How hermit works
hermit puts both sides of an OTC deal into one Solana transaction. The chain runs all of it or none of it, so nobody has to send first and nobody has to trust a stranger. You can deal privately with a wallet you already know, or post an open offer on the board and pick who takes it.
A private deal, step by step
| # | What happens | Who signs | Time |
|---|---|---|---|
| 1 | Open the case. A small deal account (a Solana durable nonce, ≈0.0015 SOL rent) is created in your name. It keeps your signed deal valid for hours instead of the usual 60 seconds. | you (maker) | ~5 s |
| 2 | Seal the deal. The page builds one transaction: your tokens to them, their SOL (or their tokens, bag for bag) to you. A one-time key made in your tab signs its memo, then your wallet signs your half. Your tokens do not move. | you | ~5 s |
| 3 | Send the link. Only the counterparty wallet you named can complete it: it is the transaction's fee payer, so nobody else can sign in its place. | nobody | — |
| 4 | They check and sign. Their page decodes the exact bytes, simulates them on chain, prices both sides against the live pump curve / PumpSwap pool and runs the token safety gate. They sign, and the deal settles as one transaction. | them (counterparty) | ~5 s |
Open offers
Post an offer to the open deals board with one wallet signature on a plain message: it cannot move funds. Anyone can ask to take it, also with a signed message. You approve one taker, which seals a private deal for that wallet exactly as above, and they settle it in one transaction. Offers show live price vs market, and a dev or top holder tag when the chain says the maker is the coin's creator or one of its 20 largest holders.
Counter-offers
Anyone can answer an open offer with their own price, and the maker can counter back. Each round is a signed message that cannot move funds, and every round stays on the offer. The maker approves one wallet at the last price, which seals a private deal for it.
Want to buy
Post the token, the size and what you pay with one signed message. Name one holder, or let any holder fill it. A holder fills it by sealing a private deal to your wallet at exactly your terms; you check it and sign to settle. hermit checks that you hold the SOL when you post.
Counterparty check
Every maker, taker and buyer can be checked before you sign: wallet age, settled hermit deals, first funder, and whether the wallet is tied to the coin's creator (a pattern read from both wallets' first and latest transactions). A clean result is not proof; a link is a pattern on the public chain, with its receipts.
What we hold
Nothing that can move funds. The server stores the half-signed transaction (useless without the taker's signature), and a pre-signed cancel that can only void the deal at its expiry. No escrow wallet, no smart contract, no delegate, no upgrade key. Your tokens stay in your wallet until the deal settles.
Cancel, expiry, receipts
- Cancel any time: closing the deal account voids the transaction forever and returns its rent to you.
- Expiry: at the time you pick, hermit submits your pre-signed cancel. It is best effort, so cancel yourself if timing matters.
- Atomic: if the maker moved the tokens or the counterparty is short, the deal fails as a whole and nothing moves. The page shows "can't fill" before anyone signs.
- Receipts: a settled deal's page becomes its receipt, verified on chain. The tape lists only settled deals whose maker opted in.
The token safety gate
Every token is checked before anyone signs, and you see any warning up front: the dev can still freeze it, supply can still be printed, it takes a transfer fee (the deal shows what the receiver nets), a permanent delegate can move any balance, accounts start frozen, transfers can be paused, or it runs its own transfer program. Any coin works, pump.fun or not. hermit only refuses what cannot move: non-transferable tokens, transfers paused right now, a frozen account, or a swap that fails its on-chain test run. An NFT on your side (a Collector Crypt card slab, say) must be a real Metaplex NFT that is not listed or locked anywhere, and its verified collection is shown. Each token also gets a NOCAP verdict on whether its market cap is real.
Fees
The counterparty pays the Solana network fee and the rent of any token account the deal creates. The maker pays the app fee: 0.3% of the price (in SOL, or in USDC on a deal priced in USDC), or 0.003 SOL flat on a bag-for-bag deal, in the same transaction and shown as its own line. Wallets holding $HERMIT pay no app fee.
Wallet warnings
Phantom can warn on any transaction another wallet has already signed. On hermit that other signature is the maker's half (plus the one-time memo key). Read your wallet's preview: you should see exactly the two sides of the deal, nothing else. If it shows anything else, reject it.
FAQ
Can the counterparty change the price? No. The maker's signature covers every byte. Change one and the network rejects the transaction.
Can anyone else take my deal? No. The named counterparty is the fee payer and a required signer.
Can the maker pull the tokens after I sign? If the maker moves the tokens first, the deal fails and nothing moves. Once it lands, it is final.
Is the board an order book? No. An offer on the board is a signed message, not locked funds, so nothing is escrowed. The maker approves one taker and then settles with them in one transaction. hermit runs without an escrow program on purpose.