Where your money sits, and who can move it

How a pledge moves

Backing a campaign needs your own tap on your own device. There is no standing authority and no stored card. Two things do move without a tap, and both are named on this page: the sweep of a card top up out of the deposit wallet, and the holding cost being netted out of your next movement.

That one transaction settles everything at once. The platform fee, and any tip you chose to add, go to the platform treasury. If you arrived through somebody's share link, the share the creator set for sharers goes straight to them. What is left over, the net pledge, goes into the campaign's vault.

The vault is a token account owned by the campaign account itself, which is an address the program derives rather than a wallet anybody holds a key to. Only the program can move what is inside it, and only along the two routes in the next section. CoFunders cannot spend it, cannot move it somewhere to earn a return, and cannot send it to anyone the program does not name.

One thing can follow a pledge without a second tap from you. Money left sitting in your balance accrues a holding cost of 0.01% a week, and the app settles whatever has accrued by moving it to the platform treasury alongside your next transaction rather than asking you to pay it separately. It is charged on an idle balance and never on money that is pledged, and nothing at all is charged at or under 10 USDC.

The instruction is contribute. The sharer's cut is set by the creator and capped by the contract at 18.5%, so a campaign cannot promise more of your pledge away than that. The holding cost page does the arithmetic on the charge above and says when it is collected. An earlier design also let a campaign vault be deployed into a lending market while it was still raising; those instructions were removed before the contract went live, and the vault now has no third way out at all.

Who can take the money out, and when

Two routes, and the program has no third.

The creator can claim, once the campaign has raised at least its goal. The instruction refuses while the raised total is below the goal. There is no deadline condition attached to it: a campaign that reaches its goal on its second day can be claimed on its second day, and it can be claimed in parts rather than all at once. This is the part backers most often get wrong, so it is worth being plain about. Reaching the goal is the moment your money stops being reclaimable, not the deadline.

You can refund, once the deadline has passed and the goal was missed. You sign it yourself. Nobody sends it to you and nobody at CoFunders can send it anywhere else, because the instruction pays the signer and nobody but the signer.

If the goal is not met by the deadline, you take your pledge back from escrow with one tap, and nobody has to approve it. What comes back is the amount held for you: your pledge minus the fees taken when you backed (the platform fee, the flat fee, any tip and any share reward the campaign pays).

• claim_funds.rs: requires raised >= goal, pays the campaign creator, and can be called more than once until the vault is empty.
• refund.rs: past the deadline with the goal missed, pays the backer who signs, and closes their contributor record.
• close_campaign.rs: a creator can close their own campaign. It moves no money and cannot take anything out of the vault.

A campaign that has been funded and claimed is money with the creator. At that point the risk is no longer custody, it is delivery, and no escrow anywhere covers delivery. What that risk looks like is set out on the transparency page.

One pledge, in numbers

A 100 USDC pledge on the free plan, with no tip and no share link, so nothing is going anywhere except to the treasury and the vault. Every figure here is computed from the contract's own constants rather than typed out, which is why it ends in an awkward number instead of a round one.

The smallest pledge the contract will accept is 10 USDC, and the reason is this arithmetic. A flat fee is regressive: at that floor the percentage and the flat fee together take 11.4% of the pledge, against 2.49% on the 100 USDC above, and below the floor that share climbs fast enough to be indefensible. The full fee table is on the pricing page.

Leaving before the deadline

The program has a path for taking a pledge back early, while a campaign is still raising. It is not free: it pays 1.5% to the platform and a further fee the creator chose when they opened the campaign, which the contract caps at 18.5%. Both come out of what you would otherwise get back.

It refuses in two cases. Once the campaign has met its goal, because at that point the money is claimable by the creator and letting backers withdraw underneath a funded campaign would be taking it from whoever else is still in. And once the creator has closed the campaign.

The app offers no way to withdraw a pledge before the deadline.

The fee floor the program will not go under

No plan, no promotional pass and no combination of referrals can take the platform's share of a pledge below 0.5%. The paid plans run from 1.5% down to 0.5% and stop there.

That floor is not a policy anyone could quietly relax. It is an assertion inside the program's own constants, checked when the program is compiled: set any rate below it and the build fails rather than shipping. We mention it here because it cuts both ways, and the second way is the one worth knowing. It means nobody is ever charged nothing, including you.

Money added by card

Stablecoin sent straight to your own wallet arrives untouched. Nothing is taken and no key but yours is involved at any point.

A card top up is different and worth understanding before you use it. The money does not land in your wallet. It lands first in a deposit wallet that CoFunders controls, one per person. When that deposit is seen on the network, a second transaction splits it: 1.5% of the deposit plus a flat 0.99 USDC goes to the platform treasury, and the rest moves on to your own wallet.

That second transaction is signed by a platform key rather than by you. It is the one step in the whole product where CoFunders signs for money on its way to you, so it belongs on a page like this rather than in a footnote. It exists because a fresh deposit wallet holds nothing to pay the network fee with, and the platform pays that fee out of the same transaction it collects the deposit fee in.

The flat part is charged on every card top up on the free plan, and only on the first one for anyone on a paid plan. Very small deposits are left where they are rather than swept, because moving them would cost more than they are worth.

Who can change the rules

The program is upgradeable, and today a single key held by CoFunders can replace it. That is the honest shape of the risk: everything above is enforced by code, and one key can change the code.

The same authority is the contract's admin, and it is worth naming exactly what that lets it do, because the list is shorter than people assume and longer in one place than they expect.

• update_platform_config.rs: change the treasury address that receives fees, change the admin key itself, and change a lending market address that no instruction reads today.
• set_user_tier.rs: set any wallet's plan ordinal, which is the fee rate the program charges that wallet. It can lower a rate and it can raise one back to 1.5%. It cannot invent a rate outside the five the program was compiled with.
• grant_fee_pass.rs: grant a wallet a seven day pass that drops its fee to the 0.5% floor.
• What the admin cannot do: move a campaign vault, change a goal or a deadline, refund on somebody's behalf, claim on a creator's behalf, or set any fee below the compiled floor.

Upgrade authority

8fPcxJYEzgYnuHDuVxsQNp6nenCNcVv8Nt6VUqM1dGnz

Read off the chain on

2026-09-19, from the program's own ProgramData account. You can repeat the check without asking us.

Those are the powers the deployed program grants. They sit underneath the upgrade authority, which could in principle replace the program with one that grants different powers. This page is rendered from a single record, so if that authority ever moves to a multi signature or is given up entirely, this section changes with it rather than being rewritten by hand and forgotten.

What you can check yourself

Everything above is checkable, and three of the checks a careful reader would want to make are not available yet. Both halves of that are on this page on purpose.

The program

5dYL1MbSvg7dzptPr1vMZXpZK7mBjavYA1oHu2fhnm5X

The platform config account

2Y1DAc9sF6Cb51iFPNZXx8x5ZDft2Djrx7a2694R5ZPD

Verified build

No. The bytes running on the network have not been reproduced from published source, so you cannot yet check that the program on chain is built from the code this page describes.

Public source

Not published today.

Third party audit

None. No outside firm has audited this contract, and nobody should treat it as though one had.

What you can check today is the part that matters most in the moment: a campaign's vault balance, every pledge into it and every payment out of it are public, permanently, and readable by anyone with the address above and no account anywhere.

Report a vulnerability

If you have found a flaw in the contract, the app or this site, write to support@cofunders.org. Tell us what you did, what happened, and what you think it lets somebody do. A proof of concept against a campaign of your own is worth more than a paragraph of theory.

Please do not test against live campaigns holding other people's money, and please do not publish a working exploit before we have had a chance to close it. We do not have a paid bounty programme and we will not pretend otherwise.

• security.txt. The same address, in the machine readable form a scanner looks for
• What can go wrong. The risks this page does not remove
• Contact. Everything that is not a security report