Docs

Skew lets anyone list and trade a bounded payoff — a forward, option, digital, spread, perp, or custom exotic — over a declared price domain. Every position prepays its worst case, so the venue is solvent by construction: claims are checked, not asserted; the cost is stated, not hidden.

There is no shared insurance fund, no socialized loss, and no liquidation engine. What replaces them is a single rule applied at formation — escrow the maximum · clamp the reference · pay from escrow only.

Each side of a contract escrows its worst-case loss (WCL) up front. Because the payoff is bounded and the settlement reference is clamped into a declared collar, the worst case is a finite number the contract computes before the market goes live — and refuses to list if it is not finite.

Escrow the maximum

Both parties lock their own WCL at formation. The counterparty's lock is the other side's WCL.

Clamp the reference

At settlement the realized price is clamped into [floor, cap] before payoff — so the loss can never exceed the escrowed edge.

Pay from escrow only

Disbursement comes from posted escrow, never from an unfunded promise. Solvency is the inequality escrow ≥ max loss.

The consequence: no leverage knob and no liquidations. Leverage, where it exists (perps), is an output of how tight a band you accept, not a multiplier you dial — and since each side prepaid its worst case, there is nothing to liquidate.

Every market declares a settlement collar [floor, cap] on a tick lattice. The payoff is piecewise-affine in the (clamped, snapped) reference. This bound is liquidity-independent: it comes from the contract, not the order book, so even a zero-liquidity token has a correct, declared worst-case band.

For a perp the bound is a rolling epoch band [lo, hi] that re-declares each epoch, with a capped funding rate and an open-interest cap; solvency is the escrowed worst case at the band edge, not a liquidation price. For a forward it is a fixed collar to maturity.

Positions in one risk account net. A hedge (a long forward + a protective leg) lowers the combined worst case, so escrow is released — the contract's freeableAmount. The amount you get back is read from the chain (or previewed with the same kernel the program runs), never computed independently by the interface.

The on-chain programs are the truth. A single byte-parity SDK mirrors them (Rust ↔ Python ↔ TS), and every consumer — this app, the indexer, the API, the keeper — reads through it, so nothing drifts. The interface touches data through three channels:

A · Preview

Pure SDK economics (escrow, payoff, netting). Deterministic and available now — the same kernel the program executes.

B · Reads

On-chain account decodes + indexer aggregations (positions, receipts, leaderboard, candles).

C · Writes

Wallet signing + transaction assembly (form, list, deposit/withdraw). Simulated + gated until mainnet.

Anything the SDK has not vended yet is gated honestly — an empty or pending state with the reason — never faked. When the SDK syncs, the gated figure lights up in place with zero interface change.

Forwards

Cash-settled forwards on a collar. Execute by batch (orders clear at one uniform price), by RFQ (maker quotes), or on the secondary market.

Perps

A rolling-epoch perp: a declared band + capped funding + OI cap per epoch. Leverage is the output of the band you accept.

Create Market

List any bounded payoff — forward / option / digital / spread / straddle / perp / custom — as ≤ 8 affine legs. Registering it lists it immediately; its WCL is certified on-chain at formation.

Maker surfaces

Post one parametric quote surface (mid · spread · slope · committed collateral) instead of dozens of resting orders; the batch nets user↔user first, then asks surfaces to quote the residual.

At maturity (or epoch close) the realized reference is clamped into the collar, then snapped to the lattice, and the affine payoff is paid from escrow. Every settlement emits a receipt that is deterministically replayable, plus a durable lifecycle log (form → activate → settle). The Receipts surface is the audit trail.

Worst-case loss is certified at formation (a cold-phase check), so a market cannot list unless it is provably solvent over its whole domain.

Governance is scoped into three buckets, and the boundary is the point:

Can govern

Fee schedules and policy parameters — within hard constitutional bounds.

Can constrain

Listing eligibility, oracle policy, risk-bracket tables.

Cannot govern

The solvency law. No vote can let a market settle outside its collar or release escrow it did not earn.

1. Connect a wallet — Phantom, Solflare, or any Wallet-Standard Solana wallet (top-right). Pre-mainnet this reads your address; signing unlocks at launch.
2. Deposit collateral from Portfolio → Deposit (USDC into your risk account).
3. Open a position — pick a token in Markets, choose a derivative, and read the funded economics before you submit.
4. List your own market via Create Market — any bounded payoff, certified at formation.
5. Build on it — generate a key under API and read the same shapes programmatically.

Can I get liquidated?

No. Each side prepays its worst case, so liquidation is inert — there is no maintenance margin or liquidation price.

What is the max I can lose?

Your escrowed WCL — shown on every ticket before you trade, and reduced by any netting against your book.

Why are some numbers gated?

A figure the vendored SDK hasn't synced yet is shown as pending with its reason, never fabricated. It lights up when the SDK lands.

Is the API live?

The shapes are real and served locally now; the public REST + WebSocket API goes live with the mainnet program. Keys today are local demo keys.