DELIVERABLE · OPTIONS ON TOKENIZED US EQUITY · READS SOLANA MAINNET · PROGRAM TARGETS DEVNET

IT · REFUSES · WHEN · ITCANNOT · DEFEND · THE · STATE

Covered calls on real tokenized shares, settled in the share itself. A Solana program cannot read the closing bell; we built the field that can, and the venue will not act without it.

Open the instrument

I · THE PROBLEM

FOUR · STATES · ONE · SILENCE

A Solana program cannot find out what is true about a tokenized stock. It can read a price account. It cannot read a market.

When the last print stops moving, four entirely different conditions arrive at the program as the same bytes: the same price, the same publisher, a timestamp that keeps counting. Nothing on chain distinguishes them, and each one demands a different answer from a venue that is about to take someone’s collateral.

  • THE MARKET IS CLOSEDScheduled, public, knowable a year in advance. Not an incident.
  • THE STOCK IS HALTEDThe session is open; this one security is not trading. Usually because something is about to be announced.
  • THE ORACLE HAS STOPPEDThe market is open and printing. The feed is not. This is the only one of the four that is a fault.
  • THE SESSION CLOSED EARLYHalf-day, holiday eve, or a rulebook suspension. The calendar said one thing; the exchange did another.

The standard defence against all four is one call: get_price_no_older_than. It asks whether the price is fresh, and it refuses if not. On a perpetual asset that is a correct and sufficient guard. On an equity it is structurally wrong, because it treats staleness as an exception when staleness is the normal state.

32.5 ⁄ 168Hours the New York Stock Exchange is open in a week, against the hours in a week. For roughly eighty per cent of the week, an honest equity feed is supposed to be still — and a freshness check cannot tell that stillness from a failure.

So a venue built on freshness alone is closed when it should be open, open when it should be closed, and unable to say which of the two it is doing.

II · THE MEASUREMENT

WE · WENT · AND · LOOKED

Two readings taken off Solana mainnet, against the on-chain market price of the same tokenized shares, per share on both sides. No simulation, no backtest.

RECORD I · SUNDAY 2026-09-20 09:15 UTC

Thirty-seven hours after the New York close. Two samples, ninety seconds apart.

Oracle timestamp
+82 s
Slot
+312
Price moved, 5 of 8 entries
0.0000

The publisher was alive. The clock advanced, the chain advanced, the number did not: AAPLx, NVDAx, CRCLx, HOODx and COINx did not move at all, and SPYx, QQQx and METAx moved by cents. Meanwhile the shares themselves were changing hands on chain. The ETFs held within eight basis points of the oracle; the single names with crypto beta did not:

CRCLx
−268.9 bps
HOODx
−235.6 bps
AAPLx
−69.0 bps
SPYx
−7.6 bps
QQQx
−0.5 bps

AAPLx · ORACLE 336.7021 PER TOKEN ÷ MULTIPLIER 1.00326901 = 335.6050 PER SHARE · MARKET 333.2898 PER SHARE · BASIS −69.0 BPS

RECORD II · TUESDAY 2026-09-22 08:11 UTC

Not a weekend. An ordinary overnight window, between one session and the next.

CRCLx
−324.0 bps
COINx
−268.3 bps
HOODx
−235.7 bps
AAPLx
−22.3 bps
SPYx
−0.3 bps
QQQx
+5.0 bps

IT RECURS EVERY NIGHT, NOT ONCE A WEEK

Our first version of these figures set a per-token oracle price against a per-share market price and was off by the ScaledUiAmount multiplier, the exact mistake this project exists to prevent; every figure above is like for like, and CRCLx, HOODx and COINx, whose multiplier is 1.0, were unaffected.

The oracle is not broken, and it is not permanently frozen. Between those two readings it moved a great deal, because the market opened and it tracked what the market did:

  • NVDAx222.35 → 227.71
  • METAx669.79 → 747.24

That is the finding, stated precisely. The feed does what it was built to do: while the reference market is shut it holds still. In both readings five of the eight entries did not move at all and the other three moved by cents — which is correct behaviour for a price, and a trap for anything that settles against one.

$22.8Mof collateral in Kamino’s xStocks market, whose AAPLx and NVDAx reserves price from this feed.

The instrument replays Record I’s Sunday. Its Replay mode runs the SDK’s TypeScript port of the gate on the pinned account bytes; the compiled program runs against the same Scope and AAPLx bytes in the LiteSVM tests, and a drift test pins the port to the program’s check order and refusal codes.

III · THE MECHANISMS

TWO · THINGS · HAD · TO · BE · BUILT

MECHANISM I

SPLITTING THE FOUR STATES

Market hours are public, fixed and knowable in advance. Deciding that the market is shut therefore needs no oracle — it needs arithmetic. The session is computed on chain from a committed exchange calendar: Unix timestamp, to US Eastern civil time, to session, with holidays and half-days carried as explicit exceptions on the calendar account.

That makes the most frequent gate in the system the one gate that trusts nobody. It is also the only check that still works when every price feed on chain is lying. What remains — halt, outage, early close — is answered separately, by attestation, by staleness inside an open session, and by the calendar’s own exception list.

session(calendar, now) == CLOSED

refused before a price account is ever opened

MECHANISM II

THE ADJUSTMENT INVARIANT

There is no on-chain corporate-action feed for tokenized equities. The only signal is the Token-2022 ScaledUiAmount multiplier on the mint: unlabelled, set by a single keypair, emitting no event. A dividend and a split are the same write with different magnitudes — which is precisely why we never have to classify them.

strike × ui_size = constant

The contract holds its notional across any multiplier change. One formula covers a six-basis-point dividend accrual and a ten-for-one split identically; nothing has to recognise which kind of event it is looking at. The raw quantity delivered on exercise is stored raw, not in UI units, so a split cannot change what the holder receives.

  • NETFLIX · 10-FOR-1multiplier 1.0 → 10.0
  • CROWDSTRIKE · 4-FOR-1multiplier 1.0 → 4.0

A series can also be written unadjusted, ignoring the mint entirely. The program’s tests write one and show that across a split it is wrong by exactly the split factor. Being able to express it is what makes the invariant falsifiable rather than merely asserted.

IV · THE STATE MACHINE

REFUSAL · IS · NOT · AN · ERROR

A venue that will not write into an undefendable state is not failing. It is doing the one thing a clearing house exists to do.

REFUSED

No colour is added to the word. It is cut deeper and tracked wider than anything else on this page, and that is the whole of the notation — the same way a rulebook prints a suspension in the same ink as everything else.

Nine reasons, numbered and stable. The integers do not change, because the SDK and the app display them and a refused transaction is a published artifact. Each refusal emits its code in the transaction log, so the reason survives the revert.

  1. IMARKET CLOSEDThe exchange calendar says the market is shut. Computed on chain; no oracle is consulted.
  2. IIHALTEDA halt has been attested for this security.
  3. IIIORACLE STALEThe price is older than this security’s tolerance, inside an open session.
  4. IVCONFIDENCE BLOWNReported confidence is too wide a fraction of the price.
  5. VMULTIPLIER PENDINGA multiplier change is scheduled and has not taken effect. A contract cannot be settled into a corporate action that is already announced.
  6. VIISSUER PAUSEDThe issuer has set the mint’s Pausable extension.
  7. VIIHOOK ATTACHEDA transfer hook has been attached to the mint since we last looked. We refuse to transfer into unknown code rather than find out in production what it does.
  8. VIIISOURCES DISAGREETwo independent price sources disagree by more than the allowed divergence.
  9. IXSINGLE SOURCEThe security is bound to one price source, and nothing corroborates it.

THE VENUE STATES ITS REASON
AND DECLINES