hermit docs

Everything hermit does, how a deal settles, what is checked, what it costs and what it cannot do. The numbers on this page are read from the live site settings.

Overview

hermit is an OTC desk for Solana. It puts both sides of a deal into one transaction: your tokens to them, their SOL (or their tokens) to you. The chain runs the whole transaction or none of it, so nobody sends first and nobody has to trust a stranger.

• No custody. There is no escrow wallet, no smart contract, no token delegate and no upgrade key. Your tokens stay in your wallet until the deal settles.
• What the server stores. The half-signed transaction, which cannot move anything without the counterparty's signature, and your pre-signed cancel, which can only void the deal.
• Where deals happen. Privately with one named wallet, on the open deals board (offers, counters, want-to-buy requests), or with a top holder of a coin.

Deal types, step by step

Private deal: token for SOL

1. On the desk, pick Private deal. Paste the token CA and the amount you sell, and name your price in SOL. The desk shows the bag's market value and where your price sits against it (the Market / −5% / −10% buttons set it for you).
2. Paste the counterparty's wallet, or pick one from Top holders. Choose an expiry (1 hour to 7 days).
3. Click Create the deal. The first wallet approval opens a small deal account (≈0.0015 SOL rent, returned when it ends). The second signs your half of the deal.
4. Send the link. Only that wallet can take it. They check it and click Sign & settle, and both sides move in one transaction.

Priced in USDC

Any deal type can be priced in dollars: pick For: USDC (or You pay: USDC on a want-to-buy, Minimum price: USDC on an auction). The price is a USDC amount, USDC counts as $1, and the desk shows the bag's market value in $ next to it.

• It settles the same way: your tokens and their USDC move in one transaction, nobody sends first.
• A USDC bid (want-to-buy aimed at one holder, or a bid on a USDC auction) is signed up front with your USDC; the seller's one signature settles it.
• The app fee is 0.3% of the USDC price, paid in USDC by the maker inside the same transaction (the first time, the transaction also opens the fee wallet's USDC account, about 0.002 SOL rent, paid by the maker). It is never the flat SOL fee, so pricing in USDC costs the same as pricing in SOL. $HERMIT holders pay none.
• USDC mint: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v.

Bag for bag

The same steps, with For: Their bag. Paste their token's CA and how many of it you get. Each side is priced off its own pump curve or PumpSwap pool, so you see which side is paying up. The app fee is a flat 0.003 SOL.

NFT or graded card

Paste an NFT mint (a Collector Crypt slab, for example) on your side. The amount is fixed at one.

• hermit checks that it is a real Metaplex NFT, not listed or locked anywhere, and shows its verified collection.
• Programmable NFTs (pNFT) move through Token Metadata's own transfer instruction, inside the same transaction.
• The other side is SOL or a token.

Open offer

1. Pick Open offer, fill in the terms and click Post the offer. Your wallet signs a plain-text message, which cannot move funds. The offer goes on the board with a live "vs market" price and chain-verified tags (dev when you created the coin, top holder #n when you are one of its 20 largest holders).
2. Anyone can Ask to take it at your price or send a counter-offer. Both are signed messages.
3. In the offer sheet you see every taker, their counters and a one-tap counterparty check. Click Approve, or Approve at their counter. The desk fills itself with those terms and that wallet, and you seal a private deal for them (two approvals).
4. They find Open your deal on the offer and settle.

Counter-offers

On any open offer, a taker can propose their own price, and the maker can counter back. Every round is kept on the offer, newest last. The maker approves one wallet at the last price. A counter is a signed message (hermit counter v1) and cannot move funds.

Want to buy

1. Pick Want to buy. Paste the token, how many you want and what you pay in SOL. Optionally, name one holder; only that wallet can fill it.
2. Click Post the request. It is one signed message, and hermit checks that you hold the SOL.
3. A holder clicks Fill it. Their desk fills with exactly your terms and your wallet, and they seal a private deal to you.
4. You get a ping, open the deal from your request, check it and sign to settle.

Deal with a top holder

Next to Counterparty, Top holders lists the largest wallets of the coin, with the dev tagged and pools left out. Pick one as the counterparty of a private deal (you sell to them), or as the named holder of a want-to-buy (you ask them to sell).

Counterparty check

Every maker, taker and buyer can be checked before you sign. The check shows:

• the wallet's age;
• its settled hermit deals;
• its first funder (exchange, a busy hub, or a wallet);
• whether it is tied to the coin's creator.

The creator link is read from both wallets' first and latest 100 transactions with our wallet-link engine: funding, direct transfers, shared funders, same-block buys and similar. A link is a pattern on the public chain with its receipts. "No links found" is not proof that two wallets are unrelated.

Deal alerts

Turn on Alerts on the board. hermit reads which coins your wallet holds and pings you when an offer or a want-to-buy appears on one of them. Makers also get pinged on new takers and counters, takers on approvals and counters, and buyers when a holder fills their request. Alerts fire while hermit is open in a tab.

Creator fees (preview)

hermit can read whether a pump.fun coin's creator fees can still be sold:

• whether the fee split is still editable;
• who can sell it;
• whether the coin has graduated;
• what a sale would need.

This is read only. No fee-rights sale is built, signed or stored on hermit yet.

How settlement works

One transaction

A deal is one legacy Solana transaction. Its fee payer is the counterparty, and its instructions are, in order:

1. AdvanceNonce on the deal account (it replaces the usual 60-second blockhash);
2. a compute limit and a priority fee;
3. creating the receiving token account(s) if needed (idempotent);
4. a memo signed by a one-time key: hermit <id>: <amount> for <price>;
5. the maker's tokens to the counterparty;
6. the counterparty's SOL (or tokens) to the maker;
7. the app fee, as its own transfer from the maker, when it applies.

Solana executes all of it or none of it. If either side is short, the whole transaction fails and nothing moves. That is "nobody sends first".

The durable nonce

A signed Solana transaction normally expires in about 60 seconds. hermit opens a deal account, a durable nonce at createWithSeed(maker, "hm1:<id>") with the maker as its authority, so the maker's signature stays valid for hours.

• Cancel: closing that account voids the deal forever and returns its rent.
• Expiry: at expiry, hermit submits the pre-signed cancel (AdvanceNonce + a cancel memo). It can only cancel.

Who signs

Three keys sign: the counterparty (fee payer), the maker, and a one-time case key made in the maker's tab, which signs the memo and is then destroyed. Because the counterparty is the fee payer and a required signer, nobody else can complete a private deal. Every byte is covered by the maker's signature, so nobody can change the price.

What both pages check

The maker's page compares every byte the wallet returns with what it built before anything is stored. The counterparty's page decodes the stored bytes with the same strict decoder and refuses if the server's description differs. It then simulates the transaction on chain and shows the exact balance changes.

Safety checks

• Any coin. Any SPL or Token-2022 token, pump.fun or not. Each token also gets a NOCAP verdict on whether its market cap is real.
• Warnings, not refusals. Every token is checked before anyone signs, and any warning shows up front: the issuer can freeze it, supply can still be minted, a transfer fee (the receiver's net amount and the fee are shown), a permanent delegate that can move any balance, frozen-by-default accounts, a pausable mint, or a transfer program (hook).
• Transfer hooks. hermit reads the hook's account list from the chain and adds exactly those accounts. A hook that asks for an extra signature or for one of the deal's wallets is refused, so it can never spend from the counterparty.
• Refused. Only what cannot move: non-transferable tokens, transfers paused right now, a frozen token account, or a swap that fails its on-chain test run.
• NFTs. The mint must be a real Metaplex NFT that is not listed or locked, and its verified collection is shown.
• Can it fill? The deal page re-reads the chain: whether the deal account is live, the maker still holds the bag and the counterparty can pay. It shows "can't fill" before anyone signs.
• Board tags. Dev and top-holder tags come from the chain, never from what a maker says.
• Wallet preview. Your wallet should show exactly the two sides of the deal. If it shows anything else, reject it.

Fees

Reading the live fee setting…

Verify a deal on Solscan

1. Open the deal page. Once settled it is the receipt and links the transaction on Solscan.
2. On Solscan, check the signers: the counterparty (fee payer), the maker, and one more key that only signs the memo.
3. Check the instructions:
   • AdvanceNonce first;
   • the memo hermit <id>: … with this deal's id;
   • one token transfer from the maker;
   • one SOL (or token) transfer from the counterparty;
   • an app-fee transfer, only if one applied.
4. Check the balance changes: the maker's tokens go down by the deal amount while the counterparty's go up by the same, and the SOL moves the other way. Nothing else moves except fees and rent.
5. An open deal can be checked too. Its deal account is a System-owned nonce account whose authority is the maker. Once closed, the deal can never settle.

Risks and limits

• The maker's tokens are not locked. A maker can move the bag after posting. The deal then fails as a whole: nobody loses funds, but it cannot fill. The page shows this before you sign.
• The price is fixed until cancel or expiry. The counterparty holds a free option while the deal is open. Keep expiries short (the default is 6 h) and cancel if the market moves against you.
• Expiry is best effort. hermit retries the pre-signed cancel until it lands. If timing matters, cancel yourself.
• Wallet support. Phantom may warn on a transaction another wallet already signed; that is the maker's half. Embedded wallets (Google or Apple login) cannot sign pre-signed transactions, so they cannot take deals.
• Durable nonces are slated for deprecation in Solana, with no date set. hermit will move to the replacement when it ships.
• hermit's server stores the half-signed deals and runs the expiry keeper. If it is down, deals cannot be opened from the link, but nothing it holds can move funds.
• Prices are spot. Market value comes from the pump curve or PumpSwap pool. A large bag would get less selling into the pool, and the deal page shows that number too.
• Counterparty checks are patterns, not proof. They read the first and latest 100 transactions of each wallet.
• Alerts fire only while hermit is open in a tab.
• Creator fees are a read-only preview.
• Not built yet: partial fills and multi-token bundles in one deal.
• Daily budget. Page views share a daily chain-read budget and rate limits. When it runs out, reads say so instead of guessing.

FAQ

Can hermit take my tokens? No. Nothing it stores can move funds without the counterparty's own signature, and the counterparty's signature only completes the exact deal you signed.

Can the counterparty change the price? No. Your signature covers every byte.

Can someone else take my private deal? No. The named wallet is the fee payer and a required signer.

Is the board an order book? No. Offers, counters and requests are signed messages, not locked funds. Each one ends in a private deal for one wallet.

What happens if I close the tab? A sealed deal lives on its link. An unsealed deal account is remembered in your browser: reopen the desk to seal it, or close it and take the rent back.

Which coins work? Any SPL or Token-2022 coin that can move in one transaction (pump.fun or not, transfer-fee and transfer-hook tokens included, with their warnings shown), plus Metaplex NFTs and pNFTs on the maker's side.

Addresses

$HERMIT

CA drops at launch

App fee wallet

no app fee set

X

—

hermit program

none: hermit deploys no program

Programs a deal uses

System 11111111111111111111111111111111, SPL Token TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA or Token-2022 TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb, Associated Token ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL, Memo MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr, Compute Budget ComputeBudget111111111111111111111111111111; Token Metadata metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s for pNFTs

Deal account

createWithSeed(maker, "hm1:<deal id>"), owned by the System program, authority = the maker

Changelog

• 10-29 · USDC and community desks. Price any offer, want-to-buy or auction in USDC (fee 0.3% in USDC), a desk page per coin at /desk/<ticker>, and the site in Spanish, Russian, Chinese and Turkish.
• 10-21 · Deal types. Want-to-buy requests, counter-offers with history, deals with a top holder, a counterparty check (wallet age, deal record, ties to the dev), deal alerts, a creator-fee read, desk stats and receipts, and these docs.
• 10-21 · Deal desk. The redesign: a private deal or open offer from one card, real token images, price vs market, live market rows.
• 10-21 · NFTs. NFT and pNFT legs (Collector Crypt slabs) with a strict decoder.
• 10-21 · Open deals board. Signed listings and takes; the maker approves, and the deal is linked to the listing.
• 10-21 · First desk. No-custody OTC: token for SOL and bag for bag in one transaction, the durable-nonce deal account, the expiry keeper and the safety gate.