and the tokens land in your vault.

Sell in one click

Selling keeps the money in the same vault, so it is not leaving. No face needed.

Leaving takes your face

The moment something moves out to another address, all four checks have to pass.

Four checks. One face.

These are not descriptions of a check. Press the button and your browser runs a real passkey assertion on this device — Touch ID, Face ID, Windows Hello, whatever your hardware uses. The four lines below are then read straight out of what the authenticator signed and returned.

chip
secp256r1.verify(passkey, msg, sig)
The private key never leaves the secure element. The signature has to come back over the P-256 curve the credential was minted on.
site
clientData.origin == face/sig
The authenticator writes the origin it was called from into the signed payload. A copy of this page on another domain signs that other domain, and the check fails.
intent
challenge == H(coin, to, amount, nonce)
The challenge is the SHA-256 of the exact transfer. Change one digit of the amount after you approve and the hash no longer matches what was signed.
face
auth
Bit 2 of the authenticator data is the user-verification flag. It is only set when the sensor actually matched you, not when you merely touched the device.

What was signed

The raw material behind the four lines above, exactly as the authenticator returned it on this device.

credential id—
algorithm—
origin signed—
challenge sent—
challenge signed—
flags—
counter—
signature—

Every burn raises the floor.

Every trade pays a 1% fee. Half of it goes to the creator and half of it buys $SIG and burns it. Supply only goes one direction, so the same liquidity sits behind fewer tokens after every trade.

—
trading fee
—
to the creator
—
to the burn
start supply
—
supply now
—
burned
—
floor
—
P_floor = P0 / (1 − b)²   b = burned ÷ start supply

The curve is the formula drawn out, not a forecast. The marked point is where the live supply on chain puts the floor right now. Supply is read from the mint account; if the chain does not answer, the number reads “—”.

Run it yourself

Put a daily volume in and this works out what a 1% fee burns at that pace, and where the floor lands after it.

Daily volume (USD)
USD

burned per day—
per week—
per month—
After a month at that pace
supply left—
b—
floor—

Worked out against the live supply and price. Both come off the chain, so this moves when the chain moves.

Look-alikes are refused on chain.

A copy of this page on a domain one character off can look identical, read your inputs and ask for your signature. It will get one — signed for its own domain. The authenticator writes the calling origin into the payload it signs, and that string never matches, so the transfer is refused before it is a transaction.

this pagewould pass
origin—
expected—
match—

a look-alikerefused
origin—
expected—
matchno

The passkey on your device is bound to the domain it was created on. Asked from anywhere else, it either refuses outright or signs that other origin — and the signature is worthless against this vault.

The order it happens in

1You press sell, or send something out of the vault.
2The exact transfer — coin, destination, amount, nonce — is hashed into a challenge.
3Your authenticator asks for your face and signs that challenge with the origin and the verification flag.
4All four checks are read off the signature. Any one of them failing and nothing is submitted.