How percs.markets works

percs.markets is a perpetual futures venue for Solana tokens that have no business having one: memecoins, fresh launches, long-tail SPL tokens. Anyone can open a market for any token with a real pool. Each market is SOL-margined, isolated, and funded by creator fees from $PERCS.

The thing that makes this possible without blowing up is the risk engine. Every market runs on Percolator, Anatoly Yakovenko's formally verified perps engine. Percolator's whole design goal is that a manipulated or illiquid asset cannot be turned into real purchasing power: winners are only paid from what the losers in that same market can actually cover.

Percolator is a zero-copy, account-local risk engine for perpetual futures. It is a Rust library, not a program: it does no token transfers, no signature checks, and no oracle reads. It owns exactly one thing, the risk-state transitions, and it proves them. The current spec (v16.9) ships with roughly 420 Kani proofs covering value conservation, no-steal, bounded progress and account-local safety.

What it guarantees

• Protected principal is senior. Your deposited collateral is never used to pay another account's paper profit.
• Realizable PnL only. Positive PnL on a position is usable (for withdrawal, for margin on other trades) only up to what the losing side of that same market has actually reserved. If someone pumps a thin token 500% against a short that cannot pay, the long's profit is haircut to what is collectable, not what the chart says.
• Instance isolation is absolute. No health, collateral, insurance or bad debt crosses between markets. A broken BONK market cannot touch a WIF market.
• Deterministic liquidation and bankruptcy. Who gets liquidated, in what order, and who eats a shortfall is decided by the engine, not by whoever submits the transaction first.
• Crank-forward liveness. Nothing in the engine requires a privileged key to advance. Any state that needs moving can be moved by anyone.

Engine, wrapper, policy

There are three layers, each with its own trust boundary:

We did not write a second wrapper. Percolator already has one, written by its author, with its own proof and fuzz suites. Our program sits on top of it: it holds the market authority, checks our rules before every trade, and calls into the wrapper through CPI.

Creating a market

1. Paste a token mint on the Create page.
2. The token's main pool is located (Meteora, PumpSwap or Raydium, whichever holds the most liquidity). If that pool has less than $5,000 of liquidity, creation is rejected. Thin pools make cheap oracles.
3. A market account and an isolated SOL vault are created. The creator pays a 0.05 SOL creation fee plus rent. The fee is deposited into that market's vault, not to the protocol.
4. The market enters Filling. The keeper routes every $PERCS creator fee into market vaults, and anyone can deposit directly.
5. When the vault holds 1 SOL, the market goes Live and trading opens.

Lifecycle

Paused is temporary and automatic: once a full window passes without a 15% move, the market returns to Live. Closing positions is always allowed in Paused, so nobody is trapped in a trade they want out of.

The mark price is a time-weighted average price computed from the token's main DEX pool over a 5-minute window. Spot is never used for anything: not for entries, not for liquidations, not for PnL.

A keeper reads the pool, computes the TWAP, and pushes it on-chain as the market's mark. Percolator's wrapper calls this mode AuthMark: a designated authority signs the mark, the engine consumes it, and the engine additionally rate-limits how far the effective price can move per slot.

• Why TWAP: a single-block pump on a thin pool barely moves a 5-minute average. To move the mark 15% you have to hold the pool there for minutes, paying slippage and fees the whole time.
• Why the pause rule: if the TWAP itself moves more than 15% in one window, something is genuinely happening (or someone is spending a lot of money). New positions stop; existing ones can close. This caps how much new exposure the vault can take on during a spike.
• Why not Pyth/Switchboard: they do not cover these tokens. Where a feed exists we will prefer it; for the long tail the pool is the only price that exists.

Every market has one vault. It is the counterparty of last resort, the insurance fund, and the source of every limit. It holds SOL only.

Because every cap is a percentage of the vault, a market's capacity grows exactly as fast as its backing. $PERCS volume funds every market; busy markets grow further on their own trading fees. Nobody has to set a size.

Bad debt, when it happens, is charged to the vault of the market that produced it and nowhere else. If a vault cannot cover a shortfall, Percolator's bankruptcy close socialises the remainder across the winning side of that market only, deterministically, in proportion to position size.

$PERCS is the protocol token and the thing that funds the vaults. It is launched on a bonding-curve launchpad (pump.fun), and every trade of $PERCS on the curve and, after graduation, on PumpSwap pays a creator fee.

1. Creator fees accrue to the $PERCS creator account on the launchpad.
2. The keeper claims them on a schedule, signing with the creator key.
3. Everything claimed is deposited into market vaults as SOL. Nothing is skimmed for the protocol.

Which vaults get the deposit is a policy decision, not an engine one. The initial rule is pro-rata by open interest with a floor for markets still in Filling, so new markets reach the 1 SOL floor instead of starving while big markets compound. The rule is a program parameter and will be documented here when it changes.

Opening a position

Pick a side, enter margin in SOL, choose leverage up to 3x. Position size is margin × leverage. The form shows the maximum size allowed right now, which is the smaller of the per-position cap and the remaining room under the open-interest cap for your side.

Fills execute against the vault at the current mark. There is no order book; the vault is the counterparty, which is why its size caps yours.

Leverage & margin

Cross-margin is per market, never across markets. A profit in one market does not protect a position in another, which is what keeps a bad market from dragging down a good one.

Liquidation

When equity falls below maintenance margin, any keeper may liquidate. Percolator decides the size: enough to restore health, not necessarily the whole position. A penalty is charged, split between the keeper and the vault. Liquidation uses the mark (TWAP), so a one-block wick cannot liquidate you.

The approximate liquidation price shown in the app is entry × (1 − 1/leverage + maintenance) for longs and the mirror for shorts. The exact level depends on fees and funding accrued and is computed by the engine.

Fees & funding

Funding keeps the perp near the TWAP. When longs crowd in, longs pay shorts, and vice versa. The engine clamps the per-slot rate so a single wild hour cannot drain an account.

Every limit scales with the vault and is enforced on-chain by the policy program before the trade reaches Percolator. The UI only previews them.

Percolator is crank-forward: markets advance when someone calls PermissionlessCrank. We run a keeper that does this continuously, but anyone can, and liquidation rewards go to whoever lands the transaction.

• Mark pushes: read the pool, compute the 5-minute TWAP, sign the mark.
• Refresh & settle: accrue funding, refresh account health certificates.
• Liquidate: submit under-margined accounts; the engine sizes the liquidation.
• Fee sweeps: claim $PERCS creator fees and deposit the vault share.
• Status: trip and clear the pause flag, open markets that cross the vault floor.

If our keeper goes down, prices stop updating. The engine treats a stale mark as a reason to fail closed: favourable actions (withdrawals, risk-increasing trades) reject until a fresh mark lands; closing is still possible against the last authenticated price, and a hard timer eventually routes the market to permissionless resolution.

• Unaudited code. Percolator is an educational research project by its own description. Our policy program and keeper are new. Assume bugs.
• Oracle manipulation. The TWAP and pause rule raise the cost of an attack, they do not make it impossible. Percolator limits the damage to what the losing side can pay, which means in a successful attack the victims are the counterparties and the vault, not other markets.
• Pool liquidity can vanish. A rugged token has no price. The market moves to Recovery at the last good mark and winds down.
• Socialised loss. If the vault cannot cover a shortfall, winners in that market are haircut. This is by design and it is better than the alternative, but it means your PnL is not final until it is withdrawn.
• Keeper liveness. Marks come from our keeper. See above for what happens if it stops.
• Admin keys. One admin key exists for the kill switch and parameter updates. It cannot move funds. It will be moved to a multisig before any real volume.

Everything is on Solana mainnet. Both programs went live on October 28, 2026; initialize has run with the parameters above.

Sources: percolator, percolator-prog, percolator-cli, percs.markets frontend.