Zpad docs / Help

Safety and security

Your keys stay with you. Here is how Zpad keeps it that way, and how to spot a fake.

Your keys

Zpad never holds or asks for your private key or seed phrase.
You sign every trade and payment in your own wallet.
Signing in is a message, not a transaction. It cannot move your funds.
The Zpad launch wallet is a PumpPortal Lightning wallet. Zpad holds only its API key, never a private key.
Zpad has no smart contracts of its own. Coins use pump.fun's programs on Solana.

Signing in

When you connect, your wallet asks you to sign a message like this one. Read it before you sign.

<this site's address> wants you to sign in with your Solana account:
<your wallet address>

Sign in to Zpad. This is not a transaction: it moves nothing and costs nothing.

Nonce: <random code>
Issued At: <time>
Expiration Time: <time>

The first line must show the address you are on.
If your wallet asks you to approve a transaction when you only meant to sign in, stop. That is not us.
A sign in lasts 7 days. Disconnect to end it sooner.

What Zpad will never do

Ask for your seed phrase or private key.
Ask you to send SOL or ZEC to receive a reward, an airdrop or a refund.
Ask you to "validate", "sync" or "unlock" your wallet on another site.

How to spot a scam

A site with a name close to ours but not the same. Check the address bar every time.
Someone offering $ZPAD before it launches, or an "airdrop" you must pay to claim.
An account in your messages that says it is support.
A transaction you did not expect, or one that asks to approve all your tokens.
A coin named after Zpad that is not the official one. Anyone can launch a coin with any name.
Pressure to act now. Real rewards wait for you.

Official links

Our website address is posted on this page as soon as it is announced.
Our X account is posted on this page as soon as it is announced.
$ZPAD is not launched yet. When it is, the only official address is the one posted on our X account. Any other address is not ours.

How the site protects you

Your sign in is a cookie the page's scripts cannot read, sent only over https, kept 7 days. Zpad stores only a hash of it.
Every change you make needs a header that other sites cannot send, and requests from other sites are refused.
Zpad's Solana connection key stays on the server. Your browser talks to Solana through Zpad's own relay, which only allows the requests the pages need.
A coin only shows once its create is proven on chain.
Every launch has one fixed coin address, so a retry can never make two coins.
Payouts are checked on chain before they are marked PAID.

If something looks wrong

Tell us through our official X account once it is announced. Never share your seed phrase with anyone, us included.