System architecture
Amoeba Farm’s capped futures have one place that holds money and enforces the rules: the futures program on Solana mainnet, with one account per market. Everything else reads its state, prepares transactions for you to approve, or runs routine jobs that the program checks. No server, app or tool can move your funds without a transaction the program accepts.
Components
Section titled “Components”| Component | What it does |
|---|---|
| Web app | amoeba.farm: markets, the trade ticket, Earn, the Oracle pages and your Account. Sign-in with Phantom, Solflare, Backpack, or Google through Magic. It reaches the futures API through its own server at /api/futures/, and the chain through the API’s RPC gateway. |
| Futures API | The Rust service ameba-futures-api, at https://api.amoeba.farm. It keeps every market account in memory from websocket subscriptions, quotes orders by solving packages on that copy, prepares sponsored transactions, co-signs and submits them, follows them until they land, indexes history, and serves the oracle documents, the leaderboard and a browser RPC gateway. See API reference. |
| Futures program | Custody, orders, maker ladders, positions, package verification and settlement, one account per market, and the Earn vault across them. See On-chain futures program reference. |
| Oracle program | Forms each index month from bonded public sources and publishes its result as a Period that markets settle on. See How the oracle works. |
| SDK | ameba-sdk: a TypeScript client for the futures API, builders for every futures instruction and the market account decoder, plus the Rust futures client. Its published package is coming. See SDK overview. |
| Petri | Terminal app and CLI. It trades the same markets, building orders from the chain itself or through the API’s sponsor, with an MCP server for AI agents. Its mainnet release is coming. |
| Governance controller | 8fhNi6QHU5TYNhoPDM4vs89ZBztnpxp3LnBXRgkBVKtx: a council of five seats, three to approve, that holds the upgrade authority of the futures and oracle programs, controls their governance gates, creates markets and can settle a market the oracle has not settled after expiry. |
Who decides what
Section titled “Who decides what”- The program decides everything that moves funds or changes what is owed. After every instruction it checks its own books: the cash it holds equals every trader’s free and reserved cash plus the backing of open positions, and while the market is open the backing equals the full value of every long-short pair.
- The API reads cached chain state and builds transactions. It never simulates. A quote, a chart value or a leaderboard figure is never a substitute for the program’s checks.
- The web app and Petri collect your intent and check the prepared transaction before your wallet signs it. See Prepared transactions.
- Governance can upgrade or freeze the futures and oracle programs. Every instruction carries the governance gate and its current epoch, and the program rejects it while the gate is frozen or the epoch is stale.
Display values such as the suggested range, the forecast chart and the oracle reference index never set a price or authorize a trade.
How a trade flows
Section titled “How a trade flows”- You set the side, range and amount in the ticket. While you edit, the web app asks the API for a quote and a transaction prepared for it, about every one to two seconds.
- On your click, the web app checks the prepared transaction (the sponsor pays, only you and the sponsor sign, only the expected programs are called) and your wallet signs it.
- The API co-signs it as the sponsor, sends it, and resends it until it lands or its blockhash expires.
- The app waits until the transaction is processed, then confirmed with its fills.
- If the book changed before the transaction landed, the program rejects the package without changing anything, and the web app prepares the order once more.
Background services
Section titled “Background services”| Service | What it does |
|---|---|
| Sponsor | Pays the network fee and new-account rent of the transactions the API prepares. It co-signs only messages the API built, unchanged. |
| Treasury maker | Quotes both sides of every one-point step of each market with the Earn vault’s cash, which it moves between markets as the vault’s operator. |
| Keeper | After the oracle settles a month, settles the markets on it and pays positions into their owners’ free cash. |
| Indexer | Records every market event in Postgres for trades, charts, account history and the leaderboard. History is append-only and survives redeploys. |
Oracle and settlement
Section titled “Oracle and settlement”Each product’s governed manifest fixes what is measured. Each month, the oracle forms a set of public price sources, fixes each source’s opening value, and then tracks source updates while the recipe stays frozen. See How the oracle works.
No earlier than 24 hours after expiry, the oracle publishes the month’s final index on chain and its Period becomes Settled. Each market reads the period it was created against, fixes its settlement value and pays every position. The keeper starts this work, but the programs’ own checks decide each step. Display feeds, news and charts never enter settlement. The formulas are in the Math appendix.
Integrating
Section titled “Integrating”Use the API, and check every prepared transaction before you sign it. Start with: