Program reference

Shear is one Anchor 0.31.1 program. It holds TSLAx in Token-2022 accounts, issues vault shares and calls as legacy SPL tokens, runs the weekly USDC auction and settles each round against a Pyth close mark. This page lists its on-chain interface. The TypeScript SDK builds the same instructions, and the indexer API serves the decoded accounts and events.

Program ID#

The program ID is GG8Db3XMAfAaa4RT38e5uaeFSDjztEyaATpR6B3AxMcn. The IDL ships with the SDK as idl/shear.json; its address field carries the same ID.

Pinned addresses#

The program compares these addresses against compiled constants, in account constraints or in the handler, and rejects any other mint, oracle owner or feed. The SDK exports them under the names below.

The program also pins the issuer keys on the TSLAx mint. Every instruction that reads the mint checks them, together with its extension set. See corporate actions and trust.

The mint must carry exactly the Token-2022 extensions 4, 6, 12, 14, 18, 19, 25 and 26 (ConfidentialTransferMint, DefaultAccountState, PermanentDelegate, TransferHook, MetadataPointer, TokenMetadata, ScaledUiAmount, Pausable), with confidential auto-approve off, no auditor, no transfer-hook program and the token not paused.

Units#

All amounts are unsigned integers in base units. The program uses no floating point. TSLAx amounts are raw Token-2022 amounts, before the mint’s ScaledUiAmount multiplier.

One call atom covers one raw TSLAx atom. A USD mark is the value of one whole raw TSLAx token: the Pyth TSLA price at 6 decimals times the mint multiplier. See oracle.

Constants#

Accounts#

Eight account types. Each starts with Anchor’s 8-byte discriminator. Field names below are the Rust names; decoded TypeScript objects use camelCase, so share_mint becomes shareMint.

Vault#

One per underlying mint, created by initialize. The vault PDA is the authority of the share mint, custody and premium accounts.

VaultConfig is fixed at initialize. See parameters.

Session#

One regular market session, committed by the vault admin with register_session. Sessions are immutable. See calendar.

Bidder#

One per wallet per vault, created by authorize_bidder or stake_bidder. A wallet can bid when allowed is true, or when it holds a stake with unlock_at 0. Approval is checked first, so an approved wallet’s bids never count against its stake. See bidder stake.

StakeConfig#

One per vault, created by the first set_bidder_stake. The mint is fixed by that call.

Position#

One per owner per vault. Its shares sit in a vault-owned token account at ["position-shares", position] and move only through program instructions. See premium.

Round#

One per weekly round, created by start_round. The round PDA is the authority of the round’s collateral, deposits, reserve, bid escrow and call mint.

BidRecord is one entry of Round.bids:

Ticket#

One per owner per round. Holds at most one queued deposit and one queued withdrawal. See deposits.

Bid#

One per bidder per round. Receipt for the escrow; the bid terms live in Round.bids.

Phase#

Borsh enum on Round.phase. The decoded TypeScript value is an object with one key, such as { Active: {} }. See settlement.

PDAs#

Seeds are a UTF-8 string followed by 32-byte public keys or little-endian integers: index as u64, close as i64. Seeds below are exactly those in the account contexts.

import { PublicKey } from '@solana/web3.js';

const PROGRAM = new PublicKey('GG8Db3XMAfAaa4RT38e5uaeFSDjztEyaATpR6B3AxMcn');
const TSLAX = new PublicKey('XsDoVfqeBukxuZHWhdvWHBhgEHjGNst4MLodqsJHzoB');
const pda = (...seeds: Buffer[]) => PublicKey.findProgramAddressSync(seeds, PROGRAM)[0];
const u64 = (n: bigint) => { const b = Buffer.alloc(8); b.writeBigUInt64LE(n); return b; };

const vault = pda(Buffer.from('vault'), TSLAX.toBuffer());
const round = pda(Buffer.from('round'), vault.toBuffer(), u64(1n));
const ticket = pda(Buffer.from('ticket'), round.toBuffer(), owner.toBuffer());

For the pinned TSLAx mint the vault-level addresses are:

Instructions#

Names here are the Rust snake_case names. The Anchor TypeScript client and ShearClient.instruction use camelCase for instruction, argument and account names: fund_ready is fundReady, min_shares is minShares, position_shares is positionShares. Each table lists the checks in the handler. Account constraints (PDA seeds, has_one, token mints and authorities) apply as well; account lists are under instruction accounts.

Instructions marked mint check read the TSLAx mint. They fail with UnsupportedMint or UnsupportedExtension if its authorities or extensions differ from the pinned set, with IssuerPaused while the issuer has paused the token, and with CorporateActionWindow within 900 seconds of a scheduled multiplier activation. observe_expiry reads the multiplier at expiry - 1 and also fails if an activation falls between that second and the observation. See corporate actions.

Owner-signed#

Signed by the position owner, who pays rent for any account the instruction creates. claim_option is signed by whoever holds the calls and needs no position.

• A second deposit on the same ticket fails with DuplicateRequest; a second withdrawal with InvalidAmount.
• min_shares on a queued deposit is checked against the settlement snapshot in process_ticket. A deposit that would mint fewer shares is refunded to the owner.
• A queued withdrawal keeps earning the round’s premium. Its shares stay locked against transfer_shares until the ticket is processed.
• Between owners, shares move only through transfer_shares, and the recipient must already have a position. Calls are ordinary SPL tokens and move freely.

Bidder#

Signed by the bidder wallet, which pays rent for what it creates. A wallet bids after the vault admin approves it with authorize_bidder, or after it locks the bidder stake with stake_bidder. See bidding and bidder stake.

Permissionless#

Any wallet can send these; the keeper sends them on schedule. Only start_round names a signer, keeper, which pays rent for the new round accounts. The others need only a fee payer.

Admin#

initialize is signed by the program’s upgrade authority, which becomes the vault admin. accept_admin is signed by the account set_admin named. The rest are signed by the vault admin, which pays rent for what they create. See trust, calendar and governance.

Instructions that create an account with init fail when it already exists: a second create_position, a second place_bid from one wallet in a round, a second register_session for the same close, or a second stake_bidder while the escrow is open.

Formulas#

Integer formulas in the handlers. Division rounds as listed; checked arithmetic fails with Arithmetic on overflow.

Auction clearing sorts bids by limit, highest first, with ties broken by ascending owner public-key bytes, and fills them in order up to offered. If total demand exceeds offered, the clearing premium is the limit of the last bid that received a fill; otherwise it is reserve_premium_micro. Every filled bid pays the clearing premium. With nothing sold, clearing is 0.

Calls are claimed against cumulative liability: a claim of q pays payout(claimed + q) - payout(claimed). Any split of claims pays out exactly the reserve, and claim order moves an individual payout by at most one atom.

Instruction accounts#

Accounts in IDL order. Pass every one; the SDK builds with accountsStrict and resolves none. Token accounts named source, destination, refund and options belong to the signer, except the destination of process_ticket, which belongs to the ticket owner.

• request_withdrawal shares its account context with queue_deposit, so it takes deposits and a TSLAx source although it moves no tokens.
• program_data is the program’s ProgramData account under the upgradeable BPF loader.
• price_update is a Pyth PriceUpdateV2 account owned by the receiver, with full verification. See oracle.
• strike_session and expiry_session are Session PDAs of the vault, derived from their close.
• In transfer_shares, sender is the signer’s position and recipient the position of the receiving owner.

Events#

Anchor events, written as Program data: log lines. Decode them with the IDL or with decodeEvent from the SDK. Units follow the account fields.

create_position, authorize_bidder, transfer_shares and reclaim_option_dust emit no event. In TicketProcessed, minted_shares is 0 when deposit_refunded is true, and deposit_refunded is also true for a ticket that queued no deposit.

Errors#

Custom errors start at 6000 in declaration order and appear in logs as custom program error: 0x1770 and up. Constraints without a custom error, such as PDA seeds, has_one and token mint or authority checks, fail with Anchor’s built-in codes below 6000.