DOCS

How it works

The mechanism in full, the arithmetic behind it, and an honest account of what is built and what is not.

What exists today

The program is written and tested, and a deposit has run end to end against a real Raydium pool cloned from mainnet. The assets it operates on do not exist yet.

▮Share accounting, entitlement state machine, holder gate
▮Impact guard + program-derived slippage
▮Raydium CPMM integration — swap, deposit, withdraw
▮15 program tests, mutation-checked
▮TS port diffed against the program across 48 rows
▮Deposit executed end-to-end on a mainnet-forked pool
▯$ZUKIN mint — address ground, token not created
▯Public mint — not open
▯ZUKIN/SOL pool — does not exist
▯Public deployment — not deployed
▯Entitlement size — not chosen
▯Audit — not started

Because there is no token, no collection and no pool, every figure on the home page — reserves, prices, LP balances, accrued fees — is a simulated input you are moving, not a measurement. The arithmetic driving those figures is the program's own: site/lib/amm.ts is diffed against amm.rs across a 48-row grid and the two agree exactly.

The deposit path

Runners are minted by the public, in stepped price tiers — there is no premint and no snapshot. The entitlement is attached to the runner at mint. One choice per NFT, made once: claim it to your wallet, or route it into the vault. The two are mutually exclusive and enforced by an Entitlement account keyed to the asset.

  1. 1 · Prove the runner. The program reads the Metaplex Core asset live — it must belong to the Zukin collection and it must be yours. Membership and ownership are checked together, because either alone is a hole.
  2. 2 · Price the sell before moving anything. Half the entitlement has to be sold. The program computes what that fill would actually return against live reserves and refuses the deposit if it lands further below the pool mid than the configured limit.
  3. 3 · Swap half. Routed through the vault's own pool, never an external router, so the swap fee is paid into that pool's reserves — which is to say, to the depositors already in.
  4. 4 · Provide the pair. The remaining half plus the SOL go in as liquidity. Raydium's deposit is LP-out driven, so the program sizes the LP first and caps what it will pay; the small remainder stays in the vault for the next deposit.
  5. 5 · Bind it to the NFT. The LP is recorded against the asset address, not your wallet — so the position transfers when the runner does. No snapshots, no balance history to reconstruct.

Share accounting

Vault shares are the pool's LP tokens, one to one. There is no share price, no vault valuation and no oracle in the program. Trading fees compound into the pool's reserves, so LP appreciates on its own and a later depositor mints at the already-appreciated ratio. They cannot dilute you and you cannot dilute them.

THE INVARIANT

sum(position.lp_amount) == vault_lp_balance

Denominated in LP tokens, so it holds exactly regardless of token dust. Verified on a mainnet-forked pool: the LP a position records equals the real balance delta, to the unit.

The alternative — minting shares against a dollar-denominated valuation — needs a price for a token whose price this vault is itself moving. That number would be unmeasurable and rendered confidently anyway, so it does not exist here.

The impact guard

Every deposit is a market sell. The guard measures execution shortfall — how far below the quoted mid a fill actually lands, which is depth and fee combined — and refuses anything past the limit. The minimum output is derived in-program from live reserves; a client cannot supply an optimistic number and have it honoured.

Because the entitlement is uniform, impact per deposit is constant, so the guard self-paces: deposits stay shut while the pool is thin and open as depth grows. At a 1% limit the pool needs roughly 65× the entitlement before the first deposit clears — and each deposit then deepens it further.

The cost of this shape, stated plainly:a deposit adds ZUKIN to the pool and no extra SOL, because the swap takes SOL out and the LP add puts the same SOL straight back. So deposits walk the price down, and the drift across the whole collection is set by the total entitlement against the pool's depth. The simulator on the home page shows this directly.

Raydium CPMM

The pool is a Raydium constant-product pool, chosen because its fees compound into reserves — which is what lets shares be LP tokens with no harvest step and no unclaimed-fee accounting. Every offset, discriminator and account order in the integration was taken from Raydium's on-chain IDL rather than from documentation.

Two details that matter and are easy to get wrong: reserves are the vault balance minus protocol, fund and creator fees — those accrue inside the vaults but are not swappable liquidity — and Raydium states its trade fee over a 1,000,000 denominator, not in basis points, so a basis-point field silently truncates rates like 25.5bps and disagrees with the pool on most trade sizes.

What you do not have to trust

  • No seize instruction. There is no code path that moves a position or the vault's LP to the authority. Not a disabled one — an absent one.
  • Pause cannot touch withdraw. The pause flag gates deposits only. A pause that can block a withdrawal is a rug switch, so no parameter reaches it.
  • One-way mint latch. The config can be pointed at the real $ZUKIN mint until it is latched; after that it is permanent and publicly readable.
  • Withdrawal authority is a program PDA, never an operator key.

None of this has been audited. Smart contracts contain defects, including this one — read the disclaimer before depositing anything.