ThalassaFi
An oracle-pegged automated market maker on Solana — engineered around a single number. The onchain oracle update costs 56 compute units: roughly three orders of magnitude cheaper than reshaping a central limit order book on the same chain. That is the difference between a passive curve and an executable venue.
The pusher, the program, the pool.
Mock telemetry · representative of devnet behavior · not live mainnet data
Pricing offchain. Execution onchain.
An offchain pusher composes a fair value from three exchanges, applies volatility-aware widening and inventory-aware skew, and pushes it onchain inside a Jito bundle. The onchain program applies the oracle faithfully, runs SPL Token transfers, and enforces a small set of safety invariants — nothing more.
Strategy lives in the pusher, not the program. Iteration doesn't require redeploying. Audits only have to certify that the program applies spreads faithfully — not that it computes them correctly.
Zero-copy entrypoint
A hand-written extern "C" entrypoint walks the runtime buffer with compile-time-constant offsets — no AccountInfo vec, no Clock::get(), no allocator. The 56-CU success path falls out of the layout.
Integer-only price feed
ASCII exchange prices are parsed by string surgery — split on '.', pad to 9 digits, parse to u64. f64 never touches the path that feeds onchain. A dropped fractional digit at $170 is $170 of slippage on a single trade.
Multi-exchange composite mid
Binance, Coinbase, and OKX websocket feeds fan into a weighted composite with per-exchange staleness filtering. A rolling-window vol estimator widens spreads when realized vol exceeds the configured baseline.
Jito bundle inclusion
Oracle updates land via Jito's block engine with hard-clamped tips and per-bundle inclusion-rate logging. The maker can refresh its quote in the same slot a toxic taker arrives — effectively cancel-priority.
Bit-identical Jupiter SDK
The Jupiter Amm trait implementation dispatches directly to the program's curve crate. The quote a taker sees through Jupiter is the amount the swap instruction lands onchain — no math duplication, no drift.
Defensive surface
Price sanity band, post-fill spread penalty, staleness multipliers (1×/2×/5× then reject), CPI-only routing, and a single-instruction kill switch. The runbook is regression-tested on localnet.
Path to mainnet.
- Phase 01complete
Core program complete
11 instructions, 320-byte pool layout, 56-CU hot path, 85 tests passing including byte-equivalence between hot and cold paths.
- Phase 02in progress
Devnet stability soak
Pusher running against live exchange websockets at production cadence; oracle latency, inclusion rate, and inventory drift under continuous observation.
- Phase 03scheduled
External audit
Required before renouncing upgrade authority and seeding material capital. Scope locked to the onchain program plus the pusher's tx-construction path.
- Phase 04scheduled
Mainnet deployment
Initial pair: SOL / USDC. Liquidity scaling on demonstrated execution quality — markout at t+5 and t+10 against the published mid.
Be on the list when ThalassaFi opens to integration partners.
Aggregators, takers, and operators evaluating onchain venues — drop a line and we'll share devnet endpoints, the Jupiter-SDK quote shim, and a walkthrough of the audit scope when it firms up.
© 2026 Thalassa Labs