Programs and architecture
Three Anchor programs, one keeper, and what lives on chain versus off.
Pre-launch, and clear about it.
The deployed configuration splits the 4% protocol fee 1% holders, 1% liquidity, 1% staking and 1% operations, fixed in the treasury program with no setter. Staking itself is planned, phase 2: the allocation is set aside, but no staking program is deployed and nothing accepts a deposit. Values that have not been read from the chain render as a dash with the reason beside them.
The programs
| Program | Responsibility |
|---|---|
| dr_treasury | SOL vault; the fixed 25 / 25 / 25 split; the stock allowlist with Pyth feeds; the flash-fill buy; epoch funding pinned to the distributor; the liquidity vault with per-market positions and per-asset daily caps; governance pause and the seven-day recovery path |
| dr_distributor | Epochs, Merkle roots, claims and receipts; weighted baskets (PayoutPref); publish, fund, activate, claim, push, sweep, close |
| dr_staking | Phase two. Stake pool and stake accounts with checkpointed rewards; designed, not deployed |
On chain
- The split ratios, the allowlist, the basket rules, the funded-before-active rule, the one-claim-per-leaf rule and the expiry floor.
- Every position NFT and every vault, owned by program-derived addresses. The keeper is a signer for fees and a delegate for claims, never an owner or a destination.
- Two-step authority transfer, initialise gated on the upgrade authority, append-only account layouts and error codes, an event on every authority action.
Off chain
- The keeper: one process, one cycle every 15 minutes. Claims fees, distributes, buys, snapshots, allocates, builds the tree, writes the epoch file, publishes, funds, activates, pushes, sweeps, closes. It re-asserts every pool's fee configuration each cycle.
- The epoch files: leaves, proofs, prices and the baskets that were applied. Served by this site, verified by your browser against the on-chain root.
- This site: a Next.js server with a hardened RPC proxy (method allowlist, per-client windows, one shared upstream budget), the proof-file endpoint and the pages. It holds no key.
Operator limits
The keeper can spend only from the two reserves, only on allowlisted stocks, only through the guarded buy, and only up to per-asset daily caps. A quote below the oracle-implied output fails the whole transaction, so released SOL can never leave without stock arriving. Governance can pause new operations and change operators; there is no timelock on governance itself, and that is stated rather than hidden.
Source and verification
The programs, keeper and this site are in one public repository. Program ids and every derived address are published in the deployment file the site reads; the page footer links to the repository. Tests are not an audit.