Bonding Curve Math in Crypto: Linear, Exponential and Sigmoid Models (2026)

Intent check: This page is the math-first bonding curve explainer. If you want the market-behavior version focused on token pricing and live curve movement, read How Bonding Curves Price Tokens.

A bonding curve is a mathematical formula that defines the price of a token based on its circulating supply. Unlike traditional markets where price is determined by order books and matched buy and sell offers, a bonding curve replaces the entire price discovery mechanism with a deterministic function written in code. Every time someone buys or sells, the smart contract calculates the new price using the same formula, instantly and without any human intervention. This is the mathematical backbone behind Pump.fun, Friend.tech, Bancor, and most modern memecoin launchpads.

If you have ever wondered why a freshly launched memecoin starts at a fraction of a cent and then jumps in price with every new buyer, the answer is the bonding curve. The curve creates a self-contained automated market maker (AMM) where liquidity is generated programmatically, where early buyers always pay less than late buyers, and where the issuance of new tokens follows a predictable mathematical path. There is no order book, no market maker, no listing fee, and no permission needed. You deposit collateral, the contract mints tokens, and the curve handles everything else.

In this guide, you will learn what a bonding curve is, where the concept comes from, the five most common mathematical forms (linear, polynomial, exponential, sigmoid, logarithmic), how Pump.fun's constant-product virtual reserves model actually works, how Friend.tech's quadratic curve priced creator keys, and how MEV bots exploit bonding curves through sandwich attacks. We will also walk through a fully worked numerical example so you can see, line by line, what happens to price when somebody buys 100 tokens at a specific point on the curve.

What Is a Bonding Curve in Crypto?

A bonding curve is a smart contract that holds a reserve of collateral (usually a stable asset like USDC, or a base asset like SOL or ETH) and mints or burns a custom token according to a price function. When you send collateral to the contract, it mints new tokens for you at the current curve price. When you sell tokens back to the contract, they are burned and the corresponding amount of collateral is returned. The price the contract quotes depends entirely on how many tokens currently exist, which is the circulating supply at the moment of your trade.

The most important property of a bonding curve is that the price is a pure function of supply. There is no concept of "the market price" because the contract is the market. If the function says price = 0.0001 * supply, then at supply 1,000,000 the price is exactly 100. There is no negotiation, no slippage off a quoted price, no order matching, no human market maker. The function alone defines the price.

This has profound implications. First, the curve provides instant liquidity for any token at any size, because there is always a counterparty: the contract itself. Second, the curve removes the need for a centralized exchange listing, because anyone can buy or sell directly from the smart contract. Third, the curve creates deterministic tokenomics. If you know the formula and the current supply, you can calculate exactly what would happen if someone bought a million dollars worth of tokens at this very second. No surprises, no hidden books, no information asymmetry.

Bonding curves are sometimes called continuous token models, because tokens are minted continuously as demand arrives, rather than being pre-mined and then distributed through an ICO or airdrop. The supply is elastic and responds to capital inflow and outflow in real time, which is a fundamentally different model from fixed-supply tokens like Bitcoin.

Origin: Bancor 1996 and Simon de la Rouviere 2017

The idea of pricing an asset against a reserve using a fixed mathematical relationship long predates crypto. In 1996, economist Bernard Lietaer published the Bancor whitepaper, named after the supranational currency originally proposed by John Maynard Keynes at the 1944 Bretton Woods conference. Lietaer's design suggested that a token could maintain convertibility to a reserve asset through a constant ratio (the "constant reserve ratio") between the reserve and the market capitalization of the token. This was the first mathematical sketch of what we now call a bonding curve.

The concept lay dormant until 2017, when the Bancor Protocol on Ethereum implemented the model on-chain. Bancor's smart contract held a reserve of ETH and minted BNT tokens against it using the constant reserve ratio formula. For the first time, a token could have provable, on-chain liquidity at all times, with no order book and no third-party market maker. Anyone could buy BNT by sending ETH to the contract and sell BNT back to receive ETH, all at prices determined by the curve.

Later that same year, developer Simon de la Rouviere wrote a now-famous blog post titled "Tokens 2.0: Curved Token Bonding in Curation Markets" which gave the concept its modern name. De la Rouviere proposed bonding curves as a general primitive for token issuance, where the curve shape would be tuned to the use case. A steeper curve would reward early adopters more aggressively, while a gentler curve would create stable pricing for utility tokens. His post laid out the conceptual framework that every later protocol, from Friend.tech to Pump.fun, would draw on.

Between 2018 and 2021, projects like Aragon, Curve, Convergent, and the Continuous Organization framework experimented with bonding curves for governance tokens, DAO funding, and continuous fundraising. The model entered mainstream crypto awareness in 2023 when Friend.tech used a quadratic bonding curve for creator "keys", and exploded in early 2024 when Pump.fun adopted a constant-product curve as the launchpad mechanism for tens of thousands of Solana memecoins.

How Bonding Curves Work Mathematically

At its core, a bonding curve is a function price = f(supply) where supply is the current circulating amount and price is the marginal price you pay for the next token. To compute the cost of buying multiple tokens, the contract integrates the price function from the current supply to the target supply.

If f(s) is the spot price function, then the total cost of buying tokens that take supply from s_0 to s_1 is the definite integral of f(s) with respect to s from s_0 to s_1. In code this looks like a closed-form expression that the contract evaluates in a single step, so the gas cost stays predictable regardless of trade size.

The integral of the price function from 0 to s gives the total amount of collateral locked in the contract when the supply is s. That collateral is the "reserve" of the curve, and it backs the market capitalization of the token in a verifiable, on-chain way. If the reserve is 10 ETH and there are 1,000,000 tokens outstanding at a curve price of 0.00002 ETH each, the market cap is 20 ETH but the redeemable backing is 10 ETH. The 2:1 ratio between market cap and reserve is a property of the curve shape, not an accident.

This brings us to a critical concept: the reserve ratio. For a linear curve, the reserve always equals half of the market cap, because the price went from zero to its current level in a straight line and the area under that line is a triangle. For a quadratic curve, the reserve equals one third of the market cap, because the area under a parabola from zero is one third of the rectangle. The steeper the curve, the smaller the reserve ratio, and the more aggressively early buyers are rewarded relative to the collateral they put in.

The Five Most Common Bonding Curve Types

There is no single canonical bonding curve. Each protocol picks a function that fits its goals, and the shape of that function controls the entire economic behavior of the token. Below are the five most common curve types you will encounter in DeFi, with their formulas, properties, and where they show up in real protocols.

Linear Bonding Curve

The simplest possible curve is a straight line. The formula is price = m * supply + b where m is the slope and b is the starting price at supply zero. Each token issued raises the price by a fixed amount. If m = 0.0001 ETH and b = 0, then the 1,000th token costs 0.1 ETH, the 10,000th token costs 1 ETH, and so on. The integral from zero to s is m * s^2 / 2 + b * s, so the reserve grows as a quadratic of supply even though the price is linear.

Linear curves are easy to reason about and gentle on late buyers. The downside is that the early-buyer reward is modest, so they are rarely used for memecoins where the entire pitch is "10x your money before the next guy buys in".

Polynomial Bonding Curve

A polynomial curve generalizes the linear case. The formula is price = k * supply^n. When n = 1 you have the linear case. When n = 2 you have a quadratic curve (parabola) which is what Friend.tech used. When n = 3 you have a cubic curve, which is more aggressive still. Higher exponents reward early buyers more. The integral is k * s^(n+1) / (n+1), so the reserve ratio is 1 / (n+1).

Exponential Bonding Curve

An exponential curve uses Euler's number: price = a * e^(b * supply). Doubling intervals are constant: every fixed number of tokens minted doubles the price. This curve goes vertical extremely fast, which is great for early buyers but punishes anyone who arrives late. Most production protocols avoid pure exponentials because they make the token effectively unusable once supply expands.

Sigmoid Bonding Curve

A sigmoid curve has three regions: a slow flat start, a fast steep middle, and a flat plateau at the top. The formula is price = L / (1 + e^(-k * (supply - s0))) where L is the maximum price, k controls steepness, and s0 is the supply midpoint where price equals L/2. Sigmoids mimic the natural adoption curve seen in technology diffusion and are useful when you want a hard price ceiling.

Logarithmic Bonding Curve

A logarithmic curve grows quickly at first and then flattens dramatically. The formula is price = a * ln(supply) + b. Early buyers get strong appreciation, but late buyers face only modest price increases. Logarithmic curves are useful when you want to reward early adoption without permanently locking out later participants.

Pump.fun Curve Deep Dive: Constant Product with Virtual Reserves

Pump.fun, the dominant Solana memecoin launchpad, does not use a "pure" linear or polynomial curve. Instead it uses a constant-product formula identical to Uniswap V2, but with one crucial twist: the reserves are virtual. Let us unpack that, because it is the single most important and most misunderstood mechanism in the memecoin space.

The Pump.fun curve starts with a virtual SOL reserve of 30 and a virtual token reserve of approximately 1.073 billion. The constant product is k = 30 * 1.073e9 = 3.219e10. The starting price per token is 30 / 1.073e9 = 2.795e-8 SOL. That is roughly 0.0000000279 SOL, or about 5 millionths of a US cent at SOL prices around $180.

When you buy with SOL, the contract adds your SOL to the virtual reserve and computes how many tokens you get out using the constant-product formula: tokens_out = virtual_token_reserve - (k / (virtual_sol_reserve + sol_in)). Because the reserves are virtual, the contract does not actually have to hold 30 SOL upfront; the math just behaves as if it did. This lets Pump.fun launch a token with effectively zero capital while still providing a working price curve.

The bonding curve runs until 85 real SOL have been deposited. At that point, the token graduates: roughly 200 million tokens are paired with the accumulated SOL and seeded as liquidity on Raydium, the AMM, and the bonding curve closes. From that point on, the token trades on a normal Uniswap-style AMM with real liquidity. The curve graduation is sometimes called "bonding to Raydium" and it is the milestone that defines a Pump.fun token as having "made it".

The genius of virtual reserves is that the curve produces a smooth, predictable hyperbola without any upfront capital, the launch fee structure is bounded (max profit for early buyers is capped by graduation), and every trade is sandwich-resistant in the sense that the price impact is identical to what you would see on a real AMM with the same reserves.

Friend.tech Quadratic Curve: Social Tokens and Creator Keys

Friend.tech launched in August 2023 on Base and briefly captured the imagination of crypto Twitter with a novel idea: every creator gets their own personal token (called a "key" or "share") whose price follows a strict quadratic bonding curve based on how many keys are outstanding for that specific creator.

The Friend.tech curve formula was straightforward: price_in_eth = supply^2 / 16000 where supply is the number of keys already issued for that creator. Buying the first key cost almost nothing (1^2 / 16000 = 0.0000625 ETH), buying the 10th cost 100 / 16000 = 0.00625 ETH, and buying the 100th cost 10000 / 16000 = 0.625 ETH. Going from supply 100 to supply 200 took the price from 0.625 ETH to 2.5 ETH per key.

The quadratic shape meant early supporters of a creator were rewarded dramatically as more people piled in. A 10% trading fee (5% to the creator, 5% to the protocol) was applied to every buy and sell. The trade-off was that late buyers paid escalating prices for what was essentially a paid Telegram group, with the only on-chain utility being access to the creator's private chat.

The mathematical critique is that a pure quadratic curve has no ceiling. If a creator becomes truly popular, the cost to buy a key grows without bound, which prices out exactly the audience that creators care about most. Friend.tech faded by mid-2024 partly because the curve shape was too aggressive for sustained engagement. The protocol nevertheless proved that bonding curves work well for niche, identity-based token markets.

Bonding Curve vs AMM (Uniswap)

A bonding curve and an AMM look mathematically similar but serve different purposes. An AMM like Uniswap requires a pool of two existing tokens, typically supplied by liquidity providers (LPs) who earn fees in return. Trading swaps one token for another, and the constant-product invariant x * y = k sets the price. The two tokens already exist; the AMM just facilitates exchange.

A bonding curve, by contrast, mints and burns tokens against a single collateral asset. There are no LPs. The "liquidity" is the smart contract's reserve, and any user can be the counterparty for any trade simply because the contract will always quote a price defined by the curve. New tokens are created when you buy and destroyed when you sell. There is no LP risk, no impermanent loss, and no pool depth concern.

That said, modern launchpad bonding curves (like Pump.fun's) borrow the constant-product math directly from Uniswap, with the only difference being virtual reserves and the absence of LP shares. From an outside trader's perspective the curves behave identically until graduation: every SOL in lifts the price along the same hyperbola.

Bonding Curve vs Traditional ICO

The contrast with a traditional ICO is sharper. In an ICO, the project team pre-mints a fixed supply, sets a fixed price per token (sometimes with tiered discounts for early rounds), and sells until either the cap is reached or the sale ends. Every buyer in the same round pays the same price, regardless of who comes first. After the ICO closes, the team distributes tokens and sometimes lists on an exchange to create a secondary market.

A bonding curve dissolves the entire concept of a "round". Every buyer transacts at the price set by the current supply, so the very first buyer always pays less than the second buyer, who pays less than the third, and so on. There is no "round close" because the curve runs continuously. There is no fixed cap unless the curve has a built-in ceiling (sigmoid) or graduation event (Pump.fun). Liquidity exists from the first satoshi of capital deposited, so the team does not need to coordinate a listing with a centralized exchange.

The downside is that bonding curves create extreme price-time sensitivity. A buyer who arrives one block later pays a different price, which is great for early movers but terrible for retail buyers who get sniped by MEV bots. Traditional ICOs at least had the dignity of charging everyone the same price.

Worked Numerical Example: Buying 100 Tokens on a Linear Curve

Let us walk through a fully worked example so you can see the math in action. Suppose a token has a linear bonding curve with price = 0.0001 * supply denominated in ETH. The current supply is 50,000 tokens, so the current spot price is 0.0001 * 50000 = 5 ETH per token. You want to buy 100 tokens, taking supply from 50,000 to 50,100.

Notice two important quantities. The price impact is the change in the spot price caused by your trade: 5.01 minus 5.00 equals 0.01, which is a 0.2% impact. The slippage is the difference between the average price you paid and the spot price you saw before clicking buy: 5.005 versus 5.00, which is 0.1%. On a linear curve, the slippage is exactly half the price impact, because the average over a linear segment is the midpoint.

If the curve were quadratic (price = supply^2 / 1e9), the same 100-token buy at supply 50,000 would cost about 250 ETH average per token (spot price = 2.5 ETH; price impact = +1%, slippage = +0.5%), with the relationship between impact and slippage now controlled by the integral of a parabola instead of a line. Steeper curves always produce more slippage for the same trade size.

Price Impact and Slippage on Bonding Curves

Slippage on a bonding curve is mathematically equivalent to the spread between the spot price and the volume-weighted average price (VWAP) of the trade. The steeper the curve, the higher the slippage for a given trade size. On a flat (zero-slope) curve, slippage is zero, but then the curve is useless because price never moves with demand.

Most bonding curve UIs allow users to set a slippage tolerance, which acts as a guard rail. If during the time your transaction sits in the mempool the curve moves more than your tolerance allows, the contract reverts your buy. This protects you from buying at a price wildly different from the one you saw on screen, but it also creates a window of vulnerability that MEV bots will happily exploit.

MEV Sandwich Exposure on Bonding Curves

Bonding curves are notoriously easy to sandwich. A sandwich attack works like this: a bot sees a victim's pending buy in the mempool, front-runs it with its own buy at the current low price, lets the victim's buy push the curve price higher, then immediately sells into the inflated price. The bot extracts the difference between its entry and exit, paid for entirely by the victim's slippage.

Because bonding curves have a deterministic price function, the bot can compute the exact extractable value before submitting any transaction. On Solana, Pump.fun's curve is sandwiched by Jito-aware bots that pay tips to validators to ensure ordering. On Ethereum L2s, the same pattern happens through Flashbots-style private order flow. The mathematics of the curve is the bot's ally: a deterministic curve is a deterministic profit calculation.

Mitigations are limited. Some protocols implement transaction ordering rules (FIFO at the block level), private mempools (Flashbots Protect on Ethereum, Helius private RPCs on Solana), or anti-sandwich price tolerances. None of these eliminate the attack vector, because the curve itself is public and the price function is known to every bot watching the chain.

Curve Design Trade-offs

Choosing a curve is choosing a tokenomics philosophy. The four main trade-offs you face are steepness, predictability, manipulation resistance, and capital efficiency.

Steepness determines early-buyer rewards. A steep curve (exponential, high-degree polynomial) rewards early adopters with massive returns when supply expands, but punishes late buyers with brutal pricing. A gentle curve (linear, logarithmic) keeps pricing accessible but offers smaller early-buyer upside.

Predictability matters for retail trust. Closed-form formulas like linear or quadratic are easy to plot, reason about, and front-test. Sigmoid and certain virtual-reserve curves have parameter-dependent behavior that is harder to communicate to users, which can lead to surprise outcomes.

Manipulation resistance covers MEV exposure, oracle dependence, and flash-loan attacks. Curves that depend on external price feeds inherit oracle risk. Curves that allow free buy-and-sell within the same block are sandwich-prone. Some protocols add per-block trade limits or cooldowns to harden the curve against bots.

Capital efficiency is the ratio of reserve held to market cap created. A linear curve holds 50% of market cap as reserve, a quadratic holds 33%, and a virtual-reserves model holds zero capital upfront but only graduates a fraction of the implied market cap to the next AMM. The right answer depends on whether you want a fully collateralized token or a memecoin that exists mostly on hype.

Real-World Bonding Curve Protocols

Several major protocols use bonding curves as core infrastructure. Each one picked a curve shape and a configuration tuned to its target audience.

Use Cases for Bonding Curves

Beyond the headline launchpads, bonding curves are deployed for a wide variety of token economies:

Risks of Bonding Curves

For all their elegance, bonding curves carry several risks every user should understand before depositing capital.

Price manipulation. A curve that depends on a small reserve is easy to push around. A large buyer can spike the price 100x in a single transaction, dump on retail, and drain the reserve. Even with virtual-reserves models like Pump.fun, snipers run bots that buy in the first block to capture the cheapest entry.

MEV extraction. As discussed earlier, sandwich attacks are nearly guaranteed on any public bonding curve with non-trivial trade volume. Users should set tight slippage and consider private RPC endpoints when buying memecoins.

Smart contract risk. Bonding curve contracts can be exploited like any DeFi contract. Bugs in the integral computation, in the reserve accounting, or in the migration to a DEX have caused multiple historical exploits. Always check whether the contract has been audited.

Rug pulls. On permissionless launchpads, the team can pre-buy on the curve, accumulate a large supply, and dump on holders once the curve graduates. This is structurally easier than on a fixed-supply ICO because the team can be invisible at launch.

Liquidity death spirals. If holders panic and sell, the curve burns tokens and returns collateral. The price falls along the curve, triggering more selling, which lowers price further. On steep curves, the spiral can wipe out 90% of market cap in minutes. There is no LP to "cushion" the move, because the curve is the LP.

Frequently Asked Questions

Is a bonding curve the same as an AMM?

Not quite. Both use mathematical price functions, but an AMM swaps between two existing tokens supplied by liquidity providers, while a bonding curve mints and burns a single token against a collateral reserve. Modern launchpads like Pump.fun blur the line by using AMM-style constant-product math on a bonding curve with virtual reserves.

Why does the price go up every time someone buys?

Because the curve is a function of supply. When you buy, the contract mints new tokens, which increases the supply, which moves you along the curve to a higher price. The very next buyer pays a price computed at the new, higher supply level. This is mechanical, not driven by sentiment.

Can I sell back to the bonding curve at any time?

On most curves, yes. You can sell tokens back to the contract, which burns them and returns the collateral corresponding to the area under the curve between the old and new supply. The price you receive depends on where you are on the curve when you sell, not on the price you paid when you bought.

What happens when a Pump.fun token graduates?

When 85 real SOL have been deposited into the bonding curve, the contract pairs roughly 200 million tokens with the accumulated SOL and seeds a liquidity pool on Raydium. The bonding curve closes and the token trades from then on as a normal AMM pair. The graduation is sometimes called "bonding" or "completing the curve".

Are bonding curves safer than ICOs?

Different risk profile, not strictly safer. Bonding curves give immediate liquidity and transparent pricing, which is an improvement over opaque ICO rounds. But they also expose buyers to MEV, sniping, and price-time discrimination that ICOs do not have. The right question is which risks you prefer.

Why do bonding curves attract MEV bots?

Because the price function is public, deterministic, and computed on-chain. A bot can simulate the exact price impact of any buy or sell before submitting a transaction. Combined with mempool visibility, this makes bonding curves a perfect environment for sandwich attacks. Every memecoin launch on Pump.fun is sniped within milliseconds for this reason.

Conclusion

A bonding curve is one of the cleanest ideas in crypto: replace the entire price discovery machinery with a single function and let math do the rest. From Bernard Lietaer's 1996 Bancor proposal to Simon de la Rouviere's 2017 essay, to Bancor's on-chain debut, to Friend.tech's quadratic creator keys, to Pump.fun's constant-product virtual reserves, every major iteration has explored a slightly different shape and parameter set to fit a different use case.

The five canonical curve types (linear, polynomial, exponential, sigmoid, logarithmic) each encode a tokenomics philosophy. Linear is fair and predictable. Quadratic rewards early adopters strongly. Exponential is brutal on latecomers. Sigmoid caps prices. Logarithmic flattens after a fast start. Picking the right curve is the single most consequential design decision a token issuer makes, because it determines who wins, who loses, and how much volatility holders endure.

For end users, understanding the curve under any token you trade is essential. If you are buying on Pump.fun, you are trading against a constant-product hyperbola with 30 SOL of virtual depth, and you can compute your price impact and slippage exactly. If you are buying on Friend.tech, you are paying a quadratic price for access to a chat, with no upper bound. If you are participating in any future bonding-curve launchpad, the formula will be your friend or your enemy, depending on whether you read it.

Bonding curves are not magic. They are math. The math is public, deterministic, and the same for everyone, which is exactly why they work and exactly why MEV bots love them. Read the curve, do the integral, and you will know more about the token's economics than 99% of the people trading it. That is the real edge in modern DeFi: the formulas are open, and the people who do the work win.

Related Guides

• Curve vs Uniswap: DeFi DEX Models Compared (2026)
• How Bonding Curves Price Tokens on Pump.fun and Friend.tech (2026)
• Impermanent Loss in DeFi Liquidity Pools: Worked LP Math, Break-Even and Trade-Offs (2026)
• What Is Convex Finance? CVX & Curve Booster Guide 2026
• Cliff Unlock vs Linear Vesting: Sell Pressure