The trustless contract

At the heart of Hedge is a Solana program that acts as the market maker and the ledger of record. It escrows USDC in per-market vaults, prices every trade with integer math, and resolves outcomes without a trusted admin — results are anchored to TxLINE's on-chain cryptographic proofs.

A market is a three-outcome pool#

Each fixture is one market with three outcomes — home, draw, and away. Shares and USDC are both denominated in USDC base units, so a winning share always redeems for exactly 1 USDC. Liquidity providers seed the market's reserves, and traders move those reserves along a constant-product curve when they buy and sell.

Solvent by construction#

The program is built around a single invariant, enforced for every outcome k:

vault_balance == reserves[k] + user_shares[k]   (for every outcome k)

Funding adds the same amount to all three reserves (the equivalent of minting complete sets), and every quote rounds so that rounding error can only grow the vault's safety margin. Because reserves can never go negative, the vault always holds at least enough USDC to pay whichever outcome wins.

The program's instructions#

The on-chain program exposes a small, auditable set of instructions that cover the full life of a market:

How settlement stays trustless#

Settlement is the part that normally requires trust — someone has to decide who won. Hedge replaces that decision with a verifiable proof. The settle instruction performs a cross-program invocation (CPI) into TxLINE's on-chain program:

1. 1
   A keeper builds the proof off-chain

   Reading the final goal statistics from TxLINE, the keeper encodes a validateStat instruction whose predicate is true if and only if the claimed outcome happened — e.g. a draw proves home − away == 0, a home win proves home − away > 0.
2. 2
   The program calls TxLINE and checks the result

   Hedge verifies the call goes to the configured TxLINE program, invokes it with the supplied Merkle proof and accounts, then reads its return data — accepting the outcome only if TxLINE returns true.
3. 3
   The market resolves (or nothing changes)

   If the proof verifies, the program records the winning outcome and marks the market resolved. If it doesn't, the transaction reverts — no one can force a result that didn't happen.

The on-chain guard, verbatim

// hedge_amm.settle (excerpt)
require!(winning_outcome <= OUTCOME_AWAY, HedgeError::InvalidOutcome);
require!(market.status == MARKET_OPEN,   HedgeError::MarketClosed);
require_keys_eq!(txline_program.key(), config.txline_program, HedgeError::WrongTxlineProgram);

invoke(&ix, ctx.remaining_accounts)?;                 // CPI into TxLINE

let (returning_program, data) = get_return_data().ok_or(HedgeError::ValidationNoReturn)?;
require_keys_eq!(returning_program, txline_program.key(), HedgeError::WrongTxlineProgram);
require!(matches!(data.first(), Some(1)), HedgeError::ValidationRejected);

market.winning_outcome = winning_outcome;
market.status = MARKET_RESOLVED;

Where your funds live#

• Each market owns a USDC vault — a program-derived account that only the market program can move funds out of.
• Your holdings are recorded in a Position account (one per wallet per market), and LP deposits in an LpFunding account.
• Funds leave a vault only through buy/sell pricing, redeem, or withdraw_funding — all bounded by the solvency invariant.