RECEIVED

TREASURY

instruments

TS/G

THE PROGRAM INTERFACE · EVERY INSTRUCTION, EVERY ACCOUNT, EVERY ARGUMENT

TS/G/1

design

nine instruments, fixed

The program has exactly nine instruments. Each is listed below with its purpose, its signer, the accounts it touches, and its arguments. This list is fixed by the program's interface description. If the interface on chain ever differs from this page, the chain is correct and this page is an incident.

initialize

Purpose: Create the config account and the float account. Called once, by the operator, when the system is put into production.

Signer: operator.

Accounts: config (PDA, seeds ["config"]), float (PDA, seeds ["float", mint]), mint, operator, system program, token program, rent.

Args: batch_window_seconds: u32, collateral_ratio_bps: u16, fee_bps: u16.

set_rates

Purpose: Update the rate sheet in the config account. Takes effect at the next batch.

Signer: operator.

Accounts: config, operator.

Args: collateral_ratio_bps: u16, fee_bps: u16, effective_batch: u32.

lock

Purpose: Lock collateral. Creates or adds to the caller's collateral account for the given mint.

Signer: counterparty.

Accounts: collateral (PDA, seeds ["collateral", counterparty, mint]), counterparty token account, collateral vault (PDA, seeds ["vault", collateral]), mint, counterparty, token program, system program.

Args: amount: u64.

open

Purpose: Open a position against locked collateral, drawing the amount from the float to the counterparty.

Signer: counterparty.

Accounts: config, float, float vault, position (PDA, seeds ["position", counterparty, nonce]), collateral, counterparty token account, counterparty, token program, system program, clock.

Args: amount: u64, nonce: u64.

settle

Purpose: Return a position's amount plus fee from the counterparty to the float and close the position. Only callable during the batch window for the position's batch number.

Signer: operator or counterparty.

Accounts: config, float, float vault, position, collateral, counterparty token account, signer, token program, clock.

Args: batch: u32.

release

Purpose: Release collateral that backs zero open positions back to the counterparty.

Signer: counterparty.

Accounts: collateral, collateral vault, counterparty token account, counterparty, token program.

Args: amount: u64.

hold

Purpose: Mark a position for review when the batch finds its collateral below ratio. Does not move value.

Signer: operator.

Accounts: config, position, operator.

Args: batch: u32, reason: u8.

name

Purpose: Set a display name for the calling counterparty, stored in a small PDA.

Signer: counterparty.

Accounts: name account (PDA, seeds ["name", counterparty]), counterparty, system program.

Args: name: String (max 32 bytes).

batch_memo

Purpose: Write the opening or closing memo of an overnight batch and advance the batch number on close.

Signer: operator.

Accounts: config, operator, clock.

Args: batch: u32, phase: u8 (0 open, 1 close), eligible: u32, settled: u32, held: u32.

interface

read from the chain at load time

The interface description below is read from the chain at load time using the program's published IDL account. It is shown raw so that it can be compared against the list above.

The interface account could not be read from the cluster at this time.

TS/G/2

seeds

derive and verify

ACCOUNT	SEEDS
config	["config"]
float	["float", mint]
float vault	["vault", float]
collateral	["collateral", counterparty, mint]
collateral vault	["vault", collateral]
position	["position", counterparty, nonce]
name account	["name", counterparty]

TS/G/3

errors

the program's error enum

CODE NAME	MEANING
NotOperator	The signer is not the operator key in config.
BatchClosed	The settle or hold instrument was called outside the position's batch window.
InsufficientCollateral	Collateral is below the ratio on the rate sheet.
CollateralInUse	Release was attempted while positions are open.
FloatLocked	Operator withdrawal was attempted while positions are open.
NameTooLong	More than 32 bytes.
RatesNotEffective	set_rates was called with an effective batch in the past.
PositionSettled	An instrument was called on an already settled position.

TS/G/4

reading an instruction from the log

PROCEDURE

Every transaction against the system produces program log lines. The first line names the program. The next names the instrument. Lines beginning with the program's own prefix record what it checked and what it moved. The last line records success or the error name. The settlement detail pages print these lines unchanged. If you learn to read them you do not need this site.

TS/G/5

instrument families

GROUPING

FAMILY	INSTRUMENTS	WHO SIGNS	WHAT MOVES
setup	initialize, set_rates	operator	nothing
collateral	lock, release	counterparty	collateral between the counterparty and its vault
position	open, settle	counterparty; settle also operator	float between the float vault and the counterparty
review	hold	operator	nothing
record	name, batch_memo	counterparty; batch_memo operator	nothing

TS/G/6

why nothing takes an arbitrary account

DESIGN

Every account an instrument touches is either a program-derived address with fixed seeds, a token account whose owner is checked against the signer, a well-known program, or a sysvar.¹ There is no instrument that accepts "an account" without constraint. This is what makes the seeds table on this page useful: anyone can derive every account the system will ever touch and check that a transaction used the right ones. A program that accepts arbitrary accounts is a program whose behaviour depends on who is calling, and that is a program you cannot audit from its interface alone.

TS/G/7

what initialize cannot do twice

DETAIL

Initialize creates the config account at a fixed address. A second call finds the account exists and fails at account creation, before any of the program's own code runs. There is no re-initialize. If config is wrong, the remedy is a new deployment with a new program id, announced by memo, and this site's environment pointing at the new id. The old program, and its book, remain readable forever.

TS/G/8

the reason codes on hold

REFERENCE

CODE	MEANING	WHAT THE COUNTERPARTY CAN DO
0	collateral below ratio	lock more collateral; the next batch will re-check
1	collateral mint mismatch	nothing; this should be unreachable because open checks the mint, and its appearance is a serious incident
2	manual hold	read the memo that accompanies it

TS/G/9

arguments that look like they should exist and do not

ABSENCES

There is no argument for a price. There is no argument for a duration. There is no argument for a recipient other than the signer. There is no argument for a memo on open or settle, because the chain's memo program exists for that and the desk uses it separately. There is no admin override argument on any instrument. Where this list surprises you, the surprise is the design.

1. A program derived address is an account address computed from fixed seeds, so anyone can derive it and check the desk's work.

END OF INSTRUMENTS