Security

Purple Percolator is an open-source perpetual futures engine on Solana. All programs are deployed with verified builds, on-chain security metadata, and formal verification of the risk engine.

Experimental software. Purple.trade is in active development. Trading involves risk of loss. Use at your own risk — no warranties are provided. Never trade more than you can afford to lose.

Bug Bounty

SeverityImpactReward
CriticalLoss of funds, unauthorized withdrawals, vault drainUp to 10 SOL
HighPosition manipulation, oracle price spoofing, margin bypassUp to 3 SOL
MediumDenial of service, crank manipulation, incorrect liquidationUp to 1 SOL
LowSDK encoding errors, UI-level issues, information disclosureUp to 0.1 SOL

Verified Programs

Purple Percolator

Verified
Address
PRPLUgjCUxCEzNPP6x7XJVK1WR5XX28Zu8MEyTqvGjF
SHA-256
bf68c6359fd0ecb2cf245c19ee0ccf10fcdb42b54f4c81d6772d10e1586b5cad
Docker
solanafoundation/solana-verifiable-build:1.18.9
SolscanVerified BuildSource Code

Purple Matcher

Verified
Address
MTCPqs6RWWUPMHhvZnnB6BLAXS86TDpTaxQW7Pa3aDh
SHA-256
a2d5aef57b91b6895079a138f849471bd58b9fd0ae4a643f1ce069c794dba073
Docker
solanafoundation/solana-verifiable-build:2.3.0
SolscanVerified BuildSource Code

On-Chain security.txt

Both programs embed solana-security-txt in the on-chain binary. This metadata is discoverable directly from Solana explorers.

namePurple Percolator
project_urlhttps://purple.trade
contactstradeonpurple@proton.me
policyhttps://purple.trade/security
source_codehttps://github.com/purpletrade/percolator-prog
preferred_languagesen

Verification

  • Verified builds — deterministic Docker builds produce identical binaries from source. SHA-256 hashes published in CI.
  • OtterSec verified — programs pass OtterSec on-chain verification with green badges on Solscan.
  • 143 Kani proofs — the risk engine is formally verified with model checking, not just tests.
  • SDK audit — TypeScript SDK verified byte-for-byte against Rust source (21/21 instructions, all account orderings, all encodings).
  • Upgrade authority retained — programs can be patched for security fixes via verified builds.
Full verification report →

Upgrade Policy

Both programs retain upgrade authority held by a single admin key controlled by the purple.trade team. The Percolator engine is forked upstream from Anatoly Yakovenko's original implementation.

  • Solana Foundation Verified Builds — all upgrades use deterministic Docker containers (solanafoundation/solana-verifiable-build) that produce identical binaries from source. No upgrade is deployed without a matching SHA-256 hash from CI.
  • Single admin key — upgrade authority is held by one key, not a multisig. This allows rapid response to security incidents. The tradeoff is trust in the team rather than governance delay.
  • Upstream tracking — the Percolator program tracks the upstream percolator-prog repository. Changes are reviewed against the original Rust source before deployment.

Emergency Procedures

The Percolator program includes two admin-only emergency instructions. These exist as circuit breakers — they cannot create value, only pause operations and return funds to users.

ToggleTrading

IX 20

Pauses all new trades on a market. Any trade attempt while paused returns error TradingPaused (0xd).

  • •Deposits, withdrawals, and account closures remain available — users can always exit
  • •Reversible — admin can resume trading once the issue is resolved
  • •Used for: oracle malfunction, exploit in progress, protocol upgrade

AdminForceCloseAccount

IX 21

Admin-initiated emergency close of a user position. Settles the position at the current oracle price and transfers remaining collateral back to the user's token account.

  • •Funds returned to user — collateral is transferred via SPL token transfer from the vault to the user's ATA, not to the admin
  • •Conservation invariant — the Kani-proven Conservation property (deposits + insurance = withdrawable + positions) applies to force closes. No value is created or destroyed.
  • •On-chain audit trail — every force close increments the lifetimeForceCloses counter in the engine state, publicly readable on-chain
  • •Used for: market wind-down, stuck position recovery, slab migration