Equinox documentation

How Equinox works, end to end

Perpetual futures on tokenized assets. Orders match in a MagicBlock Ephemeral Rollup in milliseconds, prices are verified on Solana, and USDC never leaves the program vault on Solana.

Solana

MagicBlock

Pyth

PreStocks

Meteora

2–15 msorder executed in the rollup

27accounts delegated per market

4live markets on devnet

1wallet prompt, then silent signing

01Overview

Three products share one program and one USDC mint: stock perps (TSLA), pre-IPO perps (OpenAI, SpaceX, Anthropic) and a launchpad whose graduated tokens can become perps.

System map. State lives on Solana; each market is delegated to the rollup, which trades on a working copy and commits it back.

The split is deliberate. Everything that has to be fast (placing, cancelling and matching orders, margin checks, funding, liquidation) runs in the rollup against a delegated copy of the market. Everything that has to be safe (the USDC, the verified prices, the final state) lives on Solana L1. The rollup commits its state back to L1 on a schedule, and custody moves between the two only through explicit inbox and outbox receipts.

02Where everything runs

Four runtimes, placed so the latency-sensitive hop (market maker to rollup) is about 2 ms.

Deployment topology. The browser reads the rollup directly; nothing sits between a trader and the order book.

03Market accounts

Each market is a core account plus 26 children. The whole 27-account bundle is delegated to the rollup; custody and prices stay on L1.

One market. Each child account's header binds it to its (core, kind, index) address, so the program checks identity from the header instead of re-deriving 26 addresses per order.

All four markets share one exchange and one test-USDC mint, so the same USDC works everywhere. Margin is isolated: a trader has one seat per market.

04Onboarding

One wallet signature, then everything is signed by an in-app trading key. "Start trading" funds, seats and deposits in one go.

First session. Signatures are deterministic, so the trading key can be re-derived instead of backed up.

Devnet trade-off: the trading key is kept in the browser's local storage. A production deployment would use embedded wallets or scoped session keys. Withdrawals always pay out to the connected wallet, never to the trading key.

05Order lifecycle

The order path is pre-warmed (delegation status, blockhash, price age), so a click only signs and sends.

One order. From India the round trip is about 110–130 ms, almost all of it the network hop to Singapore; the rollup itself takes 2–15 ms.

Order types: limit and market (IOC), post-only, reduce-only, with a self-trade policy. Replace (33) moves a resting order in one instruction, which is how the market maker requotes without leaving gaps.

06Order states

Order state machine as enforced by the program.

07Prices and oracles

Every market has one L1 OracleSnapshotV3. Two ways write it: a verified Pyth update, or a bounded price reporter.

Two price paths, one snapshot format. The rollup reads a clone of the L1 snapshot; it can't invent a price.

Rules the program enforces

Orders need a price at most 10 seconds old and an open session. Pyth's OverNight session trades; Closed (weekends, US holidays) refuses new orders.
A reporter post may move the price by at most 0.5% plus 0.1% per elapsed second, capped at 10% per post; the reporter walks large moves in over several posts.
Pyth-priced markets have no reporter and refuse reporter posts. The reporter key is named per market by the authority (66).

08Margin, funding, liquidation

Keeper jobs. The keeper is a named key (64); it can run funding, liquidation and commits but can't move collateral.

Initial margin is 20% (5× maximum); margin is isolated per market seat.
Funding accrues from the gap between the book and the oracle, capped by elapsed time; the program only lets the accumulator move forward.
Liquidation uses the same risk code as order placement, so the keeper can't liquidate a healthy seat.

09Commits to Solana

The rollup's state becomes Solana state at each commit. Trading pauses for about 1.2 seconds while the bundle is written back.

Sharded commit. Children first, core last, so L1 never sees a core that points at shards from a different epoch.

10Withdrawals

Two steps: a risk-checked request in the rollup, then a claim on L1 that pays only the seat owner's USDC account.

Withdrawals never wait for a live price. Custody only ever moves through inbox (60/61) and outbox (62/63) receipts.

11Pre-IPO and baskets

OPENAI, SPACEX and ANTHROPIC perps priced from PreStocks tokens. A basket buys several legs with one click.

A basket. Legs run in parallel, each in its own isolated-margin seat. One wallet prompt in total.

12Launchpad to perp

Stock-themed tokens launch on Meteora Dynamic Bonding Curves priced in USDC. A graduated token can be listed as an Equinox perp.

Launch lifecycle. The Launch page's Pulse board shows each stage live from the chain: holders, top-10 and creator share, fees, transactions.

13Market-maker service

One Rust process on the Singapore VM, about 2 ms from the rollup, running every market in the deployment manifest.

One service, three roles. The live transaction feed in the app is this service's own stream of confirmed rollup transactions.

14Market API

A Cloudflare Worker with D1, placed next to the rollup (azure southeastasia).

Endpoint	What it does
`POST /v1/oracle/refresh`	Verifies a Pyth Lazer update and posts it on L1 (TSLA).
`GET /v1/markets/{symbol}/candles`	Pyth price history for the chart.
`GET /v1/markets/{symbol}/execution-status`	Where the market lives (rollup or L1), last committed sequence. Cached per market for 2 s.
`POST /v1/faucet`	Test USDC and a little SOL, once per wallet per day.
`GET /v1/pre-ipo`	PreStocks tokens, proxied (their API has no CORS).
`GET · POST /v1/launches`	Registry of launches; the pool must be owned by Meteora DBC.

15Frontend data flow

What the terminal streams. Compressed pushes cut the feed from ~1.8 MB/s to ~100 KB/s, and unchanged pushes are skipped.

16Latency budget

Step	Typical
Sign with the trading key (in the browser)	< 1 ms
Browser to rollup, India to Singapore	~50 ms each way
Executed in a rollup block	2–15 ms
Order visible in your book after the click	~180 ms
Market maker to rollup	~2 ms
Rollup cost: requote / taker order	~90k / ~53k CU
Commit pause, every 30 min	~1.2 s

17Instructions

Area	Instruction (opcode)	Where
Orders	place 3 · cancel 4 · cancel-all 5 · replace 33	rollup
Custody in	deposit to inbox 60 → claim 61	L1 → rollup
Custody out	request 62 → claim 63	rollup → L1
Prices	Pyth update 58 · reporter post 67	L1
Keeper	funding 6 · liquidate 7 · commit 14	rollup
Admin	set keeper 64 · abort snapshot 65 · set price reporter 66	authority only

18Trust model and limits

Who can do what. Every role is bounded by the program, and every post is public on L1.

Known limits

Taking a market out of the rollup (undelegation) is blocked by the deployed MagicBlock delegation program; it isn't needed for trading, custody or commits.
No L1 escape hatch yet if the rollup were permanently down. Funds stay in the L1 vault.
Pre-IPO and launched-token prices come from a bounded reporter key, not a signed oracle network.
Devnet only: test USDC, not real funds.