Skip to main content

​
Overview

The Percolator engine is an open-source Solana program that implements perpetual futures entirely on-chain. Originally created by Solana co-founder Anatoly Yakovenko in October 2025, it stores complete market state in a single account called a slab. purple.trade deploys its own instance of the Percolator program and provides a full trading interface on top of it. See the History page for the full story of Percolator’s origins and Toly’s involvement.

​
Slab Architecture

A slab is a single Solana account that contains the entire state of one perpetual market:
ConstantValue
Slab magic0x504552434f4c4154 (“PERCOLAT”)
Header size72 bytes
Config size320 bytes
Account size240 bytes
Max accounts4096
Total slab size~992,560 bytes (~6.9 SOL rent)
One slab = one market = one token. Each token launch creates a new slab.

​
Instructions

The Percolator program supports 22 instructions:
TagInstructionDescription
0InitMarketCreate a new slab + vault
1InitUserRegister a user account in the slab
2InitLPCreate a liquidity provider account
3DepositCollateralAdd collateral to a user or LP account
4WithdrawCollateralRemove collateral
5TradeCpiExecute a trade (open/close/increase/decrease)
6KeeperCrankUpdate the risk engine state
7PushOraclePricePush a price in authority oracle mode
8SetOracleAuthorityConfigure the oracle authority
9UpdateAdminTransfer slab admin
10UpdateConfigModify market parameters
11CloseAccountClose a user account (withdraw remaining collateral)
12SetMatcherUpdate the matcher program for an LP
13CloseSlabClose an entire market (admin only)
14–21AdvancedLiquidation, settlement, and internal operations

​
PDA Derivation

Two PDA patterns are used: Vault authority (holds the token vault): 
seeds = ["vault", slab_pubkey]
program = percolator_program_id
LP account (matcher PDA): 
seeds = ["lp", slab_pubkey, lp_index_u16_le]
program = percolator_program_id

​
Oracle Modes

The Percolator supports multiple oracle sources:
ModeindexFeedId valueHow it works
AuthorityAll zerosPlatform pushes price via PushOraclePrice instruction
PythPyth feed pubkeyCrank reads price from Pyth pull oracle
purple.trade uses authority mode for small-cap tokens that don’t have Pyth feeds. The platform pushes prices sourced from DEX aggregators (Meteora pool price, DexScreener).

​
Risk Engine

The crank-based risk engine runs checks on every trade:
  • require_fresh_crank: Ensures the crank was updated within max_crank_staleness_slots
  • require_recent_full_sweep: For risk-increasing trades, ensures a complete account sweep was recent
  • Both return error 0xf (EngineUnauthorized) when stale — this is a freshness error, not a permissions error
The KeeperCrank instruction with callerIdx = 65535 is the permissionless sentinel value, meaning anyone can crank the engine. The risk engine library (percolator) is formally verified using Kani model checking, enforcing invariants like:
  • Conservation: No value created from nothing
  • Isolation: No cross-account contagion
  • No over-withdrawals: Users cannot extract more collateral than deposited + PnL

​
Collateral Model

Each market uses the inverted perpetual model:
  • The traded token IS the collateral (no stablecoins, no wrapped assets)
  • Price = 1 / token_price (inverted)
  • “Long token” = short in the inverted engine
  • “Short token” = long in the inverted engine
This means any SPL token can have a perpetual market without needing external liquidity pools or stablecoin pairs.

​
Source Code

All four protocol repositories are open source. See the Repositories section for detailed documentation on each component, or the Programs & Deployments page for on-chain addresses. purple.trade’s SDK has been verified byte-for-byte against the canonical source. See Don’t Trust, Verify for the full audit.