Docs
What the program does, the accounts it owns, the instructions it exposes, and the endpoints this site serves.
Overview
NFTITS is a wrapper around an ordinary SPL token. Lock 1,000,000 $NFTITS and the program mints one NFT whose vault is derived from that NFT's own mint address. Sell the NFT and the tokens move with it, in the same transaction, without anyone approving a transfer.
The cap follows from the supply rather than from a constant somebody chose: a billion tokens at a million per wrap is a thousand pieces, each of them 0.1% of the supply. Reaching all 1,000 would mean the entire supply is locked and nothing is left trading, so in practice the set never fills.
Nothing here is a new token standard. The wrapped asset is a standard Metaplex NFT and the locked asset is a standard SPL token, which is why both trade on existing marketplaces on day one.
Quick start
- Hold 1,000,000 $NFTITS. That is one wrap. Two million is two wraps, and so on.
- Wrap. On /wrap the tokens leave your wallet for a vault and an NFT arrives in their place.
- Trade or unwrap. List the NFT anywhere, or burn it on the Unwrap tab to take the tokens back.
Accounts & PDAs
Four program-derived addresses. The seeds are the whole mechanism — in particular the vault, which is derived from the NFT mint rather than from a wallet, which is what makes the tokens follow the art.
| Account | Seeds | Purpose |
|---|---|---|
| NftitBank | ["bank"] | Singleton. Supply counters, token mint, free-tier stack. |
| NftitAsset | ["nftit", tier_index] | One per live nftit. Ties a tier number to its NFT mint. |
| Vault | ["vault", nft_mint] | Token account holding the locked 1,000,000. |
| Collection authority | ["collection_authority"] | Signs the Metaplex collection verification. |
A vault's authority cannot be reassigned, because it is not stored anywhere — it is recomputed from the NFT mint every time. There is no owner field to update and no admin key that could point it somewhere else.
Instructions
| Instruction | Who can call it | Effect |
|---|---|---|
| initialize | Deployer, once | Creates the bank and records the token mint. |
| initialize_collection | Deployer, once | Creates the Metaplex certified collection. |
| wrap_nftit | Anyone with 1,000,000 tokens | Moves tokens to a vault, mints and verifies the NFT. |
| unwrap_nftit | Current NFT holder | Burns the NFT, releases the vault, frees the tier. |
InstructionFallbackNotFound rather than doing something unintended. If you fork this and rename an instruction, regenerate the IDL.Art & traits
Every piece is the same 48×48 drawing recoloured across four traits. The engine never redraws the figure, so the set is consistent by construction rather than by review.
Art is bound to the tier number, not to the NFT mint. NFTITS #42 is row 42 of the manifest and /collection/images/42.png, permanently. Unwrapping frees the number; whoever wraps it next mints a different NFT with the same picture. That makes /api/render/42 immutable and safe for a marketplace CDN to hold forever.
| Trait | Values | Rarest in the set |
|---|---|---|
| Body | 16 | teal — 32 of 1,000 |
| Fabric | 31 | rust — 15 of 1,000 |
| Studs | 5 | onyx — 41 of 1,000 |
| Background | 8 | void — 68 of 1,000 |
16 × 31 × 5 × 8 is 19,840 combinations on paper. The renderer rejects 2,068 of them for perceptual contrast — studs the colour of the fabric they sit on, a garment that sinks into the body — which leaves 17,772 that can actually be produced. The 1,000 minted pieces are drawn from those without repetition.
Full trait table: /collection/traits.csv. Longer explanation on the art page.
HTTP API
Public, unauthenticated, and served by this site. Marketplaces read the first two.
| Endpoint | Returns |
|---|---|
| GET /api/metadata/{tier} | Metaplex JSON metadata for one nftit. |
| GET /api/metadata/collection | Collection-level metadata. |
| GET /api/render/{tier} | 768×768 PNG, immutable. Add ?format=svg for the vector source. |
| GET /api/deflation | Supply locked in vaults and the share of total supply. |
| GET /api/recently-wrapped | The most recent wraps. |
| GET /api/launch-state | Whether wrapping is open yet. |
| GET /api/health | Liveness, for monitoring. |
Guarantees
What the program cannot do, enforced on chain rather than promised:
- → It cannot move tokens out of a vault except by burning that vault's NFT.
- → It cannot mint more than 1,000 live nftits.
- → It cannot mint a second NFT for a tier that is already live.
- → It has no admin instruction that transfers, freezes or reassigns a vault.
The site itself never holds keys and never asks for a signature it does not immediately submit. Both wrap and unwrap re-read the chain and refuse to build a transaction that would revert, so your wallet is never handed a guaranteed failure to simulate.
Threat model and audit notes: /security. Full walkthrough of the program: /tech. Why it exists at all: /thesis.
FAQ
No. Whoever holds the NFT can unwrap it. That is the point — the vault is attached to the NFT, not to a person.
It goes back on a stack and the next wrap reuses it, so the set stays numbered 1 to 1,000 with no gaps. The new NFT is a different mint but carries the same picture, because the art belongs to the number.
Only if every token in existence is wrapped at the same moment, with none in liquidity and none being traded. So no, not realistically — the collection is capped at 1,000 and will settle well below it.
Neither. Both would require abandoning the standard SPL token pump.fun launches with. This is a plain SPL token plus a vault whose authority is derived from an NFT mint.
Wrapping and unwrapping are program instructions; any client can call them. The art is regenerable from the open-source renderer. The site is a convenience, not a dependency.