Skip to main content
Knockout is early alpha software. It has not been audited by a third party. Engage at your own risk, and only with money you can afford to lose entirely.
Read the rest before you trade.

If you trade

You can lose your entire stake in under a second, and that is the design working correctly. At 1000x the barrier sits a very small distance from your entry. A move against you that you would barely see on a chart can knock you out. There is no margin call and nothing to top up. At the barrier you get nothing back. The stake is gone. Hitting the barrier is a normal result, not a rare one, so size your stake for it. Your position’s collateral is capped, at the maximum collateral in the config (config.params.maxCollateral, governed). The venue is fee-inclusive: any entry fee comes out of the budget you sign, so one open never debits more than that budget. Adding to a live position counts against the same collateral ceiling, so a double-down cannot take the position’s collateral past it. Doubling down on a winning position moves your barrier toward the price. You may add collateral to a position that is already live. The 1000x is fixed by the position’s tier, chosen at open, so an add buys size at market rather than posting margin: the entry becomes the average of what you paid, and both levels move with it. Adding while you are behind widens the runway; adding while you are ahead narrows it. It is a way to press a view, never a way to defend one — see adding to a position. A double-down is an order too: it is priced at the next price after a short delay, or returned. A returned double-down keeps the time it added to your timer. Until it is priced, and for a short time after, you cannot close the position. Closing costs a fee, and a close at a loss costs more. A close at a loss pays a loss tax first, a share of the loss taken from what is left before the exit fee, so a loss costs you more than the move against you. The exit fee is a share of what the position is worth when it closes: a lower rate on a win, a higher rate on a loss, and a rate between the two for a close near your entry price. On a gain the terms also withhold part of the gain, so a target pays less than its multiple. A knockout pays nothing, so it carries no fee. The rates and a worked example of a win and of a loss are on Fees and limits, with the date they were read. A win is paid in full, and part of it may be paid later. Your stake comes back at once and the profit is paid from the pool’s free cash. What the pool cannot pay yet joins a queue and is paid in order, with no guaranteed time. See how a win is paid. Funding is a governed rate, and the rate is 0. It comes out of the payout and never out of your equity, so it does not move your barrier. Its rate is frozen onto your position at open: Fees and limits has it, and the mechanism the rest. Your outcome is decided by the signed price of your market’s feed, not the price on your own screen. That price can differ from the venue you are watching, and you can be knocked out at a price you never saw. See oracle risk below for what backs it. Your entry is the next price, not the price on your screen. An open is an order. It takes your stake when it lands, and the first price of the venue’s price feed after a short delay sets your entry. The price can move in that delay, in either direction. If no usable price or no filler comes in time, the order is returned and the whole stake comes back. A returned order is a normal outcome, not a fault. A close you ask for is a request, and its price is not locked. The first price after a short delay prices it. Anyone may complete it, and the venue’s keepers do. If nobody completes it inside the exit window, the next window’s price applies, and a knockout price in between still ends the position. A request cannot be withdrawn, and you cannot send one in the first slots after your entry price (the minimum hold). A knockout can be proved with a recent price. Anyone may prove it with any signed price newer than your entry and up to a governed number of slots old. The move that ended your position can already have reversed by the time you look. Opens can be refused or returned, and both are normal. The protocol refuses an open when the venue or the market is paused, when a market is inside a scheduled event window, or when a market is outside or near the end of its trading hours. An order that lands is returned when its price does not come in time, does not meet the venue’s quality rule, or does not fit the pool’s cover rule at its fill (your whole stake comes back, with no fee). A client should show the reason, not retry blindly; see error handling. Settlement needs a transaction. Your position does not close itself. It becomes closable, and anybody, including you, can then close it. Nobody is paid for doing so: a close is somebody spending SOL on your behalf. The venue runs keepers that close closable positions. That is a service, not a protocol guarantee, and you can close your own. If no price can be obtained for a long time, a live position gets its stake back with no exit fee. Until then a position stays open, and it can still be knocked out or reach its target once prices return. The price feed can go down. A single market can also stop opening when its price does not meet the venue’s quality rule for an entry. While there is no price, an order you place is returned, no close can be priced, and positions wait; the no-price close above is the backstop. An operator stop can pause closing. A guardian key can freeze the oracle. Opens, adds and the no-price close are refused, and every priced close fails for want of a price, so a live position cannot be closed until the freeze is lifted. It can also disable settles (no close for any reason, including a knockout). Only the protocol’s config authority can lift either. While either switch is set you cannot exit. Both switches are public fields on the config account (config.oracleFrozen, config.settlesDisabled). An order or a double-down that is waiting for its price when a stop starts is not lost: it is filled or returned, at the latest once the stop ends.

The liquidity pool

The pool is the counterparty to every trade, and losses are real. It funds every win and keeps every loss, and none of that is a promise of a return — a run of trader wins draws the pool down, same as it would for any counterparty on the losing side of a run. In short:
  • No deposit and no redemption. The program has no instruction to deposit into the pool or to redeem from it.
  • A win may be paid later. A win is paid in full, but the pool pays what it cannot pay at once from a queue, in order, with no guaranteed time.
  • No insurance fund standing behind the pool. See the insurance fund.
  • Limited capacity. A run of large wins can draw the pool down, and what it cannot pay at once is paid from the queue.
Each of those, in full: the liquidity pool.

Risks that apply to everyone

The protocol has been reviewed adversarially in-house, and its settlement arithmetic is checked by golden test vectors emitted from the engine itself. That is not the same as a third-party audit, and there has not been one. A bug in an unaudited program can cost you everything in it.
Every outcome depends on a signed price from the market’s price feed. The program accepts a price only when its signature checks out. An order is filled only by the first price at or after its target, and only when that price meets the venue’s quality rule for an entry; a close is priced by the first price at or after its target. The program sees the signed price, not how it was formed. No oracle design removes the risk that a reported price differs from where you believe the market is.
Fees, bounds, caps, tiers and delays are governed parameters. They can be changed on chain by the protocol’s authority, without your consent. Changes are public and readable, and a position already open keeps the terms it was opened under. A separate guardian key can freeze the oracle or disable settles at once, with no notice; only the protocol’s authority can lift either. The program itself has an upgrade authority: check who holds it and decide for yourself whether you are comfortable.
Congestion, outages and failed transactions are properties of the underlying network, not of this protocol. A transaction that does not land is a transaction that did not happen — which can matter at the moment you want to close.
Knockout is a program on Solana. You open and close positions with transactions you sign, against the protocol’s pool, and every term is readable on chain. How any law or tax rule applies to a position is a question this documentation does not answer. Nothing in this documentation is financial, legal or tax advice.

When the venue pauses

The team can pause the venue, or a single market. A pause stops new orders and new double-downs, and it stops a take-profit from being proved and a target from being moved. A pause of the whole venue also stops the delivery of funded queue money. It does not stop you leaving: closes, timer ends and knockouts keep working, and every open position can still be closed. An order already placed is still filled or returned as usual. The team reopens the venue by hand. In a serious incident the team can also stop pricing altogether, as described under “An operator stop can pause closing” above. The operator can also wind the venue down: new orders and adds stop, and open positions still end by their own rules.

What is unfinished

Named plainly, because “alpha” on its own tells you nothing:
  • No third-party audit.
  • Live parameters can change. Every open is 1000x; fees and caps are governable; every change is on chain.
  • The pool’s capacity is limited, so a large win can be paid late: part of it is paid from the queue, in order.
  • This is an experiment, built in public. Parameters, limits and features can change, and the program itself can be upgraded. Do not put in more than you can afford to lose.
  • The stack is young. Where the SDK cannot prove something, it says so rather than implying coverage it does not have.

Verify rather than trust

Everything that governs your money is on chain and readable. Do not take this page’s word for it. The venue already gives you the three commands and the SDK exports that check it yourself — the config PDA, the vault PDA, and the program’s own upgrade authority, which is who can change the program that holds your funds. Run them. We would rather you verified it than believed us.