Reference implementation of a matcher program for the Percolator prediction market protocol on Solana.

The Percolator risk engine delegates trade pricing to external matcher programs via Solana CPI. Each LP (liquidity provider) registers a matcher program when they join a market. When a user submits a trade, the risk engine:

1. Calls the LP's matcher program via CPI with the trade request
2. Reads back the execution price and fill size from the matcher context account
3. Validates the response against the ABI spec
4. Applies the trade to the risk engine state (solvency checks, position updates)

This architecture allows LP operators to use any pricing strategy — AMMs, CLOBs, RFQ, or custom algorithms — while the risk engine handles all safety invariants.

percolator-matcher/
├── matcher-abi/           # Shared CPI ABI types (no_std, no dependencies)
│   └── src/lib.rs         # MatcherRequest, MatcherReturn, wire format
├── matcher-program/       # Reference AMM matcher (Solana BPF program)
│   └── src/
│       ├── lib.rs         # Entrypoint + account validation
│       └── amm.rs         # Reference pricing engine
├── Cargo.toml             # Workspace root
└── README.md

The included reference matcher implements a simple oracle-anchored AMM:

• Longs pay oracle × (1 + spread_bps / 10000)
• Shorts receive oracle × (1 - spread_bps / 10000)
• Default spread: 30 bps (0.30%)
• Configurable via the matcher context account's user-data region (bytes 64+)

# Build both crates
cargo build

# Build for Solana BPF deployment
cargo build-sbf --manifest-path matcher-program/Cargo.toml

# Run tests
cargo test

1. Fork this repository
2. Replace matcher-program/src/amm.rs with your pricing logic
3. The price_trade() function receives a MatcherRequest and must return a MatcherReturn
4. Deploy to Solana and register with an LP on a Percolator market

Key constraints enforced by the risk engine:

• abi_version must equal 1
• req_id, lp_account_id, and oracle_price_e6 must be echoed back unchanged
• exec_size must not exceed req_size in absolute value
• exec_size must have the same sign as req_size
• exec_price_e6 must be non-zero for accepted trades
• reserved must be zero
• FLAG_VALID must be set for acceptance
• Zero-fill requires FLAG_PARTIAL_OK

Apache 2.0 — see LICENSE.