How a batch runs
A batch on Solana is a fixed number of slots, read from the program's Config account (150 slots for orders, about 30 seconds, then 100 slots to open them). Batches run back to back. Each one goes through four steps.
1. Commit: the order goes in hidden
Your browser builds the order (market, side, size, limit price and a random salt) and does two things with it:
- it hashes it with sha256, together with your wallet and the batch number. That hash is the commitment;
- it encrypts it with tlock to the drand quicknet round that falls just after the batch closes. Nobody, including Blackpool, can decrypt it before that round is published.
The commit transaction carries the hash, the ciphertext and a bond of 0.10 USDC taken from your Blackpool USDC balance. It names no market, no side and no size: the accounts it touches are the same for every order. Your browser also keeps the order itself, so you can open it yourself if you ever need to.
2. Samples: the price is fixed while the book is sealed
While a batch has orders, the keeper samples the pool price of every market every few slots (poke). Each market reads the deepest USDC pool of its asset: an Orca Whirlpool for SOL, Raydium CLMM pools for the xStocks. Anyone can send poke; the program reads the price from the pool account itself.
When the first order of a market is opened, the program fixes that market's batch price to the mean of the samples. Two checks protect it:
- there must be at least 3 samples;
- the highest and lowest sample must sit within the market's guard (1 % for most markets, 1.5 % for TSLAx, CRCLx and COINx).
If either check fails the market is void for that batch: every order in it gets its bond back and nothing trades. Because the samples are taken while every order is still encrypted, nobody can move the pool knowing what the book holds.
3. Reveal: every order opens together
When the commit window closes, the drand round comes out a few seconds later. The keeper decrypts every order and opens it with reveal. If the keeper is late, you can open your own order from the app ("Reveal it myself") during the reveal window.
At reveal, the program checks the order against its hash and against the batch price:
- a buy whose limit is below the batch price, or a sell whose limit is above it, sits out: bond back, nothing locked;
- an order smaller than 1 USDC of notional sits out the same way;
- an order whose funds are missing from your balance loses its bond;
- every other order gets its bond back and locks its funds.
4. Finalize and claim: one price, fairly split
After the reveal window, finalize computes how much crosses in each market at the batch price. The lighter side fills in full, the heavier side pro rata. Then claim applies each fill to its owner's balances and closes the order account, sending its rent back to the owner. What does not cross is unlocked.
Every division rounds in favour of the venue, so the program can never pay out more than it holds. The keeper sends finalize and claim for everyone; anyone else can too.