Dark Percolator

Unit check: Leg1 × Leg2 ÷ Leg3 is SOL per STOXX 50 share (about 38.29 SOL at the defaults). The inverted mark is therefore STOXX 50 shares per SOL (about 0.0261), not “SOL per STOXX50” as the README’s comment reads.

Schematic: Leg 1 window shown as the Euronext cash session, 08:00–16:30 UTC in winter (09:00–17:30 Paris), one hour earlier in UTC during CEST. Legs 2 and 3 publish around the clock on weekdays.

With a 30-day half-life, an overnight gap of roughly 54,000 slots (6 hours at 400 ms) moves the EWMA by well under one percent of the gap to its target. The mark stays stable after hours and re-anchors once the live composite returns.

Defaults reproduce the README’s after-hours trade: dt 12,000 slots, ewma 38,420,000 → ≈38,417,500, a 0.65 bps move, so the fee is ≈1.65 bps.

Anyone who drags the after-hours mark by X bps can earn at most X bps of notional from it, and pays 1 + X bps to do so. The best case is a loss of the base fee.

Widths not to scale. Real share: header 0.008%, config 0.03%, engine 99.96%.

Pyth PriceUpdateV2, as the wrapper reads it

# accounts: caller(signer) · slab(w) · clock · leg1 · leg2 · leg3

percolator-cli keeper-crank \
  --slab   GSAT5fTCUgB9sMMTBsVzhvALbkSv6p9CifWmShHf92hj \
  --oracle C2Cf16vF6LX8GrWJwfZga5z5tjVsax5VWnL2T7Q8CF91

Provenance

Program

4ToDRrQW5j3oeQm8uTAwV9Rp6NhYfH5E5hMKcXkqfwfz

BPF sha256

408cbaa53403c54474c9b3e085f27571e7af293cfe12845316683bd6fdc5d7fc

BPF size

536,432 bytes

Engine pin

1dc4466e (percolator)

Prog pin

f626639 (percolator-prog)

SLAB_LEN

1,755,520 bytes (MAX_ACCOUNTS = 4096)

# verify
solana program dump -u m 4ToDRrQW5j3oeQm8uTAwV9Rp6NhYfH5E5hMKcXkqfwfz /tmp/bounty4.so
sha256sum /tmp/bounty4.so

What a public slab leaks

Every Percolator account record is world-readable. Anyone can decode the slab, sort accounts by leverage exactly as the crank does, and compute each trader’s liquidation price. That invites stop-hunting near thin after-hours books, copy-trading of size, and front-running of intent.

A Private Ephemeral Rollup changes who can read state, not what the program does. Delegated accounts execute in a TEE validator at ER speed; the permission program decides which wallets see logs, balances and messages; and state commits back to Solana on our schedule.

Price reads into the ER are an open question: delegated programs read base-layer accounts the validator clones, and MagicBlock also runs its own pricing oracle. Freshness rules must be re-validated for whichever path we use.

Flags held:

Batch cross simulator · SOL-PERP

Magic Action handlers are ordinary base-layer instructions that anyone can call directly. The hedge handler must verify the injected escrow signer before it routes size to Phoenix, or anyone could trigger hedges.

Program sketch

Shape only, against ephemeral-rollups-sdk v0.14+. Not compiled or audited.

#[ephemeral]
#[program]
pub mod dark_percolator {
    /// base: create position PDA, take collateral, pre-fund permission rent
    pub fn open_position(ctx: Context<Open>, collateral: u64) -> Result<()>;

    /// base: delegate PDA to the TEE validator
    pub fn delegate_position(ctx: Context<DelegatePos>) -> Result<()>;

    /// ER: PDA-signed CreateEphemeralPermissionCpi, then make private
    pub fn seal(ctx: Context<PermCtx>, auditor: Option<Pubkey>) -> Result<()> {
        let mut members = vec![Member {
            flags: TX_LOGS_FLAG | TX_BALANCES_FLAG | TX_MESSAGE_FLAG,
            pubkey: ctx.accounts.position.owner,
        }];
        if let Some(a) = auditor {
            members.push(Member { flags: TX_BALANCES_FLAG, pubkey: a });
        }
        UpdateEphemeralPermissionCpi { /* … */
            args: EphemeralMembersArgs { is_private: true, members },
        }.invoke_signed(&[&pos_seeds])?;
        Ok(())
    }

    /// ER: sealed intent, readable only by owner + auditor
    pub fn submit_intent(ctx: Context<Intent>, side: Side, size: u64, limit_e6: u64) -> Result<()>;

    /// ER: cross the batch at the composite/EWMA mark, pro rata
    pub fn cross_batch(ctx: Context<Cross>) -> Result<()>;

    /// ER: funding, liquidation, EWMA — same engine as Percolator
    pub fn crank(ctx: Context<Crank>) -> Result<()>;

    /// ER: commit aggregates, then hedge residual on Phoenix
    pub fn commit_and_hedge(ctx: Context<CommitHedge>) -> Result<()> {
        MagicIntentBundleBuilder::new(payer, magic_context, magic_program)
            .commit(&[ctx.accounts.market.to_account_info()])
            .add_post_commit_actions([hedge_residual_action])
            .build_and_invoke()?;
        Ok(())
    }

    /// base: called by the post-commit action; MUST check the escrow signer
    pub fn hedge_residual(ctx: Context<Hedge>) -> Result<()>;
}

Perps at 20× are high risk, dark or not. Nothing here is a recommendation to trade.