Drip
TESTNET LIVE ON REAL PYTH PRICES ยท MAINNET AFTER AUDIT

Perps that can't go insolvent.

Drip is a permissionless perpetual-futures DEX on Solana, built on a percolator-style risk engine. Capital is senior, profit is junior โ€” so the exchange is solvent by construction. No ADL queues. No insurance black box. No admin.

Live Markets
8
Open Interest
โ€”
Residual ยท backs profit
โ€”
Haircut ยท H
โ€”
The Engine

Not an order book. Not an AMM.

Trades fill against an oracle-priced vault โ€” no matching engine, no liquidity mining games. The real innovation is underneath: a risk engine where solvency is math, not a promise. Three invariants do the work, and anyone can verify them on-chain.

VAULT

Oracle-priced liquidity vault

Every trade fills against a shared USDC vault at the oracle price ยฑ spread. Liquidity providers are the house โ€” they earn the spread and fees. No order book, no fragmented liquidity, instant fills on any size the vault can back.

RESIDUAL ยท H

Backed exits โ€” the haircut

Capital is a senior claim; profit is junior. The exchange only pays profit out of its real residual buffer. If open profit ever exceeds it, every winner is paid the same fraction H โ€” instantly and equally. You can never withdraw more value than actually exists.

Residual = V โˆ’ (C + I)  ยท  H = min(Residual, ฮฃPnLโบ) รท ฮฃPnLโบ
A / K / F

Queue-free deleveraging

Most exchanges run an ADL queue that force-closes one unlucky winner to cover a blow-up. Drip doesn't. Three lazy per-side indices socialize a liquidation across the whole side, pro-rata, in O(1). No victim is chosen โ€” the loss is shared in microscopic, fair slices.

CRANK

Bounded cranks

Repricing is capped per slot: a single oracle wick or funding spike physically cannot move open interest through more loss than the exchange budgeted for. The cause of most "got liquidated on a wick" stories is closed off at the protocol level.

PYTH

Real oracle prices, live now

Every market marks to a live Pyth feed today โ€” in paper mode. The marks, funding, liquidations and the haircut you see on testnet are the genuine engine running on genuine prices. Only custody is simulated.

KEEPERS

Permissionless keepers

Anyone can run a keeper to mark prices and liquidate underwater positions, paid by liquidation fees. There is no privileged operator who can halt the book or front-run you. The exchange runs itself.

KANI ยท 471

Formally verified math

The percolator risk engine Drip follows ships 471 model-checking proofs covering the H + A/K/F math โ€” haircut conservation, ADL fairness, funding zero-sum. The solvency guarantee isn't marketing; it's proven.

Origin

Anatoly's math. Shipped as a product.

Anatoly Yakovenko (Solana's co-founder) authored the H + A/K/F risk-engine math and an open-source reference. Drip is a faithful port of that engine wrapped into something you can actually trade โ€” a live exchange, not a reference implementation.

github.com/ dcccrypto/percolator โ†’ DRIP ported & wrapped
3
structural invariants
8
live perp markets
471
proofs behind the math
What Drip adds on top of the reference engine: a live paper exchange on real Pyth prices (trade it now), a sleek trading terminal, a live solvency dashboard, and a real on-chain Anchor program โ€” USDC custody in a program vault, on-chain Pyth, and the full engine enforced in-program โ€” built and devnet-ready. Mainnet custody opens only after an external audit. We'd rather ship late than ship a protocol that loses your funds.

The testnet is open.

Trade every mechanic โ€” mark-to-market, funding, liquidations, the haircut โ€” live on real oracle prices, with paper USDC. No signup, no signing, no risk. See the solvency engine work in real time.

FAQ

What you're probably wondering.

Straight answers. If something's missing, ask on X.

Is this live with real money?
No โ€” and that's deliberate. Pre-audit, public trading puts user funds at risk, and we won't do that. Today Drip runs in testnet / paper mode on real Pyth oracle prices: the engine, marks, funding, liquidations and the haircut are all genuinely live โ€” only positions and USDC are simulated, so nothing is at risk. Real custody opens the moment the audit clears, not a day before.
When does mainnet open?
After the external audit clears โ€” we're targeting Q4 2026, gated on that sign-off. The on-chain program is already built: real USDC custody in a program vault, on-chain Pyth, and the full percolator engine enforced in-program โ€” with devnet deployment next. Public trading opens the instant the audit passes. We won't ship a protocol that loses your funds to hit a date.
What is "percolator," and what's the haircut?
Percolator is a risk-engine design for permissionless perps that makes the exchange structurally solvent. Its core trick is the haircut H: profit is only ever paid from the exchange's real residual buffer, so total payouts can never exceed what exists. Your deposited capital is always senior and untouched.
How is liquidation fair without an ADL queue?
When a position blows past its margin, the loss is absorbed by the A/K/F side indices โ€” spread proportionally across everyone on that side in tiny slices, in O(1). No single "victim" gets their winning trade force-closed the way ADL queues do on other venues.
Can the exchange go insolvent?
By construction, no. The core invariant is that withdrawals can never exceed the vault balance. In a worst case, open profits are haircut (paid at a fraction) โ€” but capital is never lost to insolvency, and the book never freezes.
How is this different from Hyperliquid or Drift?
Those are excellent order-book / vAMM venues with traditional ADL and insurance funds. Drip's difference is the solvency model: oracle-priced vault, a haircut instead of socialized bad debt, queue-free deleveraging, and bounded cranks โ€” all formally verified. Different risk engine, not just a different UI.
Why can I trade any token?
Markets are permissionless and oracle-priced. Any token with a price feed can have a perp market โ€” no order book or dedicated market makers required, because the vault is always the counterparty.
What is $DRIP?
The community and fee token, launched on Pump.fun. It's separate from trading collateral (USDC). Protocol fees and incentives route to $DRIP. The token being live does not mean real-money trading is live โ€” that's gated on the audit.
Are the prices real?
Yes. Every market pulls a live Pyth oracle feed right now. What's simulated on testnet is custody and settlement โ€” not the prices or the engine math.
Is the code open source?
The engine Drip ports is open source (dcccrypto/percolator). Drip's own program + app live at PumpLandSOL/drip. Privacy of the math is the opposite of the point โ€” verify, don't trust.
Is leverage risky?
Extremely. Perpetual futures can liquidate your entire margin to zero in seconds. Understand maintenance margin, size small, and never trade money you can't afford to lose. This is high-risk by nature, even before mainnet.
Testnet ยท paper-traded. Drip runs on real Pyth oracle prices and a faithful port of the percolator solvency engine โ€” the markets, marks, funding, liquidations and haircut are all live. Trading itself is simulated, with no custody and no real funds at risk. $DRIP is a real token; on-chain custody & settlement are a later, audited phase. Perpetual futures with leverage are extremely high-risk and can be liquidated to zero. Not financial advice.