Backing and poke

The invariant

class_mint.supply <= backed * shares_per_card

It holds because of how the token is made and destroyed:

• Only deposit mints. The vault PDA is the only mint authority, and only deposit mints, one card's worth (1,000 tokens) per deposited card.
• Redeem burns first. redeem burns one card's worth before it releases one card.
• Nothing else mints. Fees and pools only move card tokens that already exist.

So the invariant can only break when a card leaves the vault by another path. On Collector Crypt cards, that path is the issuer's permanent transfer or burn delegate. See Trust and security.

The undercollateralized flag

Each class stores a flag: undercollateralized when supply is greater than held cards times 1,000. It is recomputed when deposit, redeem, restore or poke runs.

While a class is flagged:

• launch_coin refuses it with ClassUndercollateralized.
• A normal deposit into it fails unless it brings the class back to full backing. A donated card restores backing without minting.
• Existing Meteora pools keep trading. pokedex cannot halt them.

poke

poke is permissionless. For a held copy, if the card's account no longer reads as a Core asset owned by the vault PDA (moved or burned), it:

1. Marks the copy missing.
2. Counts one card fewer held and one more missing.
3. Closes the copy's held marker and emits a CopyMissing event.
4. Refreshes the class's flag.

When a card comes back

A missing copy whose card is owned by the vault again can be re-added with restore (permissionless). It becomes a new held copy at the end of the queue and counts as backing again. The held marker makes sure one card never backs two copies at once.

Fees can only add backing

The class treasury collects a share of fees in card tokens. burn_treasury (permissionless) burns its whole balance. The cards stay in the vault, so every remaining card token is then backed by a little more than a thousandth of a card. See Fees.

The rest of this path