How Pálpito Actually Looks Inside Solana

We explained why Pálpito runs on-chain, and then why we chose Solana: execution, speed, fees, security. Four properties of the network. Neither post explains what we did with them.

So here's the program, starting with the decision that sounds like a contradiction. Our matching engine does not run on Solana. Every term it acts on does.

Parallel Markets as Accounts

A market is an account. It holds its own lifecycle: open, closed and resolved, the outcome on resolution. Nothing about a market lives outside, and nothing can be claimed against it until that account says it is resolved. The lock is not a rule in our backend. It's a field on-chain.

A position is an account too, derived from the market and the wallet that owns it. Anyone can read it: which outcome, how many shares, what has been claimed. It can only pay out through the market it's connected to, and only when that market's status allows it. It cannot be settled early, and it cannot be settled twice.

An order is where this matters most. The user signs the terms, market, outcome, price, shares, expiry, and those terms are what the program checks against. It won't fill above the signed price. It won't fill after the expiry. Not because we would rather not. Because it can't.

That protects us as much as it protects the user.

Speed in Two Layers, Solana and the CLOB

Parallelism is the pattern at both levels, and that isn't a coincidence. We built the second one to match the first.

On Solana, a transaction declares which accounts it writes to, and transactions that share none of them run at the same time. Every market has its own accounts, so a fill in one market and a fill in another never touch the same state. They never wait for each other.

Our matching engine follows the same rule. Each market has its own book and its own order sequence, and it matches independently of every other market.

So a market is independent end to end. Matched on its own off-chain, settled on its own on-chain. Congestion stays local at both layers: a market taking heavy flow contends only with itself, in its own book and in its own accounts. Everything around it keeps running at the same speed, and more markets means more capacity rather than a longer queue.

Fees and Costs the User Never Sees

Solana's fees are low, but what lets us absorb them is that they're predictable. Congestion is priced per account. When a market gets busy, that market's own fees go up and the rest of the chain pays nothing. There is no single queue where one unrelated event raises the price of everything at once.

We said in the second post that we cover those fees. This is what makes that safe to promise. Pálpito signs as the fee payer on every transaction, so a user never buys SOL, never funds a gas balance, and never sees a network fee. The cost of settling their trade is ours.

It's also what lets us give every market, position and order an account of its own, instead of packing state together to save space. That layout isn't free for us. Rent on an account per order is the most expensive version of this design, and we picked it because it's the one you can read. We're working on narrowing that cost, not on hiding it.

Security by Design

The second post covered Rust and Anchor. What matters here is what those checks are pointed at: us.

The matching engine is our own infrastructure, and it could be wrong. It could be compromised. The program doesn't care. A fill has to arrive with an order the user signed, and it has to satisfy every term in it. A worse price than the one signed doesn't settle. An expired order doesn't settle. A payout before resolution doesn't settle.

The collateral sits in a vault the program alone controls. No admin key, no multisig, nobody at Pálpito can move it.

That is the point of putting the disputable terms on-chain. It takes us off the list of things you have to trust.

Four properties of the network. This is what we did with them: state anyone can read, parallelism at both layers, costs the user never carries, and terms not even we can break.

That's Pálpito inside Solana.