Execution programs

Every fill on the venue obeys one core rule. A quote only fills if it sits inside the price limit around the oracle venue's bid and ask. The single best admitted maker takes the whole size; if two are equal, the one with the most room left wins. The fill is at that maker's own price. Your slippage limit is measured from the oracle venue's side (its ask when you buy, its bid when you sell), and a close settles against the writer of record of the leg. The contract enforces this rule, and it is the rule being proved in Lean (being proved in Lean; see Verify it yourself).

Execution programs sit on top of that rule. Slice order, Flex strike/duration, the Protect solver and TLP allocation only decide which requests to send, and when. They never change how a request is matched or priced, and every fill they produce passes the core rule. Each program runs on the venue's server, off the chain. The chain checks margin, the price limit, the slippage bound and all-or-nothing (atomic) fills, and nothing else about them.

Slice order (Piece size)#

What it does. Cuts a big order into pieces and sends one request per piece, all at once. Each piece is matched on its own, in its own transaction, and may land on a different maker.

• Piece size is the most premium one piece carries (default $1,000, editable in Execution details).
• An order is cut into as many pieces of up to that size as it takes, never more than 8 (past that, each piece is bigger) and never a piece under $1.
• An order that fits in one piece is one request.
• If makers run out part way, you keep what filled, and the ticket shows ⚠ "may not fill fully".
• When no single maker can take a piece, the chain refuses it by name (NoSingleMaker) and the venue sends smaller pieces. Nothing moves in the refused one.

Example. A $3,200 premium order with the default Piece size is cut into 4 pieces of $800. The venue asks the makers about all four at once. Pieces 1 and 3 are best quoted by one maker, pieces 2 and 4 by another; each piece fills whole at its winner's own price, with its own fee (3 bps of notional, $0.25 minimum per piece).

Cannot do. Split one piece across makers, make a maker quote a different size than asked, or fill past your slippage limit.

Who runs it. The venue server cuts the order and sends the requests. The chain only sees each piece as one ordinary fill.

Flex strike/duration#

What it does. Looks for a better fill next to your pick. It moves your strike or duration slightly, only when your exact pick fills poorly.

• It steps in only when the slippage at your exact pick is above Flex when slippage above (default 5 %). Choose Exact and it never moves anything.
• It may move the strike by at most 10 % and the duration by at most 50 %, and never further than your pick's own slippage allows.
• Two move rates (default 1 % each) say how much slippage a 1 % move of the strike, or of the duration, must save to be worth it. A candidate is scored by its slippage plus its move cost plus fees.
• The venue asks makers about the nearby candidates (one request each, a few strikes and durations where makers' quotes begin or end) and ranks them by slippage against the oracle venue's side. It moves only if the best one beats your exact pick.
• No quote at your pick. If no maker quotes your exact pick, its slippage counts as infinite, so Flex looks for the nearest quoted fill. The ticket says "no quote at your pick · moved to the nearest quoted fill", or "no quoted fill nearby". In Exact mode the ticket just says the price is unavailable.

Example. You want a BTC 3-month call at +5 % strike. At that exact pick the best maker's price is 7 % over the oracle ask, above the 5 % threshold, so Flex looks around. A 3-month call at +4 % costs 2 % over the oracle ask (the strike moves about 1 %; at a 1 % move rate that costs 1 point). Score: 2 + 1 = 3, against 7 for your pick. Flex fills the +4 % call. Both prices come from firm quotes that passed the price limit.

Cannot do. Change the option type (call or put), the side, or the size. It never moves outside the limits above, and it cannot make a maker quote something they did not sign.

Who runs it. The venue server ranks the candidates and sends the requests; the maker's signed quote and the price limit are checked on chain as for any fill.

Protect solver#

What it does. Picks the premium-neutral option swap that goes with your perp, from the Liq. price, Target price and Target ROE you set. A Protect swap, or each slice of it, is one package filled by one maker.

• It searches strikes and durations for structures that hold your Liq. price. A structure must also last at least the Protection lasts days you typed (30 when blank).
• Among those it takes the highest edge: the ROE you keep at your target (as a share of what the bare perp would make), less the ROE of a plain perp de-levered to the same floor.
• Structures within half a point of the best edge are a tie and the longest-lasting wins. A tie left after that goes to the one with the lowest funding now (candidates within 2 points of participation count as tied there).
• The sold leg is never bigger than the perp; the bought leg may be.
• If nothing qualifies, it refuses by name: "Can't protect at this leverage — try lower leverage or a nearer target". Nothing opens.

Example. Three structures hold your floor and last 30 days or more: edge 12.0 (funding $1.40 a day), edge 11.7 ($0.90 a day, longer lasting), edge 8.0 ($0.40 a day). The first two are 0.3 apart, within half a point, so they tie and the longer-lasting second one wins. The third is 4 points behind, so it loses however little it costs.

Cannot do. Open anything unless the swap's bought option starts paying before your Liq. price, or exceed the sold-leg cap. It does not set any price: the swap's two legs are filled by one maker at its own signed prices.

Who runs it. The venue server (POST /perp/plan reads the book and changes nothing). The chain opens the perp and its legs together or not at all.

TLP allocation#

What it does. One TLP deposit makes a market on the listed assets for you. The venue decides how the deposit is spread.

• It goes to the largest market first, at least $250 a market. A market's size is the premium traded there over the last 7 days.
• A bigger deposit reaches more markets, and each reached market gets a share in proportion to its size, with a floor so no listed asset quotes nothing.
• A market that already has the front's 32 standing makers is skipped: a new maker there would only push out the weakest.
• The Earn tab shows the result as "Markets" (for example "2 largest of 10") and what one more market would need.

Example. You deposit $600 and the two biggest markets are BTC then HYPE. $600 reaches two markets at $250 or more each, split by market size. With $400 you would reach only BTC, and the tab would say "add $250 for HYPE" to reach the next.

Cannot do. Let you pick the split (use AUTO per asset for that), quote outside the oracle venue's own bid and ask (TLP quotes the oracle venue's sides), or change what a quote fills at. Margin still bounds each maker.

Who runs it. The venue server hosts TLP's quoting program and allocates the deposit (POST /earn/plan previews it, and sends nothing).

Kept in lockstep with the code: a check fails if this page drifts.