How Allpad works
A market is one Bureau of Labor Statistics series at one leverage, holding one pot of SOL split into an up side and a down side. This page covers where the numbers come from, how a print moves the pots, and what the program can and cannot do.
Markets
The program keeps one market account per series per leverage. Leverage is a whole number from 1 to 50, chosen by whoever launches the market, and it never changes. Eggs at 2x and eggs at 20x are separate markets with separate pots.
Each market has two SPL mints, one per side, whose only mint authority is the market itself. The app names them after the series and leverage: EGG5UP and EGG5DN for eggs at 5x. The market's SOL sits in a system-owned vault account that only the program can sign for.
Launching is permissionless. The launcher pays the rent for the market, the two mints and the vault's rent-exempt floor, which is never part of either pot. A launch and a first buy fit in one transaction.
Buying and selling
Buying a side adds your SOL to that side's pot and mints you tokens at the pot's value per token: shares = lamports × supply / pot, or one token per lamport when the side is empty. Selling burns tokens for pot × shares / supply. Whoever sells the last token of a side takes the whole pot, rounding dust included.
Both directions trade at the pot's own value per token, so a buy or a sell never changes the value of anyone else's tokens. That is why you buy one side directly rather than minting both and selling the half you disagree with.
The program takes nothing on a buy, a sell, a launch or a settlement. You pay Solana network fees and, when you launch or first buy a side, account rent.
Settlement
A market remembers which print of its series it has settled to. settle walks forward through newer prints one at a time, up to 24 per call. Anyone can call it, and every buy and sell calls it first. For each step from v0 to v1:
- Up wins if the value rose, down wins if it fell, and a flat month moves nothing.
- The share of the losing pot that moves is
|v1 − v0| / v0 × leverage, capped at 99%. - That share is added to the winning pot. The total never changes.
- If either side has no holders, nothing moves.
| Eggs | Move | At 2x | At 10x |
|---|---|---|---|
| $2.000 to $2.020 | +1% | 2% of down to up | 10% of down to up |
| $2.000 to $1.900 | −5% | 10% of up to down | 50% of up to down |
| $2.000 to $2.400 | +20% | 40% of down to up | 99%, the cap |
BLS occasionally skips a month; it published no October 2025 figures during the shutdown. The series then simply has no print for that month, and the next one is compared with the last.
The release freeze
The config account holds next_release, the scheduled time of the next BLS release. From one hour before it, buys and sells fail with Frozen until the market's series has a print posted after the freeze began. A market reopens as soon as its own figure lands.
The freeze cannot outlast three days after the scheduled release, figure or not, and the attester can only announce a release within the next 62 days.
Without it, anyone who reads the figure on bls.gov at 8:30 could sell the losing side before it is on chain, and the holders left behind would pay the whole move between them.
The attester
Each series is a PDA seeded with its BLS id, the same string bls.gov uses, holding its last 24 prints as (period, value × 1000, posted_at). One key, the attester, can list a series, post a newer month, and announce the next release.
The program refuses a month that is not later than the last one, a month that has not ended by UTC, and a zero value. There is no instruction through which the attester reaches a market or its SOL. Handing the role on takes two transactions, one from each key.
The attester could post a wrong figure, and markets settle on what is posted. It cannot rewrite a month once posted. Every series in the app links to its source, so any print can be checked.
Status
Reading Solana…
The program is unaudited. Its test suite runs the compiled program under solana-program-test with a controllable clock: the full cycle, the freeze, the freeze's own expiry, every guard, and a randomized run that checks after each step that the vault holds exactly the two pots plus its rent floor.