The pair index

A market is a coin and the tokenized stock it is paired with. Its index R is how many units of the stock one unit of the coin is worth, read straight from the pool's reserves. Nothing else enters the settlement path — no stock feed, no USD price, no external oracle.

Profit and loss is proportional to the move in that index. A position of size S opened at R₀ and closed at R₁ pays S × (R₁ − R₀) / R₀ for a long, and the negative of that for a short. Because both legs are ratios, the arithmetic is unit-free and the stock's dollar price cancels out entirely.

The coins are Token-2022 and can carry a transfer fee, a rebasing multiplier, a transfer hook or a pause flag. The program reads all of them before it quotes. A mint with a permanent delegate, a live pause, or a fee that can be raised without warning is not listable, and a change to any of them is grounds for the market to stop accepting opens.

Opening a position

You choose a market, a side, an amount of USDC and a leverage. Size is collateral × leverage, and four things are charged before anything else happens:

• Spread — 50 bps, applied against you. A long enters 0.5% above the index, a short 0.5% below it. This is the house's edge and it is the same for everyone.
• Open fee — 8 bps of size, taken once.
• Impact — a quadratic charge that grows with size relative to the pool's depth, capped at 300 bps. It exists so that opening large in a thin pool costs what it would cost to actually move that pool, and so the cap is never the only thing standing between a thin market and a large position.
• Close fee — 8 bps of size, charged when you exit.

Leverage is checked after those charges, against what is left of your collateral. Asking for the tier's maximum leverage on a size the impact fee has already eaten into will be refused rather than silently reduced.

Escrow and payout

The most a position can win is capped at 100% of size, and at 100% of the collateral behind it. That amount is moved into escrow for your position, specifically, at the moment it opens. If the vault cannot cover it, the open is rejected. There is no netting across positions and no assumption that some traders will lose while others win.

The vault therefore always satisfies balance ≥ total collateral + total reserved + total pending, and that inequality is asserted on every instruction that moves money. A payout that would break it cannot be signed. The practical consequence: the treasury can run out of room to open new positions, and it can lose money, but it cannot owe a settled position more than it holds.

Liquidation

A position is liquidatable once its remaining margin falls below 500 bps of size. At that point a keeper closes it, the close fee is charged, and whatever collateral remains returns to the vault. Your loss stops at the collateral you posted — the vault has no claim on you beyond it, in any market condition.

Keepers are permissionless and paid from the position being closed, so liquidation does not depend on us running infrastructure. If the ratio gaps straight past the threshold, the position closes at the worse price and the shortfall is the treasury's, not yours.

Caps and the daily budget

Every market lands in a tier from its measured depth, and the tier fixes three things: the maximum leverage, the maximum a single wallet may hold, and the maximum everyone on the same side may hold together. The per-side cap is what stops a crowd from doing what one large wallet cannot.

Above those sits one number that does not care which market you traded: across everything, the treasury books at most $3,000 of net loss in a rolling day, metered in 25 hourly buckets so the window cannot be gamed by waiting for midnight. When the budget is spent, opens stop and closes carry on. Nobody is trapped in a position by a limit.

A market's tier is re-derived from depth, so a pool that drains falls to a lower tier or out of the set entirely. Existing positions are always allowed to close.

A new market does not start at the tier its depth earns. However deep the pool, a fresh listing opens at Lite — $300 per wallet, $750 per side — and has to be observed without a break for a full day before the caps widen. Depth read once is a number someone can arrange for the length of one transaction; depth read continuously for a day is not. The tiers in the table above are what each market reaches once it has been watched that long, not what it carries on its first day. Tier falls apply immediately, with no delay in the other direction.

Getting a coin listed

Listing is mechanical, not editorial. A coin qualifies when it has a Raydium CPMM pool against a tokenized stock, that pool holds at least $14,000, and its mint passes the checks in The pair index. No application, no fee, and no cut of the coin's own tax — we take none of it. Anyone can call the listing instruction; the program reads the pool and either accepts it or does not.

Search above is the same test run against a real reading of the chain. Paste a mint and you get one of three answers: a market with its tier and caps, a pool that exists but sits below the floor, or nothing — which is what a coin with no stock-paired pool looks like. A coin that is below the floor today lists the moment its pool crosses it, and its tier then follows depth in both directions.

Price, and what stops manipulation

The index is a time-weighted average over a 60-minute window, sampled from the pool and stored in a ring of 318 observations on-chain. Pool depth is averaged over a shorter 30-minute window, because a pool draining is something to react to faster than a price moving. A spot read is never used for settlement, and the average is taken in log space so that a spike up and the matching collapse do not leave a residue in the mean.

The reason the averaging is not the main defence is worth being explicit about: we measured what actually happens after a large move in these pools and found no mean reversion inside the window. The median move gives back almost nothing an hour later, and nearly half of large up-moves are fully intact. Waiting does not make you whole, so the design does not assume it will.

What does the work is the cap. A manipulator has to buy the pool up, hold the position, and sell back out, paying the pool's fee twice and eating their own price impact on the exit. We priced that exact round trip rather than the first-order approximation of it — the sell leg executes into the price the buy created, which makes the true break-even materially lower than the naive one — and set the per-side cap below it with room to spare. At every listed depth, the attack costs more than it pays.

What can go wrong

• The coin goes to zero. Shorts win, longs lose their collateral, and the escrow pays the shorts. This is the ordinary case, not a failure.
• The treasury runs out of room. New opens are refused. Existing positions close normally, because their payouts were escrowed when they opened.
• The pool is drained or the coin's mint changes its rules. The market stops accepting opens. Positions can still be closed, priced from the last good observations.
• A stock halts or is delisted. The pair index keeps reading from the pool, which does not close. This is exactly why settlement is a ratio.
• We are wrong about the caps. The daily budget is the backstop: it bounds the loss from any mistake in the tier maths to a known number per day, in every market at once.

None of this makes the product safe to size carelessly. These are leveraged positions on microcap tokens. The honest summary is that you can lose everything you post, quickly, and that the design only guarantees you cannot lose more.

Parameters at launch

Parameters are on-chain and changeable by governance within bounds the program enforces; they cannot be changed retroactively for a position that is already open.