> For the complete documentation index, see [llms.txt](https://streamlock.gitbook.io/streamlock-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://streamlock.gitbook.io/streamlock-docs/core-concepts/locksmith.md).

# Locksmith — Native Escrow

**Locksmith** is Streamlock's native token-escrow program. Every new pool launched from 2026-04-18 onward uses Locksmith as the default backend for token locking and unlocking.

***

## Why Locksmith exists

Earlier pools used a third-party escrow (Streamflow). Replacing it with our own program gives us three things:

* **Zero stream-creation fee.** The 0.19% token tax plus the \~0.176 SOL account-rent fee that Streamflow charges on every buy are both gone for Locksmith pools.
* **On-chain phase gating.** The price-gated unlock condition is enforced by a direct CPI into the `token_factory` pool-phase check, not a timestamp that has to be updated externally.
* **No licensing constraint.** Our own code, our own audit scope, our own change path.

Locksmith does **not** replace Streamflow retroactively. Pre-2026-04-18 pools continue to use Streamflow; creators can also opt into Streamflow at launch if they prefer.

***

## What Locksmith holds

Two lock types, one program:

### Price-gated stream (primary)

Created on every buy. Releases your tokens only when the pool is in the UNLOCK window. Before that, the tokens sit in a program-controlled vault — no buyer signature can withdraw them, no admin can seize them.

The unlock predicate is an on-chain read of `unlock_timestamp` and `unlock_window_end_ts` from the pool config. No oracles. No off-chain cron. Settlement is permissionless.

### Time-lock stream (excess / anti-whale)

Created whenever a buy would push your balance above the 1% holding cap. The overflow tokens go into a separate position with a milestone-anchored schedule:

* **67-day cliff**, measured from `max(buy_time, first_milestone_hit_ts) + 67 days`. Whichever anchor is later wins. If the token hits its first price milestone before your 67-day buy-anchored cliff, the calendar timer dominates. If the token takes longer to hit milestone, the milestone-anchored clock dominates.
* **67 days of linear vesting** after the effective cliff, releasing roughly `1/67` of the excess each day.
* **Claiming is permissionless and drip-based**. Once past the effective cliff, any settle call pulls whatever is newly vested, sells it through the bonding curve during the pool's active UNLOCK window, and deposits the SOL proceeds into your proceeds ledger. A protocol-run crank advances the drip automatically during UNLOCK windows; you claim the accumulated SOL whenever.
* **Recipient is the pool's `sol_vault` PDA**, protected by `has_one` + `token::authority` constraints on the withdraw path. Only the entitlement ledger holder (you, the buyer) can claim the resulting SOL.

Consequence of the milestone anchor: a whale who buys 1.6% at launch and sees the token pump quickly to M1 cannot dump their full position and then wait out a fixed calendar timer. Their 0.6% excess stays locked until 67 days *after* the milestone — which, for a fast pump, is later than the buy-anchored cliff. For slow-performing or never-succeeding tokens, the excess can remain locked indefinitely (same as with any price-gated lock).

Two ways excess gets claimable:

1. **Pool hits a milestone.** Your `first_milestone_hit_ts` starts ticking; 67 days later the drip begins.
2. **Pool never hits a milestone.** Excess stays locked. This is by design — the 1% cap exists to prevent whale accumulation on successful tokens; if the token never succeeds, the lock is moot anyway (no one wants the tokens).

The 1% cap is a hard limit on how much of any single pool one wallet can accumulate in a freely-claimable state.

***

## Locksmith vs Streamflow

|                       | **Locksmith** (new default)  | **Streamflow** (legacy / opt-in) |
| --------------------- | ---------------------------- | -------------------------------- |
| Stream-creation fee   | None                         | 0.19% + \~0.176 SOL              |
| Unlock predicate      | On-chain CPI to pool phase   | Off-chain timestamp updates      |
| Program               | `locksmith_master`           | Streamflow protocol              |
| Pre-2026-04-18 pools  | —                            | Default                          |
| Post-2026-04-18 pools | Default (creator-selectable) | Opt-in fallback                  |

You don't need to pick manually unless you want to. New tokens default to Locksmith. Tokens launched before 2026-04-18 stay on Streamflow forever — mid-pool backend migration is structurally impossible because Streamflow owns those escrow accounts.

***

## Deployment

* **Mainnet program ID:** `HGnDvnxwuvtcJ32CqZf1AFPUUqz3QUSwRsPFyH1FqRA5`
* **Deployed:** 2026-04-18 (fresh deploy)
* **Source:** clean-room — no AGPL-licensed Streamflow source was read during implementation
* **Audit status:** external engagement in progress; mainnet shipped ahead of audit sign-off per launch timeline. The surrounding programs `token_factory` and `streamlock_router` carry the March 2026 audit with all C/H/M findings addressed.

***

## Related

* [Streaming Proceeds](/streamlock-docs/core-concepts/streaming-proceeds.md) — what streams are and how settlement works
* [Freeze & Unlock Windows](/streamlock-docs/core-concepts/freeze-and-unlock.md) — when streams become withdrawable
* [Fee Structure](/streamlock-docs/fees-and-economics/fee-structure.md) — full fee breakdown
* [Trust & Safety](/streamlock-docs/security/trust-and-safety.md) — program list, audit scope, escrow guarantees