PumpStriker's Open-Source Solana Trading Bot (MIT)

PumpStriker's execution bot is open source under the MIT license: the Telegram interface, key management and trade execution are public on GitHub for anyone to read, fork or modify. The scoring engine is MIT licensed too: its full source comes with your one-time purchase, with lifetime updates, and you can modify, rebrand or resell it.

The split is about access, not rights. The code that holds your private key and signs your trades is public, so you can audit it before you pay. The part you pay for is the engine that decides what is worth buying, and it ships under the same MIT license. This page covers what the license allows, how to get and check the code, how to audit any bot in fifteen minutes, and how to spot the fake "open-source" bots that steal keys.

What is MIT, and how you get each part

MIT is one of the shortest and most permissive open-source licenses. It lets anyone with a copy use, copy, modify, merge, publish, distribute, sublicense and sell the software, on one condition: the copyright notice and permission notice stay in all copies. It also ships the code "as is", without warranty, which is the honest way to ship anything that touches money. The full text is on the Open Source Initiative's MIT page.

Why the bot is public and the engine comes with your purchase

Trust and value sit in different places. A bot can only drain a wallet through the code that reads the key and signs transactions, and in PumpStriker key management lives in the open-source execution bot. The part that can touch your money is the part anyone can read.

The engine is the product: the weighting and filter combinations that came from grinding through thousands of configurations on live data. That is why it comes with your purchase instead of sitting in a public repository; once you have it, the same MIT license applies. The safety work behind it is public, too. The token checks are published free as RugKit, the open rug-detection kit, so anyone building their own bot can use them.

How to get the code and verify it

The execution bot lives in a public repository: github.com/bathyrdev/pumpstriker-bot. Start from that link or from this site, never from a file someone sends you in a DM. Running it needs Node.js 20+, a free Telegram bot token from BotFather and a free-tier Helius key; the install guide for Windows, macOS and Linux walks through it. Before a funded wallet goes anywhere near it, check five things:

1. The license. Open the LICENSE file. It should be the standard MIT text, and GitHub shows "MIT license" in the repository sidebar.
2. The key handling. PumpStriker's privacy policy documents the key scheme: private keys are encrypted with AES-256-GCM using a key derived from your Telegram bot token with SHA-256, and stored in data/wallets.json on your own machine. Find that code and confirm it does exactly that.
3. The network calls. Search the source for every outbound request. In a trading bot, legitimate traffic goes to an RPC provider, swap routers, price and safety APIs, and Telegram. Anything else needs an explanation, and nothing should ever send a key or seed phrase off the machine.
4. The dependencies. Read package.json and the lockfile. Every package should come from the public npm registry, with no surprise install scripts and none of the known-bad versions described below.
5. A dry run. Install with the lockfile (npm ci) on a machine you control, then start with an empty wallet, as the unfunded dry run in the best-practices guide recommends. The bot does not need a funded wallet to scan and send signals.

How to audit a Solana trading bot in 15 minutes

You do not need to be a developer to do a useful first pass on any bot, including this one. Fifteen minutes will not prove a codebase is safe, but it catches the traps people actually fall into.

For the AI pass, copy the repository into an assistant such as Claude and ask the four questions the PumpStriker homepage FAQ suggests:

• "Is this bot safe?"
• "Is it able to drain my wallet?"
• "Does it have any scam or malicious function to scam or steal my money?"
• "Does it send my usage info to the developer?"

Then add one of your own: "List every external host this code sends data to, and what it sends." Compare the answer with what the bot says it does.

💡 An AI review is a fast filter, not an audit certificate. Treat a clean answer as permission to keep checking, then run the bot unfunded before you trust it with real money.

Red flags in GitHub trading bots

The fake open-source bot is now a standard attack. In July 2025, blockchain security firm SlowMist traced a user's stolen funds to a GitHub repository called solana-pumpfun-bot, published under the account zldp2002 and presented as a working Solana trading bot. One of its dependencies, crypto-layout-utils, had already been removed from npm and was being served from a separate GitHub repository instead. Its obfuscated code scanned local files for wallet data and private keys and uploaded them to a remote server. SlowMist also found a batch of accounts, likely controlled by the attacker, forking the project to inflate its stars and forks (Cointelegraph, July 4, 2025).

The patterns repeat. Walk away from a bot if you see any of these:

• Stars without history. Popularity that does not match a long, steady commit record.
• Odd dependencies. Packages that are not on the public npm registry, are installed from a URL, or copy a well-known name with a suffix. Some forks in the SlowMist case pulled in a package called bs58-encrypt-utils.
• Obfuscated code. Minified or encoded logic in a project that calls itself open source.
• Seed-phrase requests. A trading bot needs at most one hot-wallet key. A request for your 12 or 24 words is theft.
• Setup steps that disarm you. Instructions to disable antivirus, run a bundled .exe, or paste a command someone sent you in a chat.
• Unexplained traffic. Calls to servers that have nothing to do with RPC, swaps, prices or Telegram.
• Known-bad versions. On December 3, 2024, two published versions of @solana/web3.js, 1.95.6 and 1.95.7, carried code that stole private keys from apps that handle keys directly, such as bots. The fix is 1.95.8 or later (Solana web3.js security advisory).

🚨 Stars, forks and a polished README are not an audit. The repository in the SlowMist case looked popular because the attacker made it look popular.

Fork, modify, rebrand: what the terms allow

Both parts are yours to hack on. Under MIT you can fork the bot or the engine, change it, rename it, ship it inside your own product and redistribute or sell your version, commercially or not. The one obligation is to keep the copyright and license notice in your copies. There is no warranty, so whoever runs a fork owns the result.

Selling a service built on PumpStriker? Section 9 of the Terms of Use lists what you owe your own users, such as passing on the risk disclosure.

If you publish a fork, say clearly that it is a fork. Impersonation is how fake bots spread, and an honest name protects your users as well as ours.

What open source proves, and what it does not

PumpStriker is a self-hosted Solana memecoin trading bot: it runs on your own PC or VPS, your private key is encrypted locally and never leaves the machine, and there is no PumpStriker server in the trade path. Open code is what lets you check those claims instead of trusting them. It has limits, and it is better to know them up front:

• It proves what the published code does, once someone actually reads it.
• It does not prove that a file from somewhere else matches the repository. Install from the source, not from a re-upload.
• It does not make your machine safe. Your Telegram bot token is the master key to the encrypted wallet file, so it needs the same care as a password.
• It does not make memecoin trading safe. Most tokens round-trip, and your exits decide the outcome.

For the short versions of the safety question, see is the PumpStriker bot safe and can PumpStriker drain my wallet.

Frequently asked questions

Is PumpStriker open source?

Yes. The whole codebase is MIT licensed. The execution bot, meaning the Telegram interface, key management and trade execution, is public on GitHub, and the scoring engine's full source comes with your one-time purchase under the same license, with lifetime updates.

Can I fork or resell it?

Yes. Under the MIT license you can fork, modify, rebrand, redistribute and resell both the execution bot and the scoring engine, as long as you keep the copyright and license notice in your copies.

How do I know a GitHub bot isn't malware?

You check, because stars prove nothing. Read the dependency list and lockfile, look for code that reads your key or files and sends data anywhere, have an AI assistant review the whole repository, and run the bot with an empty wallet first. In 2025 a fake GitHub Solana bot stole private keys through a malicious dependency.

Why isn't the engine on GitHub?

Because the engine is the product you pay for. The code that handles your keys and signs your trades is in the public bot, so the part that can touch your money is the part anyone can read before buying. The engine's full source comes with your purchase under the same MIT license, and the safety checks themselves are shared free as RugKit.