STOPPAGE.

For operators

Settle only when a proof verifies

Bring the market and the oracle. Funds move on a bool — not a key.

  1. CPI one byte back
  2. Oracle yours, or ours
  3. Quote optional, reproducible
The three claims

Funds move only if a CPI into your validator returns true — anything else reverts. Three oracles already live on the same receipt path: TxLINE Merkle, Pyth, ed25519 attest. Pricing is optional Monte Carlo anchored to a snapshot hash.

One CPI, one bool

your program decides

[1] writes the receipt and funds become claimable. Anything else, the transaction reverts.

Show the validator shape
fn process_instruction(_pid, _accounts, data) -> ProgramResult {
    let claim = Claim::try_from_slice(data)?;
    let verdict: bool = verify_your_evidence(claim);
    set_return_data(&[verdict as u8]); // [1] settles; anything else reverts
    Ok(())
}

Your validator can only say yes or no; it never touches lamports. Worked example ↗

TxLINE

TxODDS fixture data, Merkle-proof verified on-chain

Pyth

Guardian-attested Pyth price, 30s freshness window

Operator attestor

ed25519-signed operator observation (TheSportsDB data)

Quote in, proof out

optional pricing line
Subscribe to the stream
const es = new EventSource("/api/quotes/stream");
es.onmessage = (e) => {
  const { quote } = JSON.parse(e.data);
  // quote.result.fairValue, bid, ask, seed, snapshot
};

Why it holds

  • Proof-gated.CPI false → the tx reverts.
  • Oracle-agnostic.Merkle, Pyth, and attest already live.
  • The receipt is the artifact.Anyone can re-verify it.
  • The schlep is the moat.Borsh, proofs, CPI — if it were easy, it would already exist.
EPL keystone · Arsenal v CoventryFull time — settlement proofs landingReceipts landing →