How a trade settles.

Xlev is a book of synthetic perpetuals settled in USDC on Solana. Eleven markets: BTC, ETH, SOL, HYPE and ZEC, and the Solana memecoins BONK, WIF, FARTCOIN, TRUMP, MEW and PUMP. Every one trades long or short. There is no order book. You trade against the house, a pool of USDC that pays winners and keeps losses. Leverage runs from 1× to 10,000×, the smallest margin is 1 USDC, and there is no funding rate and no spread.

Your price is one you have not seen

Prices are Pyth's. At 1,000× a price a few seconds old is a small edge. At 10,000× it is a free bet: if you can see the market has already moved and still get the old price, you win almost every time and the house is drained. So no order fills at the price on your screen.

1. You send a request. The program stamps it with the chain's clock and takes your margin.
2. The fill is the first Pyth price published more than 2 seconds after that stamp. Every Pyth price carries the time of the one before it, so the program can check that a price is the first one after the cutoff and not the second or the tenth.
3. Exactly one price qualifies. Anyone can submit it: you, the keeper, or a stranger. The result is the same.

Closing works the same way. You ask to close, and the close fills at the first price published 2 seconds later.

An example in real numbers

From a run on a local validator against the live BTC tape: 10 USDC, long, 10,000×.

Three ways it could end:

That run busted. BTC printed $83,370.34 about 17 seconds after the fill, 1.7 bp down.

Limit orders

Pick Limit on the ticket and set a price. A long fills at the first live Pyth price at or below it, a short at the first at or above it, and the fill is that price, so it can only be better than your limit. Your margin and the house's reserve are held while the order waits. Take profit and stop work the same as on a market order, measured from the fill.

• Only live prices fill it. A limit order fills on Pyth's on-chain price account, never on an older price someone posts, so nobody can go back and pick the best print.
• You can cancel any time the price has not reached it. Once the live price touches your limit, the order fills and cannot be pulled. You cannot see the price cross and then back out.
• After a day it expires. If it has not filled in 24 hours, anyone can cancel it while the price is still short of the limit, and the margin goes back to your desk balance.

Listed coins

Anyone can list a market for a coin that graduated from pump.fun: paste its contract address on the trade page. The program checks that the pool is the one pump.fun made at graduation, so a copy cannot be listed in its place.

• The price is the coin's own pool. Anyone can record the pool's price, at most once every 2 seconds. Trades use the median of nine recordings. A fill or a close takes the first nine recordings after it, and no others, so nobody can pick the price.
• Size is capped by the pool. Each side of a market can hold open positions worth at most 0.1% of the pool's locked liquidity. Pushing the pool's price costs at least 0.25% of the pool per unit of move in swap fees, so it always costs more than the cap lets anyone win. A $400k pool allows about $200 a side. Small pools allow only a few dollars, so leverage there is limited by the cap, not by the 10,000× maximum.
• Each order pays 0.002 SOL into its market, which pays whoever records its prices.
• Market orders only. If an order's fill readings are never taken (nobody recorded prices in time), anyone can refund it.
• Missed events still count. The market keeps its last 64 recordings, and a bust or target that showed in any of them can still be proven.

Bust, target and stop

These do not wait for a request. Any Pyth price published after your fill can trigger them, and anyone can submit it.

The earliest event wins. A bust, a target, a stop or your close is first proposed with the price that shows it, and nothing pays for 15 seconds. In that window anyone can replace the proposal with a strictly earlier price that shows any of them. So a position cannot escape a bust it already hit, and nobody can bust a position that had already reached its target.

• The bust sits where 90% of your margin is gone: 0.9 bp at 10,000×, 9 bp at 1,000×. Crossing it forfeits the whole margin. The last 10% is the house's main edge.
• A take profit pays the target price, not the price that crossed it. A wick past your target earns you nothing extra, so there is no reason to go hunting for the best print.
• A stop pays the stop price. If one print jumps straight through the stop and the bust, it is a bust. A stop has to sit before the bust, and the program refuses one that does not.
• The cap. Every position can win at most 10× its margin. That is a take profit anyone can trigger.

If one price proves both a bust and your close, the bust wins.

The house

Anyone can add USDC to the house and get shares. Every request reserves its largest possible payout, 10× the margin, before it is accepted. The house therefore never owes more than it holds: there is no queue and no partial payout. If the free part of the house is too small, the request is refused.

Deposits buy shares at the house's best case, as if every open position loses its whole margin. Withdrawals pay the worst case, as if every open position wins its whole reserve. Nobody can gain by depositing just before a bust or leaving just before a win. With nothing open the two prices are the same.

Fees and receipts

2% of every win's profit and of every loss. Half goes to stakers as USDC, half is the dev fee.

Every loss mints receipts in the same instruction that settles it, and stakes them for the loser. The rate starts at 100 receipts per USDC lost and falls as total losses grow: 100 × (2M / (2M + lost so far))².

Staked receipts earn their share of the stakers' half of every fee. A fee booked while nothing is staked stays with the house, so nobody can stake one receipt to collect a pile of waiting fees. There is no lockup. Unstaked receipts are ordinary SPL tokens.

Receipts are not $XLEV. $XLEV is the community coin on pump.fun, contract 6PTXh4Ux8R1ZAZmrwq8VUbNPY8b54KhU74fYsQrfpump, with mint and freeze authority both removed. A loss mints receipts, never $XLEV.

What it costs you on average

A random walk does not care about leverage, so the cost is in the rules. At 10,000× with no take profit, a position runs until it hits the cap (+10 bp) or the bust (-0.9 bp). It reaches the cap about 8% of the time, and you lose about 10.8% of your margin per trade on average. With a take profit at +0.9 bp the race is even, and the cost falls to about 5.9%, mostly from the 2% fee and the bust buffer.

What you are trusting

• Pyth's price. The program reads fully verified price accounts owned by Pyth's receiver program and nothing else.
• The chain's clock. If Solana's clock ran more than 2 seconds behind real time, a fill could use a price published before your request landed. The delay is a setting between 1 and 10 seconds for that reason.
• The admin key. It can pause markets and change the fee (at most 5%), the bust point (50% to 100% of margin), the cap (1× to 100×), the fill delay and the confidence limit. It cannot move anyone's USDC or receipts. The program is upgradeable until the upgrade authority is removed.
• Not the keeper. The keeper fills, proposes, challenges and finalizes promptly, but every instruction it sends is one anyone can send. If it proposes the wrong outcome, anyone has 15 seconds to prove an earlier one. An order is refunded only if its one fill price is too uncertain to open on, which anyone can prove by handing that price in, or if nobody fills it for a day. A refund is never available just because you dislike the fill.

Prices on mainnet today

• Xlev reads Pyth's free on-chain price accounts. For BTC, SOL, HYPE and ZEC Pyth updates them about every 5 seconds, with the odd gap of up to 40. An order fills at a price published more than 2 seconds after it lands and within the next 60 seconds, so nobody can know it when they trade. Bust, target and stop are judged on those same prices, a few seconds apart, not every tick in between.
• ETH and the memecoins (BONK, WIF, FARTCOIN, TRUMP, MEW, PUMP) only update about once a minute on the free accounts, so their orders have a 75-second window and their positions are judged on prices about a minute apart. That makes them at high leverage close to a coin flip on the next price.
• If the keeper is ever late, every step it takes is one you can take yourself: the trade page shows "Fill now", "Settle now" or "Pay out now" on your position when one is due.
• With full-speed prices, an order fills at the provable first price after it, and anyone can prove an earlier event inside the 15-second window. The program already accepts both kinds.
• A known risk for the house. Anyone can update Pyth's free price accounts with any newer signed price. Someone who also pays for Pyth's full-speed data could choose, among the prices of the last few seconds, the one that suits their order: about 1 to 2 bp on BTC and SOL, about 6 bp on ETH. At 10,000× that is an edge against the house. Traders are not exposed to it; house depositors are. It closes when Xlev posts provable full-speed prices itself.