Protocol

Architecture

One contract holds all value and all rules. Everything off-chain is replaceable.

Components

Component	What it does	Holds funds
Contract	One NEAR contract: custody, markets, oracle checks, orders, the risk engine, pools, fees and liquidations.	Yes
Risk engine	Percolator, compiled into the contract. Margin, profit and loss, funding, liquidation and insurance maths. Integer arithmetic only.	Part of the contract
Keeper	Refreshes prices, activates new markets, executes pending orders, triggers TP / SL, liquidates. Every call is permissionless and re-checked by the contract.	No
Indexer and API	Reads contract events into Postgres and serves REST and WebSocket data for the app. Display only, rebuildable from chain.	No
Web app	Next.js on Cloudflare Workers. Builds transactions for your wallet to sign. Never holds keys.	No

Order flow

wallet ── request_order ──▶ contract  (order stored, block recorded)
keeper ── refresh_price ──▶ contract ──▶ DEX pool ──▶ observation stored
keeper ── execute_order ──▶ contract  (checks price is newer, fills vs pool)
contract ── events ──▶ indexer ──▶ REST / WebSocket ──▶ app

Design rules

The chain is the only state. There is no off-chain matching, so the app and the chain cannot disagree about a fill.
Every change to balances completes inside one transaction receipt. Calls to other contracts only read a price or send USDC out, and a failed send is credited back.
USDC held by the contract is always at least the sum of every user balance, vault and unclaimed fee. This is checked after every call in tests.
No call touches more than one market.
Admin keys can pause and tighten risk. No admin method can move a user balance.

Source code

Path	Contents
crates/neap	The contract.
crates/engine	The Percolator risk engine and its proofs.
services/keeper	Keeper.
services/indexer	Indexer and API.
docs	Contract spec, architecture, decisions and the security review.