> ## Documentation Index
> Fetch the complete documentation index at: https://continuum-ec12e897.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# CLP - Continuous Liquidity Provider
> The on-chain program that hosts Continuum's three trading venues and the vaults that provision them.
The **CLP** (Continuous Liquidity Provider) is the on-chain program where all trading happens. It hosts the three venues - native CLMM books, committed orders, and the instant oracle swap - plus the per-market vaults that stock them with inventory.
End users interact with the CLP every time they trade a leg. Inventory and treasury operations (funding books, sweeping excess, minting pairs into vaults) are keeper- or admin-gated.
## Venue 1: native CLMM books
Each market has one `Pool` account **per side** (PDA seeds `[b"pool", market, side]`), so 8 pools across the 4 live markets. Unlike an external AMM:
* **Bins are inline.** Up to 16 price bins live directly in the `Pool` account - no separate bin-array accounts, no rent churn on reposition.
* **2-zone geometry.** Fine core steps near NAV for tight small-trade pricing, wide wings further out (e.g. QQQ: 20 bps core steps ×3, then 300 bps wings). Set via `configure_pool_geom(wing_step_bps, core_bins)`.
* **Keeper-pinned to NAV.** `set_pool_shape(base_price, asks, bids)` posts the book base and per-bin sizes in one call (sums are checked against vault balances). The keeper re-pins when pool price drifts past a per-market gate - 20 bps for QQQ/SPY/XAU, 40 bps for VXX, calibrated just below each market's toxic-arb line.
`pool_swap(direction, amount_in, min_out)` walks the bins with real slippage. It is pure inventory trading - no mint or burn happens in the swap.
### Lean by design
Book depth is sized to **demand, never to TVL**:
* Toxic-arb loss scales with deployed depth, while organic revenue is demand-capped - so more depth past demand is pure downside.
* Deployed **synth** has zero yield opportunity cost (the collateral backing the pair earns wherever the tokens sit). Deployed **bid cUSDC** idles, forgoing \~5.5% APR - so bids are capped at \~\$5k per side, with excess swept to the CLP vault where it provisions committed orders.
* Asks trim to ≤1.5× bids via `pool_sweep_synth`.
The keeper's refill loop is bidirectional: drained asks restock by sweeping bids, minting pairs via `vault_mint_pairs`, and funding both sides delta-neutral; bloated sides trim back. Large sells don't need standing bids at all - they route through committed orders, and the keeper provisions cUSDC at settle time via `vault_redeem_pairs`.
## Venue 2: committed orders
The large-order path - three instructions and one account:
```
commit_swap(direction, amount_in, min_out)
→ escrows input into an Order PDA (TTL 180 s)
settle_swap(order) ── permissionless
→ fills at NAV ± 10 bps using the FIRST oracle print
strictly after the commit; min_out miss → full refund
cancel_swap(order) ── after TTL
→ unconditional refund; checks nothing else
```
Key properties:
* **No size cap.** Because the fill price is set after the commitment, latency arbitrage is impossible by construction. Bounds are oracle health, the collateral floor, and keeper-provisioned inventory.
* **Thin spread.** `COMMIT_SPREAD_BPS = 10` - thinner than the instant venues because the post-commit price carries zero adverse selection.
* **Always recoverable.** `cancel_swap` after the 180 s TTL (`COMMIT_TTL_SECS`) refunds regardless of oracle, keeper, or admin state. Every terminal path - settle, refund, cancel - closes the Order account and returns rent.
* **Permissionless settlement.** Anyone can call `settle_swap`; the keeper cranks it at a 20 s cadence (5 s while orders are pending), typically 12-25 s end to end.
The `Order` account layout anchors `getProgramAccounts` filters: `user` at offset 8, `market` at 40, `status` at 74.
Mainnet prerequisite: `settle_swap` currently prices off the keeper-relayed TWAP. Mainnet requires reading Pyth directly with `publish_time > order.created_at`.
## Venue 3: instant oracle swap
`clp_swap` fills instantly from pre-stocked CLP inventory at NAV ± 30 bps. It predates the books and is retained for small instant trades, behind defense-in-depth guards:
* Oracle-health breakers: 60 s staleness, confidence ceiling, 25% deviation cap.
* A rolling notional window cap.
* A collateral floor check on the market vault.
Committed orders bypass this venue entirely and do not consume its window.
## Vaults and capital flow
```
Admin / fees / yield
▼
Per-market CLP vault (cUSDC)
│ vault_mint_pairs → CLP-PDA-signed CPI into mint-redeem;
▼ paired L+S land in CLP custody
CLP inventory (L + S + cUSDC)
│ clp_fund_pool_synth / → stock the per-side books
│ set_pool_shape
▼
CLMM books ◄──── pool_sweep_usdc / pool_sweep_synth ──── excess back to vault
│
└─ committed orders provision from the vault at settle time
(vault_redeem_pairs converts pairs back to cUSDC)
```
`vault_mint_pairs`, `vault_redeem_pairs`, and `vault_redeem_single` are CLP-PDA-signed CPIs into mint-redeem - the CLP can convert between cUSDC and paired inventory without touching solvency (paired mint/redeem is neutral by construction).
Collateral is a single unified vault, but each market is isolated by its own `total_collateral − deployed_to_yield` ledger — every outflow is gated on that per-market liquid share. A cross-market rebalancer moves only excess above a source market's own dynamic buffer target (a scalar ledger move, no token transfer), with the floor enforced on-chain (`rebalance_collateral` on mint-redeem).
## Where protocol revenue accumulates
* **Trading-spread profits** accumulate in CLP custody as the books buy low and sell high around NAV. They reach the collateral vault via `donate_to_vault`.
* **Mint/redeem fees**: 90% of every fee stays in the market's collateral vault directly; 10% is the dev tax.
* **Harvested collateral yield** lands in the treasury vault and reaches the collateral ratio via the same donate path.
See [Solvency](/concepts/solvency) for how these channels fill the overcollateralization buffer.
## Reading pool state
```typescript theme={null}
const [poolPDA] = web3.PublicKey.findProgramAddressSync(
[Buffer.from("pool"), marketPDA.toBuffer(), Buffer.from([side])], // side: 0 = long, 1 = short
clpProgram.programId,
);
const pool = await clpProgram.account.pool.fetch(poolPDA);
console.log("Base price:", pool.basePrice1e6.toString());
console.log("Bins:", pool.numBins, "core step:", pool.stepBps, "wing step:", pool.wingStepBps);
```
The frontend's [/pools](https://continuum.markets/pools) page renders this directly: per-leg pool price, deviation-vs-NAV badge, instant depth, and the per-market spread.
Engineering note: the CLP's larger account structs are `Box`ed - the SVM's 4 KB stack frame can't hold them inline. If you fork or extend the program, keep new context structs boxed too.
## Read more
All instructions, account fields, errors.
The spread engine and book-management loop behind set\_pool\_shape.
Why lean books and depth caps are a solvency defense, not a limitation.
Choosing a venue and executing trades end to end.