clp

Continuous Liquidity Provider. The protocol’s cUSDC vaults, the native bin books and committed orders.

The CLP program holds the protocol’s market-making capital and runs both trading venues: committed orders, which fill at the next price push while a market is open, and native bin books, which fill instantly while its price is stale. It also mints and redeems its own L+S inventory through CPI into mint-redeem. A single GlobalClp PDA tracks funding and per-market allocations, and its cUSDC vault is the protocol treasury. Each market has a Clp PDA with its inventory, swap guards and committed-order spread, plus two Pool PDAs, one bin book per side.

Devnet ID: 8xauDRjw9XRyk4FE3hW1JKjD8nC87gfr59Xig1dJqLES

Anyone can call pool_swap and commit_swap, anyone can send cancel_swap once an order has expired, and anyone can send claim for a held order. Only the keeper can send settle_swap. clp_swap is retired and always fails. The sections below give the signer every other instruction requires, usually global_clp.authority, the market’s clp.authority or the pool’s pool.authority.

The two venues

Venue	Instructions	When	Price	Fee
Committed order	commit_swap, then settle_swap	While the market’s price is live	NAV ± max(commit_spread_bps, 10) bps at a price push after the commit	The spread
Bin book (instant)	pool_swap	Only while the market’s price is stale	Walks the keeper’s posted bins out from the book centre, with real slippage	None; you pay the bin spread

A committed order fills at a price pushed after the commit, so the trader never trades against a quote seen before committing. Since 11 Oct 2026 committed orders are on for every live market and are the protocol’s only venue while its price is live. pool_swap fills only while the market floats (its risk state isn’t Normal and its last push is more than 300 s old) and fails with PoolClosedWhileLive otherwise. The keeper sizes the bin books to expected demand. The instant oracle swap, clp_swap, was retired the same day. See SwapGuardsState below.

Exposure cap

Clp.oi_cap bounds traders’ net position in the market, in cUSDC atoms. 0 means uncapped. The protocol is the counterparty to whatever traders hold net, so the cap bounds what a one-sided move can cost the treasury. Exposure cap explains the reasoning and the nightly sizing.

Traders’ net position E is measured at NAV from on-chain balances:

E = (L supply − CLP-held L) · l_nav − (S supply − CLP-held S) · s_nav

CLP-held for a leg is the balance of the pool’s synth vault for that leg plus the CLP’s own token account for it. E above 0 means traders are net long and the treasury is net short. A paired mint splits the deposit by value between the two legs, so it never moves E. A committed buy of L, a book buy of L and a committed sell of S back to the CLP all raise E. The reverse trades lower it. Redemptions burn a balanced pair, so they move E by less than $1.

A change ΔE is allowed when the cap is 0 or when E + ΔE stays inside [min(−cap, E), max(cap, E)]. Nobody can push E further past the cap than it already is, and a trade that shrinks it always passes, even when a price move has carried E past the cap with no trade at all.

The program reads the inventory from four accounts pinned by address, so a caller cannot understate the CLP’s holdings with a look-alike account. In order, they are the pool long synth vault, the pool short synth vault, the CLP’s long token account and the CLP’s short token account. An account that was never created counts as empty. A wrong address, owner or mint fails with ExposureAccountMismatch (6061) in mint-redeem. The measurement lives in mint-redeem’s exposure module, which the CLP calls.

Path	Accounts to pass	Over the cap
settle_swap	The four inventory accounts, when oi_cap > 0	Fills up to the room left and refunds the rest. Under $1 of room refunds the whole order
pool_swap (also through the trading program’s swap_pool)	The four inventory accounts, when oi_cap > 0	Reverts with ExposureCapExceeded (6045)
redeem_paired, request_redemption	None. Since 14 Oct 2026 they burn a balanced pair, so E moves by less than $1	Not capped. The guard is still in the code (mint-redeem 6060)

commit_swap is not checked, because nothing has moved yet: the cap applies when the order settles. A redemption signed by the market’s own CLP (vault_redeem_pairs) isn’t checked either, because burning CLP-held tokens lowers a supply and the CLP’s holding of it together, so E doesn’t move. Trades on the P2P order book are unaffected by the cap.

Accounts

GlobalClp PDA

seeds = [b"global_clp"]

One per cluster (BcGR8kuGCiMhwonyztXZHEZtjJXxXVRgjwbn58bUfXtw on devnet). The global vault is this PDA’s cUSDC associated token account (5GSTKN4u5LfropcnQQoqFht48JMaF1SzZzBcgDNL5VKy on devnet), and it is the protocol treasury. It held about 22.13M cUSDC after the keeper’s returns of 11 Oct 2026 and 36.1M on 13 Oct 2026, as the devnet keeper burns it down. The 22.13M was: 5,534,820.82 from funding, plus idle CLP cash that the keeper returned to it, 12.99M on the first pass and 3.6M more once the instant swap was retired. See Treasury.

Field	Type	Purpose
total_deposits	u64	Principal added by admin_fund, net of admin_withdraw. Sets the deposit_profit tax tier
last_admin_fund_at	u64	Unix time of the last admin_fund. Informational
total_fees_accumulated	u64	Net deposit_profit plus recorded recall fees
market_allocations	Vec<MarketAllocation>	cUSDC allocated per market (market_id, allocated_usdc); at most 10 entries
protocol_buffer	ProtocolBuffer	Yield accumulated, losses absorbed, balance, target (1,000 bps) and an above-target flag
liquidity_seed_threshold	u64	Idle balance below which the keeper doesn’t allocate (1,000 cUSDC on devnet)
authority	Pubkey	Global admin signer
admin_wallet	Pubkey	Owner of the account that receives the deposit_profit tax
bump	u8	PDA bump

allocate_to_market adds a market_allocations entry the first time it funds a market. The table is informational and holds 10 entries, fewer than the markets, so it never blocks a move. Once it is full, a market without an entry takes over one whose allocation has been fully returned. If there is none, the move still goes ahead, and the market’s own allocated_from_global is the only record. Until the upgrade of 11 Oct 2026, funding an 11th market failed with MaxDeploymentsExceeded. As of 11 Oct 2026, five entries exist: QQQ, SPY, XAU, MSTR (closed on 12 Oct 2026, its allocation fully returned) and the delisted VXX market.

Clp PDA

seeds = [b"clp", market]

One per market. Its operating vault (clp_vault) is this PDA’s cUSDC associated token account. Fields in account order:

Field	Type	Purpose
market_id	Pubkey	Bound Market PDA
total_fees_collected	u64	Fees moved in by collect_fees
oi_cap / current_oi	u64	oi_cap is the exposure cap in cUSDC atoms, 0 meaning uncapped. It bounds traders’ net position on committed fills, pool_swap fills (see Exposure cap). The keeper posts it from the nightly job. current_oi is a legacy mirror that nothing maintains and reads 0
bump	u8	PDA bump
inventory_budget	InventoryBudget	Soft and hard bounds on the volatile share q, plus drawdown limits
inventory_state	InventoryState	Current q, drawdown, breach flags and peak value
yield_strategy	YieldStrategyConfig	Per-state deployment shares and reserves; off by default
oracle_config	Pubkey	The market’s OracleConfig
deployment_count / yield_deployments / total_deployed	u8 / Vec<YieldDeployment> (max 3) / u64	Yield bookkeeping
authority	Pubkey	Signer for this market’s CLP instructions
vault_l_deployed / vault_s_deployed	u64	L and S outstanding from CLP minting
total_vault_pairs_minted	u64	Lifetime cUSDC spent by vault_mint_pairs
retired_venue_state	[u8; 136]	Reserved bytes from a retired venue. Nothing reads or writes them, and every later offset is unchanged
allocated_from_global	u64	cUSDC allocated from the global vault
swap_guards	SwapGuardsState	Guards for committed orders (below)
swap_window_start / swap_window_used	i64 / u64	Rolling notional-cap window for pool_swap
swap_prev_price	u64	Price of the last committed fill (the deviation anchor)
commit_spread_bps	u16	Committed-order half-spread posted by the keeper

SwapGuardsState

Stored in Clp.swap_guards and set with configure_swap. The all-zero default leaves committed orders off. settle_swap applies the staleness, confidence and deviation limits and the collateral floor.

Field	Type	Purpose
enabled	bool	Required by commit_swap (SwapDisabled). pool_swap ignores it
frozen	bool	Blocks commit_swap and settle_swap (SwapFrozen). pool_swap and cancel_swap ignore it
spread_bps	u16	Spread of the retired clp_swap. No live instruction reads it
max_staleness_secs	i64	Maximum age of the Market price, in seconds (OracleStale)
max_confidence_bps	u16	Maximum Market.oracle_confidence, in bps of price (OracleConfidenceTooWide)
max_deviation_bps	u16	Maximum move from swap_prev_price, in bps (OracleDeviationTooLarge)
window_cap_usd	u64	cUSDC notional allowed per window on pool_swap; 0 means no cap. Committed fills don’t count
window_secs	i64	Window length
collateral_floor_bps	u16	Minimum market collateral ratio, at the settle price, for a committed fill

Since 11 Oct 2026, all 13 live markets have guards enabled and not frozen, with the same limits: a 600 s staleness limit, a 5,000 bps confidence limit (off in practice), a 10,000 bps deviation limit (off; update_risk_state_v2 already refuses a move of more than 25% per push) and a 10,000 bps (100%) collateral floor. Their spread and window cap were left as they were: QQQ, SPY and XAU keep a 30 bps spread and a cap of 1,000,000 cUSDC per hour, and the other markets have no cap.

Pool PDA

seeds = [b"pool", market, [side]]    // side: 0 = long, 1 = short

Two per market, so 26 for the 13 live markets. Each is a native bin book for one synth leg against cUSDC. The whole book lives in the account (up to 16 bins a side, POOL_MAX_BINS), so bins cost no extra rent. The pool PDA’s two associated token accounts hold the reserves: synth for the asks and cUSDC for the bids.

Field	Type	Purpose
authority	Pubkey	Signer for set_pool_shape, configure_pool_geom and realloc_pool
market / side	Pubkey / u8	Binding
synth_mint / usdc_mint	Pubkey	Pair mints
base_price_1e6	u64	Book centre (1e6). The keeper sets it from NAV, shifted for its inventory
step_bps	u32	Core bin step (r = 1 + step_bps/1e4)
num_bins	u8	Bins per side (at most 16)
asks	[u64; 16]	Synth reserve per ask bin, above the centre
bids	[u64; 16]	cUSDC reserve per bid bin, below the centre
enabled / frozen	bool	pool_swap needs enabled and not frozen. The first set_pool_shape sets enabled; no instruction clears it or sets frozen
shape_updated_at	i64	Unix time of the last reposition
bump	u8	PDA bump
wing_step_bps	u32	Wing step for the 2-zone geometry (0 = uniform ladder)
core_bins	u8	Number of fine core bins before the wings start

There is no pool kill switch. Once a pool has a shape, nothing can disable it, though it fills only while its market floats (see pool_swap below).

Bin geometry. Ask bin i sits at base · r^(i+1) and bid bin i at base · r^-(i+1). The centre itself is an empty mid, so the smallest round trip costs about two steps. With 2-zone geometry, the first core_bins steps use step_bps for fine pricing near the centre. The rest use wing_step_bps, so the same 16 bins can span a large move.

Order PDA (committed orders)

order:  seeds = [b"order", user, market, nonce_le_u64]
escrow: seeds = [b"escrow", order]      // token account owned by the order PDA

Each order records what the user escrowed and when, and the fill uses a price pushed after created_at. The account is 213 bytes, with every field at a fixed offset. Orders committed before the CLP-5 upgrade are 117 bytes, have no recorded accounts and still work.

Field	Offset	Type	Purpose
user	8	Pubkey	Order owner
market	40	Pubkey	Bound market
side	72	u8	0 = long, 1 = short
direction	73	u8	0 = buy synth, 1 = sell synth
status	74	u8	0 = pending, 1 = held (tokens wait for claim)
bump / escrow_bump	75 / 76	u8	PDA bumps
amount_in	77	u64	Escrowed base units (cUSDC for buys, synth for sells)
min_out	85	u64	Slippage floor; a miss at settle refunds instead of reverting
created_at	93	i64	Commit time; settle needs twap_updated_at > created_at
expires_at	101	i64	created_at + 180; settle owns ≤, cancel owns >
nonce	109	u64	Client-chosen seed
user_out	117	Pubkey	The payout account given at commit. Settle pays only here, or into the claim account when this one can’t receive
user_in	149	Pubkey	The source account given at commit, where refunds and leftovers go
claim_payer	181	Pubkey	Who paid the claim account’s rent (the settling keeper) and gets it back at claim; default while no claim account exists

A client can find a wallet’s orders with getProgramAccounts memcmp filters on user (offset 8) or market (offset 40). The keeper finds every pending order in one call, filtered on the Order discriminator and status = 0 at offset 74, over both sizes (117 and 213 bytes). Every terminal path (fill, refund, cancel) empties the escrow, closes both the order and the escrow, and returns all rent to the user, so a second settle attempt fails at account load. The exception is a held order (status 1), which stays open until claim. Since 13 Oct 2026, tokens anyone sends to an escrow after the commit go back to the owner with the rest, so they can’t stop it closing.

TreasuryPolicy PDA

seeds = [b"treasury_policy"]

One per cluster (58JeHAcMAAyEZWusVqmvoFNVqh37cTkmfbbP6bMHExWR on devnet, 210 bytes). It holds the limits on admin_withdraw and treasury_lend and is created by init_treasury_policy. It replaced the AdminWithdrawWindow account, which the upgrade of 11 Oct 2026 removed.

Field	Type	Purpose
guardian	Pubkey	Freeze-only key. It can freeze and unfreeze withdrawals, cancel a pending change and hand its role to a new key. It can’t move funds
destination	Pubkey	The only token account admin_withdraw pays
rate_per_sec	u64	Allowance refill rate, in cUSDC base units per second
burst	u64	Most the allowance can hold, so the largest single withdrawal
delay_secs	i64	Wait before a loosening can apply; at most 30 days
allowance	u64	Withdrawable amount as of last_accrual_at
last_accrual_at	i64	When allowance was last refilled
frozen	bool	Blocks admin_withdraw and treasury_lend. treasury_recall still works
pending_rate_per_sec, pending_burst, pending_delay_secs, pending_destination, pending_guardian	u64, u64, i64, Pubkey, Pubkey	A proposed loosening that is waiting out its delay
pending_at	i64	When the pending change can apply; 0 if none
bump	u8	PDA bump

The program refills allowance only when an instruction touches the policy. To read what can be withdrawn now, compute min(burst, allowance + rate_per_sec × (now − last_accrual_at)).

The live policy as read on 13 Oct 2026:

• Rate: 256.78 cUSDC per second, about 924,403 cUSDC an hour. The keeper keeps the rate in proportion to the balance so that the whole treasury can leave in about 24 h; see Keeper → Treasury withdrawal rate. The earlier rate was 64.06 cUSDC per second.
• Burst: 924,402.61 cUSDC, one hour of refill.
• Delay: 24 h.
• Pending: a rate and a burst of 1,000,000,000 cUSDC (in effect no limit), due at 04:29 UTC on 14 Oct 2026. It stays pending until then; read TreasuryPolicy for the values in force.

TreasuryYield PDA

seeds = [b"treasury_yield"]

One per cluster (6YrCADSTyTJPNrVhrZz5S2wTzBQSPM5fGUrGSpLTBJgY on devnet, 73 bytes), created by init_treasury_yield on 12 Oct 2026. It records the treasury cUSDC that is out at lending venues.

Field	Type	Purpose
by_venue	[u64; 5]	Principal out at each venue, by YieldProtocol index: 0 Kamino, 1 MarginFi, 2 Other, 3 Solend, 4 JupiterLend
principal	u64	Sum of by_venue
interest	u64	Interest returned to the treasury, all time
updated_at	i64	Time of the last lend or recall
bump	u8	PDA bump

Devnet has no lending venues, so its ledger stays at zero. A 1 cUSDC lend and recall on 12 Oct 2026 tested the instructions and left it there.

RevenueAttribution PDA

seeds = [b"revenue_attribution"]

One per cluster (A8mK2pnagabEcnkSiWieEZyQjjNWFYm1Z91dUVMXe6a4 on devnet). It splits protocol revenue into keeper flow and external flow. deposit_profit takes it as its last account, and pool_swap takes it just before the market. Amounts are cUSDC base units.

Field	Type	Purpose
fees_external	u64	Spread captured on pool_swap fills by signers that aren’t keeper keys
fees_keeper	u64	Spread captured on keeper-signed pool_swap fills, plus net deposit_profit and recorded recall fees
volume_external / volume_keeper	u64	cUSDC notional of pool_swap fills, split the same way
deposit_by_source	[u64; 4]	Net deposit_profit by source tag
started_at	i64	When counting began
keeper_authorities	[Pubkey; 4]	Signers counted as keeper flow, in addition to clp.authority. Default pubkeys are empty slots
bump	u8	PDA bump
reserved	[u8; 64]	Spare space for future counters

A fill’s spread capture is its distance from the book centre: cUSDC paid minus synth × base_price_1e6 on a buy, and synth × base_price_1e6 minus cUSDC received on a sell.

Instructions

Swaps

pool_swap(params: PoolSwapParams) (anyone)

PoolSwapParams { direction: u8, amount_in: u64, min_out: u64 }. Direction 0 buys synth with cUSDC, and 1 sells synth for cUSDC. A buy walks the ask bins up from base·r; a sell walks the bid bins down from base/r. The handler decrements reserves in place, so the stored book always matches the vault balances, and partial bin fills round in the pool’s favour. If the book runs out first, the swap fills what it can and takes only what it used. There is no swap fee.

The pool must be enabled and not frozen (SwapDisabled), and base_price_1e6 must be nonzero (OracleStale). The market must be floating: its risk_state isn’t Normal and its twap_updated_at is more than 300 s old, the age at which mint and redeem freeze (PoolClosedWhileLive otherwise). The book must have been posted after the float began: pool.shape_updated_at must be more than 300 s after twap_updated_at, else PoolShapePredatesFloat. Something must fill (InsufficientFunds), the output must reach min_out (SlippageExceeded), and the fill must fit the Clp window cap (WindowCapExceeded). pool_swap doesn’t read swap_guards.enabled, frozen or the oracle guards: it trades on the book as posted. Off-hours the keeper keeps a demand-sized free-float book, with a guard that can only pull bins on the stale side. Until 11 Oct 2026 the books traded at any hour.

Accounts, in order:

#	Account	Notes
0	user	Signer
1	user_usdc	User’s cUSDC token account
2	user_synth	User’s token account for the pool’s synth mint
3	pool	Pool PDA
4	clp	PDA [b"clp", pool.market]; holds the window cap
5	synth_vault	The pool’s synth ATA
6	usdc_vault	The pool’s cUSDC ATA
7	token_program	SPL Token
8	revenue_attribution	PDA [b"revenue_attribution"]
9	market	The pool’s mint-redeem Market PDA, read for its risk state and price age; must be last. Added on 11 Oct 2026

The pool PDA signs the outbound transfer. Each fill updates RevenueAttribution and emits SwapExecuted with route 1.

Remaining accounts, needed only when the market is capped (clp.oi_cap > 0): the pool long synth vault, the pool short synth vault, the CLP’s long token account and the CLP’s short token account, in that order. They are the inventory accounts the cap measures. A fill that would push traders’ net position past the cap reverts with ExposureCapExceeded (6045), and a capped market called without them fails with ExposureAccountsMissing (6046). An uncapped market ignores them. Unlike a committed order, a book fill is never cut to the room left: it fills whole or reverts.

clp_swap(side: u8, direction: u8, amount_in: u64, min_out: u64) (retired)

Retired on 11 Oct 2026. It was the instant swap against CLP inventory at NAV ± swap_guards.spread_bps, with NAV from Market.user_twap_price. The instruction keeps its accounts (user, user_usdc, user_synth, clp, clp_vault, clp_synth, market, token_program) and arguments, so existing clients still decode it, but every call fails with SwapDisabled. Use a committed order instead. Its fills emitted SwapExecuted with route 0.

commit_swap(side: u8, direction: u8, amount_in: u64, min_out: u64, nonce: u64) (anyone)

Opens a committed order. It escrows amount_in (cUSDC for buys, synth for sells) and sets expires_at = now + 180. The user pays rent for the order and escrow accounts and gets it back on every terminal path. The payout account (user_out) must already exist, so settlement can’t stall on it. It checks market.is_active (MarketInactive), swap_guards.enabled (SwapDisabled) and frozen (SwapFrozen). Accounts: user, market, clp, order, in_mint, escrow, user_in, user_out, clp_vault, token_program, system_program. Emits OrderCommitted.

settle_swap() (clp.authority or market.keeper_authority)

Fills a pending order at NAV ± max(clp.commit_spread_bps, 10) bps, with NAV from Market.user_twap_price at settle time. Any other signer fails with SettleKeeperOnly (6047). The keeper settles at the first push it sees after the commit, so the owner can’t pick the price. It requires:

• now ≤ expires_at, else OrderExpired.
• market.twap_updated_at > order.created_at, else NoFreshOraclePush. Any push after the commit qualifies, not only the first.
• The oracle guards: not frozen, a price no older than max_staleness_secs, and confidence and deviation within limits.

It doesn’t recheck swap_guards.enabled. Since 13 Oct 2026 a paused market (market.is_active false) refunds the order before any price check, so a pause stops fills at once.

Condition	Result
Market paused (market.is_active false)	Full refund. The accounts close and OrderRefunded is emitted
An oracle guard fails	Revert (SwapFrozen, OracleStale, OracleConfidenceTooWide or OracleDeviationTooLarge). The order stays pending and can fill at a later push
Quote at or above min_out, and the exposure cap has room for all of it	Fill: amount_in to the CLP, payout to the user, anything else in the escrow back to the user, accounts close. Emits OrderSettled and SwapExecuted (route 2)
The exposure cap has room for only part of it (at least $1)	Partial fill: the part that fits is filled and OrderSettled reports that part as amount_in. The rest goes back to the user with the escrow, min_out is scaled to the filled share, and OrderCapped is emitted. The log line starts settle_swap PARTIAL
The exposure cap has under $1 of room	Full refund, logged as settle_swap REFUND exposure cap. The accounts close and OrderRefunded is emitted
Quote below min_out	Full refund instead of a revert, so a runaway price can’t leave the order retrying until expiry. The accounts close and OrderRefunded is emitted
Market below collateral_floor_bps at the settle price	Revert (CollateralFloorBreach). The order stays pending and can fill at a later push once the market is topped up
CLP inventory short	Revert. The order stays pending while the keeper adds inventory and retries
The payout or refund can’t be delivered (the recorded account is closed, re-owned, frozen or the wrong mint)	The settle succeeds and the order is held: the payout goes to the claim account, the refund stays in the escrow, the status becomes 1 and OrderHeld is emitted. The log line is settle_swap HELD for claim. claim pays the owner

The collateral floor is checked only on the fill path. A fill updates swap_prev_price but doesn’t count toward the window cap. Accounts, in order:

#	Account	Notes
0	cranker	Signer, writable. clp.authority or market.keeper_authority
1	user	order.user; receives the rent
2	order	The Order PDA
3	escrow	The order’s escrow token account
4	clp	The market’s Clp PDA
5	clp_vault	The CLP’s cUSDC account
6	clp_synth	The CLP’s account for the leg
7	market	The mint-redeem Market
8	user_out	The payout account. For a 213-byte order, the one recorded at commit
9	user_in	The refund account. For a 213-byte order, the one recorded at commit
10	token_program	SPL Token
11	claim	PDA [b"claim", order]; holds the payout of a held order
12	out_mint	The payout mint
13	system_program

The inventory accounts come after these. They are needed only when the market is capped: the pool long synth vault, the pool short synth vault, the CLP’s long token account and the CLP’s short token account. The keeper passes them on every settle. A capped market settled without them fails with ExposureAccountsMissing (6046), and the order stays pending until the keeper settles it with them. An uncapped market ignores them, as did the program before the upgrade, so passing them is always safe.

A partial fill is the CLP’s check against the room left, measured at the settle price: the largest input whose value fits the room, with the spread included on a buy. A min_out that the partial fill misses is an ordinary refund. A settle always empties the escrow, so nothing is stranded.

The keeper posts commit_spread_bps with set_commit_spread, as clamp(half-spread, 10, 500) from its volatility model, and re-posts it whenever it moves by 2 bps or more. As of 10 Oct 2026 it is 18 bps on QQQ, 15 on SPY and 18 on XAU.

claim() (anyone)

Pays a held order’s owner. It is permissionless, like cancel_swap, and every token goes to an account owned by order.user, so a caller can’t redirect anything. It returns the claim’s payout to the owner’s account for that mint, any refund in the escrow to the owner’s account for the escrowed mint, the escrow and order rent to the owner, and the claim account’s rent to claim_payer, the keeper that fronted it. The keeper cranks it and creates the owner’s associated token account first. Fails with OrderNotClaimable (6049) when nothing is held, and ClaimDestinationInvalid (6050) when a destination isn’t a live, unfrozen account of the owner for its mint. Emits OrderClaimed. Accounts: user, order, escrow, claim, claim_payer, refund_to, payout_to, token_program.

cancel_swap() (anyone, after expiry)

Refunds an expired order once now > expires_at (else OrderNotExpired). Settle owns now ≤ expires_at, so there is no gap or overlap, and before expiry nobody can cancel. Since 11 Oct 2026 anyone may send it: user must be the order’s owner but doesn’t sign, and the escrow can go only to user_in, a token account the owner holds for the escrowed mint (SwapAccountMismatch). For a 213-byte order, user_in must be the account recorded at commit. If that account can’t receive the refund, the cancel still succeeds, the funds wait in the escrow and the order is held for claim. Nothing else is checked (no frozen, enabled, oracle or market-active gate), so escrowed funds can always be recovered after the 180 s TTL. Returns the escrow’s whole balance and all rent to the owner and emits OrderCancelled. The keeper sends it for every expired order about 5 s after expiry. Accounts: user, order, escrow, user_in, token_program.

Bin book management

init_pool(side: u8, step_bps: u32, num_bins: u8) (global_clp.authority)

Creates the Pool PDA, and the signer becomes pool.authority. step_bps must be in (0, 1000] and num_bins in [1, 16]. The pool starts disabled with an empty book.

set_pool_shape(base_price_1e6: u64, asks: Vec<u64>, bids: Vec<u64>) (pool.authority)

The reposition. It sets the centre and every bin’s reserve in one call, and sets enabled = true. Each vector must have exactly num_bins entries and sum to no more than the matching vault balance. The keeper centres the book on NAV shifted for its inventory, with a skewed shape.

configure_pool_geom(wing_step_bps: u32, core_bins: u8) (pool.authority)

Sets the 2-zone geometry. A nonzero wing_step_bps must be at least step_bps, and core_bins at most num_bins. wing_step_bps = 0 restores the uniform ladder.

realloc_pool() (pool.authority)

Grows a pool created before the 2-zone fields existed. The new fields start at 0, which reads as the uniform ladder.

pool_sweep_usdc(amount: u64) / pool_sweep_synth(amount: u64) (clp.authority)

Move cUSDC out of a pool’s bid vault, or synth out of its ask vault, back to the CLP. One-way buying turns ask inventory into cUSDC that collects in the pool; the sweep recycles it through vault_mint_pairs into fresh L+S. The synth sweep trims ask depth far beyond the bid side, and the trimmed synth supplies committed orders instead.

clp_fund_pool_synth(amount: u64) (clp.authority)

Moves synth from the CLP’s L or S account into a pool’s ask vault, the refill step after vault_mint_pairs. No counters change; the next set_pool_shape places the tokens in bins.

clp_fund_pool_usdc(amount: u64) (clp.authority)

Moves cUSDC from the market’s CLP vault into a pool’s bid vault: the bid-side refill. Sell flow spends a book’s bid cUSDC. pool_sweep_synth takes back the synth the book bought, and this puts the cUSDC back. The source must be the CLP’s own vault, the destination must be the pool’s cUSDC vault, and the pool must belong to the CLP’s market (SwapAccountMismatch). No counters change; the next set_pool_shape places the cUSDC in bins. Added 11 Oct 2026.

Inventory minting (clp.authority)

The CLP mints and redeems through CPI into mint-redeem, signing as the Clp PDA.

• vault_mint_pairs(usdc_amount: u64) calls mint_paired with cUSDC from the market’s CLP vault. The L+S land in the PDA’s token accounts, and vault_l_deployed/vault_s_deployed grow by the amounts actually minted.
• vault_redeem_pairs(l_amount: u64, s_amount: u64) burns L+S held by the PDA and returns cUSDC to its vault.
• vault_redeem_single(is_long: bool, token_amount: u64) redeems one leg at NAV through mint-redeem’s redeem_single_for_vault, which refuses to leave the market below 100% collateral.
• clp_burn_excess(is_long: bool, amount: u64) burns leftover L or S without any payout, through permissionless_burn.

The three vault instructions take 15 accounts. The upgrade of 11 Oct 2026 dropped the trailing collateral_authority account, and callers that still send 16 keep working because the extra account is ignored. Each one checks where tokens can go:

• market must be this CLP’s own market (MarketMismatch).
• clp_vault must be owned by the Clp PDA and hold the market’s collateral mint (InvalidVault).
• clp_long_account and clp_short_account must be owned by the Clp PDA and hold the market’s L and S mints (InvalidVault).

Capital flow

initialize_global_clp(liquidity_seed_threshold: u64)

One-time setup of GlobalClp. The signer becomes authority, the admin_wallet account is recorded, and the buffer target is set to 1,000 bps. It doesn’t create the global vault token account.

admin_fund(amount: u64) (global_clp.authority)

Moves cUSDC from the admin into the global vault, adds it to total_deposits and stamps last_admin_fund_at.

allocate_to_market(amount: u64) / return_to_global(amount: u64) (global_clp.authority)

Move cUSDC between the global vault and a market’s CLP vault, updating allocated_from_global and market_allocations. allocate_to_market refuses while the treasury is frozen, and takes treasury_policy as its last account. They move only between those two accounts. The global vault must be owned by the GlobalClp PDA, and the CLP vault must be owned by this market’s Clp PDA and hold the same mint (InvalidVault).

deposit_profit(params: DepositProfitParams) (global_clp.authority or a registered keeper)

DepositProfitParams { amount: u64, source: u8 }. Since 13 Oct 2026 the keeper signer must be global_clp.authority or a wallet in RevenueAttribution.keeper_authorities (else Unauthorized). Moves amount of cUSDC out of keeper_source, a token account the keeper signer controls. A tiered tax goes to admin_token_account, which must be owned by admin_wallet. The rest goes to the global vault and total_fees_accumulated. The tier follows total_deposits: 15% below $5M, 10% up to $25M and 5% above. The net amount counts as keeper flow in RevenueAttribution, under deposit_by_source[source] (0 arb, 1 recycled LP fees, 2 yield harvest, 3 other; unknown tags count as 3). Accounts: global_clp, keeper, keeper_source, global_vault, admin_token_account, token_program, revenue_attribution (last).

collect_fees(amount: u64) (clp.authority)

Moves fees into the market’s CLP vault and adds them to total_fees_collected.

Treasury

The global vault is the protocol treasury. admin_withdraw pays cUSDC out of the protocol, within the limits in TreasuryPolicy. treasury_lend sends idle cUSDC to a lending venue within the same limits, and treasury_recall brings it back. backstop_market moves cUSDC into a market’s collateral and has no limit, because the funds stay inside the protocol. The policy, backstop_market and the instructions that manage the policy were added on 11 Oct 2026, the three lending instructions on 12 Oct 2026, and advance_to_market on 13 Oct 2026.

admin_withdraw(amount: u64) (global_clp.authority)

Pays idle cUSDC from the global vault to the policy’s destination. It works as a token bucket: the allowance refills at rate_per_sec up to burst, and each withdrawal spends it. A withdrawal must fit in the allowance (TreasuryAllowanceExceeded) and in the vault balance (InsufficientLiquidFunds), and must pay the policy destination (InvalidTreasuryDestination). It is refused while the policy is frozen (TreasuryFrozen). Capital allocated to markets must first come back through return_to_global.

Accounts: global_clp, authority, treasury_policy, global_vault (owned by the GlobalClp PDA, else InvalidVault), destination, token_program. Emits TreasuryWithdrawn.

On 11 Oct 2026 the bucket replaced the old 24 h cap and the 1 h hold after admin_fund, so AdminWithdrawCapExceeded (6033) is no longer returned.

init_treasury_yield() (global_clp.authority)

Creates TreasuryYield once, paid for by the signer. Accounts: global_clp, authority, treasury_yield, system_program.

treasury_lend(params: TreasuryLendParams) (global_clp.authority)

TreasuryLendParams { amount, venue }, where venue is the YieldProtocol index, 0 to 4 (else InvalidAmount). Moves amount cUSDC from the global vault to lend_account, the authority’s own cUSDC account, which deposits it at the venue in the same transaction, as deploy_collateral_to_yield does for market collateral. It spends the TreasuryPolicy allowance exactly as admin_withdraw does, so lending can’t move money out of the treasury faster than the policy allows. A lend must fit in the allowance (TreasuryAllowanceExceeded) and in the vault balance (InsufficientLiquidFunds), and is refused while the treasury is frozen (TreasuryFrozen). It adds amount to by_venue[venue] and principal.

Accounts: global_clp, authority, treasury_policy, global_vault (owned by the GlobalClp PDA, else InvalidVault), lend_account (owned by the authority, else Unauthorized, and holding the vault’s mint, else InvalidVault), treasury_yield, token_program. It emits no event; the program log carries the amount, the venue and the principal out.

treasury_recall(params: TreasuryRecallParams) (global_clp.authority)

TreasuryRecallParams { amount, principal, venue }. Moves amount cUSDC from lend_account back to the global vault. principal of it repays what was lent at venue and the rest is booked as interest. principal can’t exceed amount (InvalidAmount) or what is out at that venue (InsufficientDeployment). The returned principal restores the allowance its lend spent, up to burst. A recall works while the treasury is frozen, so money coming home is never blocked. Same accounts as treasury_lend.

Nothing calls these on a schedule yet. The keeper’s yield allocator lends market collateral only, and devnet has no venues.

advance_to_market(amount: u64) (global_clp.authority and market.authority)

Lends amount cUSDC from the global vault into a market’s collateral vault, so that a queued redemption can be paid. The signer must be both GlobalClp.authority and the market’s authority. It is refused while the treasury is frozen (TreasuryFrozen), and it is not charged to the withdrawal allowance, because the cash stays protocol-owned until a settle pays a redeemer. It calls mint-redeem’s receive_advance by CPI with the GlobalClp PDA as funder, so the market’s max_advance_bps caps it (AdvanceCapExceeded) and the cash isn’t counted in total_collateral. mint-redeem’s repay_advance returns it to the global vault when the market’s own recall lands.

Accounts: global_clp, authority, treasury_policy, market, market_advance, collateral_vault, global_vault, mint_redeem_program, token_program. Emits MarketAdvanced.

init_treasury_policy(params: TreasuryPolicyParams) (global_clp.authority)

TreasuryPolicyParams { rate_per_sec, burst, delay_secs, guardian, destination }. Creates TreasuryPolicy once, paid for by the signer. The allowance starts at 0. Rate and burst must be above 0, the delay must be 0 to 30 days, and a guardian must be set (InvalidTreasuryParams). The destination account must be the one named in the params and hold the global vault’s mint (InvalidTreasuryDestination).

set_treasury_limits(params: TreasuryLimitsParams) (global_clp.authority)

TreasuryLimitsParams { rate_per_sec, burst, delay_secs, destination, guardian }, checked like init_treasury_policy.

• When every field is equal or tighter, the change applies at once. Tighter means a lower rate, a lower burst, a longer delay, the same destination and the same guardian. Emits TreasuryLimitsApplied.
• Any loosening becomes pending until now plus the current delay_secs. A new proposal replaces an older pending one. Emits TreasuryLimitsProposed.

TreasuryLimitsProposed carries pending_at and a loosened bitmask: 1 rate up, 2 burst up, 4 delay shorter, 8 new destination, 16 new guardian.

apply_treasury_limits() (anyone)

Applies the pending change once pending_at has passed. It fails with NoPendingTreasuryChange when nothing is pending and TreasuryChangeNotReady before pending_at. It also works while frozen.

cancel_treasury_limits() (global_clp.authority or the guardian)

Drops the pending change. Emits TreasuryLimitsCancelled.

freeze_treasury() (the guardian or global_clp.authority) and unfreeze_treasury() (the guardian only)

Set and clear frozen. Both emit TreasuryFreezeChanged.

set_treasury_guardian(new_guardian: Pubkey) (the guardian only)

Hands the guardian role to a new key at once. If a pending change kept the old guardian, it now names the new one, so applying it later can’t restore the old key. Emits TreasuryGuardianSet.

backstop_market(amount: u64) (global_clp.authority)

Moves treasury cUSDC straight into a market’s collateral vault and credits total_collateral. It calls mint-redeem’s fund_collateral_from by CPI, with the GlobalClp PDA as funder. The signer is the global authority, which must also be the market’s authority. It is not rate limited, because the funds stay inside the protocol, and it works while frozen.

The keeper’s liquidity reallocator calls it: at once for a market below 100% collateral at its stored price, and after 5 minutes for one short of its posted target by more than one confidence band. It fills to the posted target, at most 130% by default, and never takes a fill back. See Solvency → Treasury backstop.

Accounts: global_clp, authority, market, collateral_vault (the market’s), global_vault, mint_redeem_program, token_program, treasury_policy (last). It refuses while the treasury is frozen. Emits MarketBackstopped, and mint-redeem emits CollateralFunded.

sweep_clp_lamports() (global_clp.authority)

Moves the lamports a per-market Clp PDA holds above its rent-exempt minimum to the authority. The signer must be global_clp.authority. Only Clp accounts qualify, never token accounts, orders or other records, and the account keeps exactly its minimum. It fails with NothingToSweep (6051) when there is nothing above it. Accounts: global_clp, authority (signer, writable), clp (writable). Emits ClpLamportsSwept.

Configuration

• initialize_clp(oi_cap: u64, oracle_config: Pubkey) creates a market’s Clp with the default inventory budget, yield off and zeroed swap guards. The signer must be the Market’s authority and becomes clp.authority.
• configure_swap(params: ConfigureSwapParams) (clp.authority) sets SwapGuardsState. ConfigureSwapParams { enabled, frozen, spread_bps, max_staleness_secs, max_confidence_bps, max_deviation_bps, window_cap_usd, window_secs, collateral_floor_bps } holds the separate arguments the instruction took until 11 Oct 2026, with the same fields in the same order, so the bytes on the wire are unchanged. Every field is optional, and None leaves it unchanged. frozen = true stops commit_swap and settle_swap, but not pool_swap or cancel_swap.
• set_commit_spread(commit_spread_bps: u16) (clp.authority) sets the committed-order half-spread, at most 1,000 bps (else InvalidAmount). settle_swap floors it at 10 bps.
• update_oi_cap(new_cap: u64) (clp.authority) sets oi_cap, the exposure cap. 0 uncaps the market. The keeper posts it nightly from the cr-targets job, and the posted value takes effect on the next trade.
• configure_inventory_budget(params: ConfigureInventoryBudgetParams) and configure_yield_strategy(params: ConfigureYieldStrategyParams) (clp.authority) set the inventory bounds and the yield shares. Each struct holds the instruction’s former arguments as optional fields, in the same order, so the bytes on the wire are unchanged: ConfigureInventoryBudgetParams { soft_lower_bps, soft_upper_bps, hard_lower_bps, hard_upper_bps, max_drawdown_bps, target_drawdown_bps, enforce_hard_bounds } and ConfigureYieldStrategyParams { normal_deployment_bps, proxy_deployment_bps, stress_deployment_bps, recovery_deployment_bps, min_liquid_reserve, min_liquid_reserve_bps, oi_liquidity_buffer_bps, enabled }.
• configure_liquidity_seeder(threshold: Option<u64>) and realloc_clp() (global_clp.authority) set the seed threshold and grow an older Clp to the current layout.
• init_revenue_attribution(params: RevenueAttributionParams) and configure_revenue_attribution(params: RevenueAttributionParams) (global_clp.authority) create the RevenueAttribution singleton and replace its keeper_authorities. RevenueAttributionParams is { keeper_authorities: [Pubkey; 4] }. Configuring leaves the counters and started_at alone.

Inventory checks

• update_inventory(volatile_value: u64, stable_value: u64) (clp.authority) recomputes q, drawdown and the breach flags.
• update_oi(new_oi: u64) (clp.authority) sets current_oi and fails with OICapExceeded above oi_cap. Nothing calls it, and it has nothing to do with the exposure cap.
• check_inventory_restrictions() returns hard_breach && enforce_hard_bounds, and get_yield_status() returns (total_deployed, max_deployable, can_deploy_more). Both are read-only and CPI-callable. max_deployable is still the old limit sized by the CLP’s own capital, which record_deployment stopped applying on 12 Oct 2026.

Yield (off)

record_deployment and record_withdrawal (clp.authority) and record_harvest (global_clp.authority) track deployments to lending venues. Since 12 Oct 2026 record_deployment refuses only when yield is off (YieldStrategyDisabled) or the market isn’t Active (ExceedsMaxDeployment). It used to also cap a market’s lending at a share of its CLP’s own capital, a few hundred dollars per market after the stock cuts. A market’s lending is now bounded by its yield_ceiling_bps in mint-redeem and by the keeper’s venue caps. add_yield_to_buffer and absorb_loss (global_clp.authority) maintain the global protocol buffer. Yield is off by default (yield_strategy.enabled = false).

Events

commit_swap emits OrderCommitted, settle_swap emits OrderSettled, OrderRefunded or OrderHeld (and OrderCapped as well when the exposure cap cut a fill short), cancel_swap emits OrderCancelled or OrderHeld, and claim emits OrderClaimed. sweep_clp_lamports emits ClpLamportsSwept. The treasury instructions emit TreasuryPolicyInitialized, TreasuryWithdrawn, TreasuryLimitsProposed, TreasuryLimitsApplied, TreasuryLimitsCancelled, TreasuryFreezeChanged, TreasuryGuardianSet, MarketBackstopped and MarketAdvanced. Their fields are in the IDL. Every fill on any route also emits SwapExecuted:

Field	Type	Meaning
user	Pubkey	Swap signer, or the order’s owner for a committed fill
market	Pubkey	Market PDA
collateral_mint / synth_mint	Pubkey	cUSDC and the traded leg
order	Pubkey	Order PDA for a committed fill; default pubkey otherwise
route	u8	0 = clp_swap (retired), 1 = pool_swap, 2 = settle_swap fill
side / direction	u8	0 = long, 1 = short / 0 = buy synth, 1 = sell synth
is_keeper	bool	user is a keeper key: clp.authority or a keeper_authorities entry on route 1, clp.authority or Market.keeper_authority on routes 0 and 2
amount_in / amount_out	u64	Base units in and out
collateral_amount / synth_amount	u64	The same two amounts, by token
reference_price	u64	NAV (1e6) on routes 0 and 2; the book centre on route 1
spread_capture	u64	Execution spread against reference_price, in cUSDC base units. It isn’t realized revenue

OrderCapped is emitted together with OrderSettled when the exposure cap filled an order only in part:

Field	Type	Meaning
order / user / market	Pubkey	The order, its owner and the market
filled_in	u64	Input that filled, in base units. It equals the amount_in of the matching OrderSettled
refunded_in	u64	Input returned to the owner with the escrow
exposure	i64	Traders’ net position E before the fill, in cUSDC atoms
cap	u64	oi_cap at the time

Errors

Code	Name	Cause
6000	Unauthorized	Signer isn’t the stored authority, or a token account has the wrong owner
6001	WithdrawalLocked	Unused (legacy LP lockup)
6002	InvalidAmount	Zero or out-of-range argument
6003	SwapDisabled	Every clp_swap (retired on 11 Oct 2026), swap_guards.enabled is false (commit_swap), or the pool isn’t enabled (pool_swap)
6004	SwapFrozen	swap_guards.frozen is true (commit_swap, settle_swap)
6005	InvalidSide	Side or direction isn’t 0 or 1
6006	SwapAccountMismatch	A token account’s mint or owner doesn’t match the market or pool, or the order isn’t pending
6007	MarketInactive	market.is_active is false (commit_swap)
6008	SlippageExceeded	Output below min_out (pool_swap; settle_swap refunds instead)
6009	OrderExpired	Settle after expires_at; use cancel_swap to refund
6010	OrderNotExpired	Cancel at or before expires_at
6011	NoFreshOraclePush	No price push since the commit yet
6012	OracleStale	Market price is 0 or older than max_staleness_secs, or the pool’s base_price_1e6 is 0
6013	OracleConfidenceTooWide	Market.oracle_confidence above max_confidence_bps
6014	OracleDeviationTooLarge	Price moved more than max_deviation_bps from swap_prev_price
6015	WindowCapExceeded	Rolling notional cap hit (pool_swap)
6016	CollateralFloorBreach	Market collateral ratio below collateral_floor_bps at the settle price; the order stays pending
6017	InsufficientShares	Unused (legacy LP shares)
6018	InsufficientFunds	A vault, book or inventory can’t cover the request
6019	InsufficientLiquidFunds	admin_withdraw, treasury_lend or backstop_market is larger than the global vault balance
6020	OICapExceeded	update_oi above oi_cap
6021	MathOverflow	Arithmetic overflow
6022	InsufficientBuffer	absorb_loss is larger than the buffer balance
6023	HardBoundBreach	Unused
6024	YieldStrategyDisabled	record_deployment while yield is off
6025	ExceedsMaxDeployment	record_deployment while the market isn’t Active
6026	MaxDeploymentsExceeded	A fourth yield deployment. allocate_to_market no longer raises it as of 11 Oct 2026
6027	DeploymentNotFound	Unknown yield protocol
6028	InsufficientDeployment	Withdrawal or recall larger than what is deployed
6029	DeploymentTooHigh	configure_yield_strategy share out of range
6030	OracleReadError	OracleConfig too short to read
6031	Retired6031	Retired error code. Nothing returns it
6032	Retired6032	Retired error code. Nothing returns it
6033	AdminWithdrawCapExceeded	No longer returned. It reported the old 24 h cap, which TreasuryPolicy replaced on 11 Oct 2026
6034	InvalidPosition	A CLP account passed to clp_burn_excess doesn’t match the expected CLP-owned account
6035	InvalidAccountData	Unused
6036	InvalidVault	A token account isn’t the protocol-owned account expected: the wrong owner or mint for the global vault, a CLP vault or the CLP’s L and S accounts
6037	TreasuryFrozen	admin_withdraw or treasury_lend while the treasury is frozen
6038	TreasuryAllowanceExceeded	admin_withdraw or treasury_lend above the refilled allowance
6039	InvalidTreasuryParams	Rate or burst of 0, a delay outside 0 to 30 days, or no guardian
6040	InvalidTreasuryDestination	admin_withdraw to an account other than the policy destination, or a new destination that isn’t the account passed or holds another mint
6041	NoPendingTreasuryChange	apply_treasury_limits with nothing pending
6042	TreasuryChangeNotReady	apply_treasury_limits before pending_at
6043	MarketMismatch	A vault instruction named a market other than the CLP’s own
6044	PoolClosedWhileLive	pool_swap while the market’s price is live: its risk state is Normal, or its last push is at most 300 s old
6045	ExposureCapExceeded	pool_swap that would push traders’ net position past oi_cap: “This trade would push the market’s net exposure past its cap”
6046	ExposureAccountsMissing	pool_swap or settle_swap on a capped market without the four inventory accounts: “The market is capped: pass the pool synth vaults and the CLP’s token accounts”
6047	SettleKeeperOnly	settle_swap signed by neither clp.authority nor market.keeper_authority: “Only the keeper (clp.authority or market.keeper_authority) may settle”
6048	InvalidOrderAccount	An order account that isn’t valid for the instruction
6049	OrderNotClaimable	claim on an order with nothing held
6050	ClaimDestinationInvalid	claim to an account that isn’t a live, unfrozen account of the order’s owner for that mint
6051	NothingToSweep	sweep_clp_lamports on a Clp with no lamports above its rent-exempt minimum
6052	PoolShapePredatesFloat	pool_swap on a book posted before the market began to float

→ Full error catalog

TypeScript

This reads QQQ’s long book and builds a pool_swap that spends up to 10 cUSDC on QQQ-L. provider is set up as in SDK setup, and the IDL is published in continuum-docs/idl.

import { BN, Program } from "@coral-xyz/anchor";
import { PublicKey } from "@solana/web3.js";
import { getAssociatedTokenAddressSync, TOKEN_PROGRAM_ID } from "@solana/spl-token";
import clpIdl from "./clp.json";

const clp: any = new Program(clpIdl as any, provider);
const pda = (...seeds: Buffer[]) => PublicKey.findProgramAddressSync(seeds, clp.programId)[0];

const market = new PublicKey("F12ostJBgYCzsdouwz5GG1qeBCwbmhNGucPBNCZCfPG5"); // QQQ
const clpPda = pda(Buffer.from("clp"), market.toBuffer());
const longPool = pda(Buffer.from("pool"), market.toBuffer(), Buffer.from([0])); // 0 = long
const revenueAttribution = pda(Buffer.from("revenue_attribution"));

const [perMarket, pool] = await Promise.all([
  clp.account.clp.fetch(clpPda),
  clp.account.pool.fetch(longPool),
]);

// Anchor renders base_price_1e6 as basePrice1E6 (capital E).
console.log("Book centre:", pool.basePrice1E6.toNumber() / 1e6);
console.log("Committed spread (bps):", Math.max(perMarket.commitSpreadBps, 10));
console.log("Swap guards enabled:", perMarket.swapGuards.enabled);

// Build a pool_swap that spends up to 10 cUSDC on QQQ-L.
// The pool's vaults are the pool PDA's associated token accounts.
const user = provider.publicKey;
const ix = await clp.methods
  .poolSwap({ direction: 0, amountIn: new BN(10_000_000), minOut: new BN(1) }) // set minOut from your own quote
  .accountsStrict({
    user,
    userUsdc: getAssociatedTokenAddressSync(pool.usdcMint, user),
    userSynth: getAssociatedTokenAddressSync(pool.synthMint, user),
    pool: longPool,
    clp: clpPda,
    synthVault: getAssociatedTokenAddressSync(pool.synthMint, longPool, true),
    usdcVault: getAssociatedTokenAddressSync(pool.usdcMint, longPool, true),
    tokenProgram: TOKEN_PROGRAM_ID,
    revenueAttribution,
    market, // the mint-redeem Market, last
  })
  .instruction();

On 10 Oct 2026 the read printed a centre of 751.27, a committed spread of 18 bps and true for the swap guards. A simulation of the instruction filled 10 cUSDC for 0.013257 QQQ-L. That was a Saturday, with QQQ’s price stale; while its price is live, the same instruction fails with PoolClosedWhileLive. Send it in a transaction that first creates the user’s synth ATA if it doesn’t exist.

See also

CLP concept

Why the CLP exists, how capital flows and the inventory bounds.

Trading

Swapping on the bin book and placing committed orders.