CLP - Continuous Liquidity Provider

The on-chain program that hosts Continuum’s three trading venues and the vaults that provision them.

The CLP (Continuous Liquidity Provider) is the on-chain program where all trading happens. It hosts the three venues - native CLMM books, committed orders, and the instant oracle swap - plus the per-market vaults that stock them with inventory.

End users interact with the CLP every time they trade a leg. Inventory and treasury operations (funding books, sweeping excess, minting pairs into vaults) are keeper- or admin-gated.

Venue 1: native CLMM books

Each market has one Pool account per side (PDA seeds [b"pool", market, side]), so 8 pools across the 4 live markets. Unlike an external AMM:

• Bins are inline. Up to 16 price bins live directly in the Pool account - no separate bin-array accounts, no rent churn on reposition.
• 2-zone geometry. Fine core steps near NAV for tight small-trade pricing, wide wings further out (e.g. QQQ: 20 bps core steps ×3, then 300 bps wings). Set via configure_pool_geom(wing_step_bps, core_bins).
• Keeper-pinned to NAV. set_pool_shape(base_price, asks, bids) posts the book base and per-bin sizes in one call (sums are checked against vault balances). The keeper re-pins when pool price drifts past a per-market gate - 20 bps for QQQ/SPY/XAU, 40 bps for VXX, calibrated just below each market’s toxic-arb line.

pool_swap(direction, amount_in, min_out) walks the bins with real slippage. It is pure inventory trading - no mint or burn happens in the swap.

Lean by design

Book depth is sized to demand, never to TVL:

• Toxic-arb loss scales with deployed depth, while organic revenue is demand-capped - so more depth past demand is pure downside.
• Deployed synth has zero yield opportunity cost (the collateral backing the pair earns wherever the tokens sit). Deployed bid cUSDC idles, forgoing ~5.5% APR - so bids are capped at ~$5k per side, with excess swept to the CLP vault where it provisions committed orders.
• Asks trim to ≤1.5× bids via pool_sweep_synth.

The keeper’s refill loop is bidirectional: drained asks restock by sweeping bids, minting pairs via vault_mint_pairs, and funding both sides delta-neutral; bloated sides trim back. Large sells don’t need standing bids at all - they route through committed orders, and the keeper provisions cUSDC at settle time via vault_redeem_pairs.

Venue 2: committed orders

The large-order path - three instructions and one account:

commit_swap(direction, amount_in, min_out)
    → escrows input into an Order PDA (TTL 180 s)
settle_swap(order)            ── permissionless
    → fills at NAV ± 10 bps using the FIRST oracle print
      strictly after the commit; min_out miss → full refund
cancel_swap(order)            ── after TTL
    → unconditional refund; checks nothing else

Key properties:

• No size cap. Because the fill price is set after the commitment, latency arbitrage is impossible by construction. Bounds are oracle health, the collateral floor, and keeper-provisioned inventory.
• Thin spread. COMMIT_SPREAD_BPS = 10 - thinner than the instant venues because the post-commit price carries zero adverse selection.
• Always recoverable. cancel_swap after the 180 s TTL (COMMIT_TTL_SECS) refunds regardless of oracle, keeper, or admin state. Every terminal path - settle, refund, cancel - closes the Order account and returns rent.
• Permissionless settlement. Anyone can call settle_swap; the keeper cranks it at a 20 s cadence (5 s while orders are pending), typically 12-25 s end to end.

The Order account layout anchors getProgramAccounts filters: user at offset 8, market at 40, status at 74.

Mainnet prerequisite: settle_swap currently prices off the keeper-relayed TWAP. Mainnet requires reading Pyth directly with publish_time > order.created_at.

Venue 3: instant oracle swap

clp_swap fills instantly from pre-stocked CLP inventory at NAV ± 30 bps. It predates the books and is retained for small instant trades, behind defense-in-depth guards:

• Oracle-health breakers: 60 s staleness, confidence ceiling, 25% deviation cap.
• A rolling notional window cap.
• A collateral floor check on the market vault.

Committed orders bypass this venue entirely and do not consume its window.

Vaults and capital flow

Admin / fees / yield
    ▼
Per-market CLP vault (cUSDC)
    │ vault_mint_pairs        → CLP-PDA-signed CPI into mint-redeem;
    ▼                            paired L+S land in CLP custody
CLP inventory (L + S + cUSDC)
    │ clp_fund_pool_synth /   → stock the per-side books
    │ set_pool_shape
    ▼
CLMM books ◄──── pool_sweep_usdc / pool_sweep_synth ──── excess back to vault
    │
    └─ committed orders provision from the vault at settle time
       (vault_redeem_pairs converts pairs back to cUSDC)

vault_mint_pairs, vault_redeem_pairs, and vault_redeem_single are CLP-PDA-signed CPIs into mint-redeem - the CLP can convert between cUSDC and paired inventory without touching solvency (paired mint/redeem is neutral by construction).

Collateral is a single unified vault, but each market is isolated by its own total_collateral − deployed_to_yield ledger — every outflow is gated on that per-market liquid share. A cross-market rebalancer moves only excess above a source market’s own dynamic buffer target (a scalar ledger move, no token transfer), with the floor enforced on-chain (rebalance_collateral on mint-redeem).

Where protocol revenue accumulates

• Trading-spread profits accumulate in CLP custody as the books buy low and sell high around NAV. They reach the collateral vault via donate_to_vault.
• Mint/redeem fees: 90% of every fee stays in the market’s collateral vault directly; 10% is the dev tax.
• Harvested collateral yield lands in the treasury vault and reaches the collateral ratio via the same donate path.

See Solvency for how these channels fill the overcollateralization buffer.

Reading pool state

const [poolPDA] = web3.PublicKey.findProgramAddressSync(
  [Buffer.from("pool"), marketPDA.toBuffer(), Buffer.from([side])], // side: 0 = long, 1 = short
  clpProgram.programId,
);
const pool = await clpProgram.account.pool.fetch(poolPDA);
console.log("Base price:", pool.basePrice1e6.toString());
console.log("Bins:", pool.numBins, "core step:", pool.stepBps, "wing step:", pool.wingStepBps);

The frontend’s /pools page renders this directly: per-leg pool price, deviation-vs-NAV badge, instant depth, and the per-market spread.

Engineering note: the CLP’s larger account structs are Boxed - the SVM’s 4 KB stack frame can’t hold them inline. If you fork or extend the program, keep new context structs boxed too.

Read more

CLP program reference

All instructions, account fields, errors.

Keeper

The spread engine and book-management loop behind set_pool_shape.

Solvency

Why lean books and depth caps are a solvency defense, not a limitation.

Trading flows

Choosing a venue and executing trades end to end.