Roadmap
What is built, what comes next, and what has to be true before an order settles against real money. Stages are ordered by what each depends on, and each ends at stated criteria rather than a date.
Done — shipped, with the evidence beside itReady — built and rehearsed, waiting on a deployStarted — partly builtPlanned — specified, not builtResearch — needs a design or a proof first
Built and running
A live index, an open paper venue, and a contract suite deployed and rehearsed on testnet.
C-VIX 30D index
Variance replication over the Deribit BTC and ETH option surface, held at a constant 30-day tenor and recomputed every 15 seconds. It tracks Deribit's DVOL within about 5%.
Live since 20 September 2026
Where: core/cvix.tsDoneFunding feeds
Binance, Hyperliquid and Lighter, the native leg, normalised to basis points per 8 hours and differenced into the FR-BASIS spread.
Live since 21 September 2026
Where: relayer/sourcesDonePaper venue
Signed market and limit orders under the contracts' rules, kept in Postgres: margin, the fee, the 8× cap, borrow and carry, and liquidation once 90% of margin is gone. Nothing opens, closes or liquidates against a stale feed. Every balance change has a ledger row.
21 end-to-end API checks
Where: relayer/matcher.tsDoneSession keys
One gas-free EIP-712 signature delegates a scoped, 12-hour key held in the browser, so orders sign without a wallet prompt. The contract checks the grant itself, and one call revokes every key.
10 typed-data parity checks against the contract
Where: core/session.tsPrismPerpSettlement.solDoneSettlement contracts
Settlement, vault, oracle dampener and skew engine: the 8× payout reserved from the pool at open, a per-block band on every oracle move, and borrow and carry accrued through per-side indices.
137 Foundry tests, 4 of them invariants over 128,000 random calls; 98.4% of lines covered
Where: contracts/srcDoneChain venue in the relayer
Keeper, batch settler, event indexer and liquidator: the relayer pushes the index, settles orders through settleBatch, mirrors every event into Postgres and liquidates what the contract reports.
35 end-to-end checks on a local chain, a liquidation among them
Where: relayer/chainDoneTestnet deployment
All five contracts deployed to Robinhood Chain Testnet (46630) and verified on its explorer on 21 September 2026, then rehearsed there from wallet to contract and back.
26 of 26 chain checks and the full wallet journey, on testnet
Where: deployments/46630.jsonDoneProduction stack
The site, one always-on relayer and a managed Postgres beside it, with a provenance tag on every stored row: live, historical, seeded, simulated or paper.
Health and feed freshness at /api/health
Where: VercelRailwayNeonDone$PRP token
Launched on ponsfamily.com on 21 September 2026: all 1,000,000,000 tokens minted into one pool on Robinhood Chain mainnet, from a contract with no mint function.
The launch transaction, the supply and every function in the contract, read from the chain
Where: Robinhood ChainDone
Harden the live venue
The paper venue is public. Make it watched, protected and reproducible before anything settles on-chain.
Alerting
A watchdog runs every minute and pages a phone when a feed goes stale, the relayer's heartbeat stops, relayer and site disagree on how orders are signed, an order sticks, or a signing key runs low on gas. One page per change, a reminder every half hour while it lasts, and one when it recovers.
Paged 50 s after the last relayer was killed, in a rehearsal on a copy of production; running on prismperp.trade
Where: api/cron/watchdogapi/healthDoneError reporting
Exceptions from the web app and the relayer collected in one table, each with the request or the relayer round that raised it, grouped by fingerprint and paged the first time in a day each appears.
Its first catch was a real bug: a malformed limit that made two routes answer 500, fixed the same day
Where: db/ops.tsinstrumentation.tsDoneContinuous integration
Typecheck, lint, the core and database suites, a production build driven end to end in a browser, the contract suite with its invariants, ABI drift and Slither, on every push to master and every pull request. Gating merges on it is a repository setting, which a private repository gets only on a paid GitHub plan.
Green on GitHub Actions: 71 unit tests, 64 end-to-end checks, 137 contract tests, and 45 of 45 Slither results triaged
Where: .github/workflowsDoneRate limits
Per-IP limits before any work and per-address limits once a signature verifies, on orders, closes, cancels, sessions, nonces and collateral moves, counted in Postgres so every server shares them.
On prismperp.trade, the 121st nonce read in a minute and an account's 11th collateral move were refused
Where: server/limits.tsDoneOne relayer, enforced
The relayer holds a lease in Postgres to write, so a second instance waits as a standby instead of sending every keeper transaction twice, and takes over when the first stops.
Rehearsed on a copy of production: the standby wrote nothing, then took the lease within seconds of the holder dying
Where: relayer/main.tsdb/ops.tsDoneObserved FR-BASIS history
The hourly, four-hour and daily FR-BASIS history before live collection, rebuilt from Binance's, Hyperliquid's and Lighter's own published funding and tagged historical. Finer candles stay as they were: no venue publishes funding finer than an hour.
2,210 hourly candles per market on production, replacing every seeded and modelled one
Where: scripts/backfill-history.tsDoneRetire seeded C-VIX history
Live collection began on 20 September 2026 and covers 90 days at 12:00 UTC on 19 December. The relayer checks every hour and then deletes the seeded rows, and nothing else, by itself.
Where: db/seed.tsrelayer/main.tsStartedReference pages from the code
Every formula, rule and status line on the docs, protocol and market pages checked against the contracts and the relayer, and rewritten where it predated them.
Checked against the contracts and the relayer on 22 September 2026: the architecture notes and over twenty other claims rewritten
Where: lib/content.tsDone
- Done when
- A stopped relayer or a stale feed pages someone within two minutes
- The full check suite gates every merge
- Write endpoints are rate-limited, and a second relayer cannot write
- FR-BASIS history is observed, and the seeded C-VIX rows are gone on 19 December 2026
Chain venue on testnet
Orders settle in PrismPerpSettlement on Robinhood Chain Testnet from a public site, while prismperp.trade stays on paper.
Safe ownership
Move all four contracts to a Safe: the deployer nominates it with transferOwnership, then one Safe transaction accepts ownership of all four. scripts/safe-handover.mjs nominates, writes the batch for the Safe app, and verifies. Until then the deployer key owns them.
Rehearsed on a fork of testnet with a real Safe 1.4.1: nominated, accepted in one transaction, verified. Waits on the Safe and its signers.
Where: Owned.solscripts/safe-handover.mjsReadyA public testnet site
A second deployment at testnet.prismperp.trade, with its own relayer and database on the chain venue, so the chain venue runs in public while prismperp.trade stays on paper. The testnet build says so on every page, is not indexed, and links back.
Built as the site's testnet variant and run against a fork of testnet; scripts/testnet-site.mjs provisions it. Waits on the deploy and one DNS record.
Where: VercelRailwayscripts/testnet-site.mjsReadyKeys by role
Separate keeper, settler and liquidator keys, each funded for one job, so a leaked key can do only that job. The relayer will not start on the chain venue with a key missing or shared, each role's gas pages below 0.002 ETH, and a health check says if a role signs with another's key.
The liquidator's own key is made. It is funded, and set on the relayer, at deploy.
Where: relayer/chainscripts/make-testnet-keys.mjsReadySolvency monitor
Read isSolvent, isBacked and the pool's free liquidity every five seconds at the chain head, all from one block; page on any breach, hold the check failed for ten minutes after one, and chart pool against reserved payouts on the risk dashboard.
Tested on Postgres 17 and PGlite, and read from a fork of testnet. Runs with the testnet relayer.
Where: relayer/chain/solvency.tsanalyticsReadyA second options venue
Derive's BTC and ETH option surfaces join Deribit's in the C-VIX aggregate, at a quarter of each asset's weight, so the index, and every C-VIX position with it, does not stop when Deribit does. A Derive level more than 25% from Deribit's is left out as an outlier.
Within 0.1 vol points of Deribit on both assets. With Deribit cut off, the index printed from Derive alone, 0.05% from the round before.
Where: relayer/sources/derive.tscore/cvix.tsReadyLiquidations on a live network
Liquidate on testnet without touching the index: on a market with no open interest, the owner lowers the skew engine's depth so a lone position's borrow takes its margin within minutes, and the relayer's own liquidator must seize it. Depth goes back afterwards.
Passed 14 of 14 on a fork of testnet, before and after a Safe handover: the relayer's own liquidator key seized a lone 20× position 85 s after depth dropped, and the vault stayed solvent. Runs live once the testnet site is up.
Where: scripts/e2e-liquidation.tsReady
- Depends on
- Alerting and the relayer lease, because the chain relayer holds keys.
- Done when
- Fourteen consecutive days with no invariant breach and no order stuck in the queue
- Feeds fresh at least 99.9% of the time
- The chain and wallet end-to-end suites pass against testnet on every deploy
Contracts v2
Everything the mainnet contracts need, built before the audit, so the audit covers the code that ships.
Add margin
Top up an open position to move its liquidation level away. Today the only way to take risk off a position is to close it.
Where: PrismPerpSettlement.solPrismPerpVault.solPlannedPartial close and reduce-only
Close part of a position, with its margin, escrow and accrued costs split pro rata. Today every order opens a new position and a close takes all of it.
Where: PrismPerpSettlement.solPlannedStop-loss and take-profit
Closes signed in advance with a trigger level. The contract checks the trigger against the oracle, so the relayer cannot fire one early.
Where: PrismTypes.solcore/eip712.tsPlannedMarket registry
Markets as configuration, each with its kind, leverage cap, feed and limits, instead of three constants compiled into the contracts. A listing then needs no redeployment.
Where: PrismTypes.solPrismPerpSettlement.solPlannedOpen-interest caps
Limits per market and per account. Today the only bound is the pool's free liquidity.
Where: PrismPerpSettlement.solDynamicSkewEngine.solPlannedKeeper quorum
The oracle settles on the median of values signed by several independent keepers, so one compromised keeper cannot move it. Today any allowed keeper can push within the band.
Where: CVIXOracleDampener.solPlannedEmergency settlement
If a feed stays stale past a long, fixed bound, anyone can settle that market's positions at its last fresh level. Today a stopped keeper freezes exits until it returns.
Where: PrismPerpSettlement.solPlannedTimelocked parameters
Changes to the borrow rate, depth, liquidation bounty, oracle age and spread step wait out a public delay. Pauses stay immediate, since they only protect.
Where: Owned.sola timelockPlannedFee router
The fee split on the tokenomics page, enforced by a contract. Today every fee goes to the payout pool.
Where: PrismPerpVault.sola fee routerPlannedPaper and chain in lockstep
The paper matcher gains every v2 feature, and a differential test runs one order sequence through both venues and compares every balance.
Where: relayer/matcher.tsscriptsPlanned
- Done when
- Every new path covered by unit, fuzz and invariant tests, with line coverage above 95%
- Slither clean; typed data, ABI and parity checks regenerated and green
- Redeployed to testnet, and the testnet stage's criteria met again
- One tagged commit, frozen for the audit
Terminal and API
The trading tools the v2 contracts make possible, and a documented way in for software.
Position tools
Add margin, partial close, reduce-only, stop-loss and take-profit, from the order ticket and the positions table.
Where: components/tradePlannedLiquidation warnings
A notification when a position nears its liquidation level, and when an order fills or expires.
Where: apps/webrelayerPlannedAccount export
Fills, closes and every ledger row as CSV, for bookkeeping.
Where: components/portfolioPlannedPublic API and SDK
Documented REST and streaming endpoints and a typed client built on @prismperp/core, for bots and market makers trading through session keys.
Where: app/apipackages/corePlanned
- Depends on
- Contracts v2 for each position tool, which reaches the paper venue first. The API can start at any time.
- Done when
- Every v2 position tool usable from the ticket on both venues
- The API documented, versioned and covered by the end-to-end suite
Audit and security
Independent review of the frozen contracts, and the operational security that has to exist before real money does.
External audit
An independent firm reviews the tagged commit. Every finding is fixed with a regression test, and the report is published naming the commit it covers.
Where: contracts/srcPlannedLonger fuzzing campaigns
The four invariants held over millions of random calls rather than 128,000, and checked again by a second fuzzing engine.
Where: Invariants.t.solPlannedBug bounty
A public bounty with rewards scaled to the funds at risk, live before the first real deposit.
Where: SecurityPlannedKeys in a managed signer
Keeper and settler keys held by a key-management service that signs without exposing them, not in environment variables, with a rotation runbook.
Where: relayer/chain/client.tsPlannedIncident runbook
Who can pause what, how fast, and what is posted on X, rehearsed on testnet with the Safe's real signers.
Where: OperationsPlanned
- Depends on
- Contracts v2 frozen at a tagged commit.
- Done when
- The report published, with no critical or high finding open
- The bounty live and the incident runbook rehearsed
- Legal review complete
Mainnet
Real USDG on Robinhood Chain, opened slowly.
Audited deployment
The audited bytecode on Robinhood Chain (4663) with Paxos's USDG as collateral, owned by the Safe through the timelock from the first block, and verified on the explorer.
Where: script/Deploy.s.solPlannedCommitted pool capital
The payout pool funded with real USDG. Each position reserves eight times its margin from it, so the pool can back open margin up to an eighth of its size.
Where: PrismPerpVault.solPlannedGuarded launch
Low open-interest and deposit caps at first, raised on a published schedule as the pool grows and the book stays two-sided.
Where: Market registryPlannedPublic status page
Feed freshness, keeper health, pool solvency and any pause, read from the chain and shown to everyone.
Where: apps/webPlannedPaper as practice
prismperp.trade moves to the chain venue, and the paper venue stays open for practice.
Where: apps/webrelayerPlanned
- Depends on
- A published audit, a live bounty and a rehearsed runbook.
- Done when
- Open-interest caps raised to their published long-run levels without an invariant breach
$PRP utility
Staking and governance as the tokenomics page describes them, funded by real trading fees.
Staking
Stake $PRP for the share of trading fees the tokenomics page describes, paid in USDG. No emissions: rewards come from fees, not new tokens.
Where: a staking contractPlannedBuyback
The fee router's buyback share spent in the $PRP pool on a public schedule, with every purchase and burn visible on-chain.
Where: the fee routerPlannedGovernance
Votes on oracle venue weights, dampener parameters and new listings, carried out by the Safe through the timelock at first and on-chain later.
Where: Safethe timelockPlannedKeeper subsidy
The keeper share of fees paying for the gas that keeps the oracle fresh and orders settling. There is no token treasury to draw on.
Where: the fee routerPlanned
- Depends on
- Trading fees on mainnet. A fee share cannot be paid out of a paper venue.
- Done when
- A full period of fees distributed on-chain, every transfer reconcilable against the fee router
Research
Ideas that need a design, or a proof, before they can be scheduled.
Netted escrow
Reserve the book's worst case rather than the sum of every position's cap. Longs and shorts on one index largely offset, so the same pool could back more open interest, once the bound is proven.
Where: PrismPerpVault.solLiquidationModule.solResearchThird-party pool capital
A vault with shares, so others can fund the payout pool and take its side of the book. Who carries that risk is a design decision before it is a technical one.
Where: PrismPerpVault.solResearchMore markets
Further volatility tenors and underlyings where an option surface is deep enough to replicate, and further basis pairs as the native venue lists them.
Where: core/markets.tsResearchCross-margin
One margin account across positions instead of isolated margin for each.
Where: PrismPerpVault.solResearchPermissionless keepers
Anyone may run a keeper, bonded and paid per fresh push, so the oracle does not depend on one operator.
Where: CVIXOracleDampener.solResearch
Open the terminal
Charts, books and quotes need no wallet. Connecting one starts a paper session: test collateral, settled by the relayer, not on-chain.