Docs

Two things leave your wallet when you mint. 1,000,000 SOLBROKER goes in as collateral. It is not spent and no instruction in the program can spend it. It sits in a vault the program owns until you sell the NFT back, and then all of it comes back to you. 0.5 SOL is the surcharge. That one is spent, and it is the money that ends up buying stock.

The NFT you get is a Metaplex Core asset with a vault address derived from it. The vault holds one token account per stock. When a round fires, your share is delivered into those accounts, so what the broker owns is held by the broker rather than credited to you on a server. Sell it to somebody and the stock inside goes with it.

Every surcharge goes into one pot. When that pot passes 0.1 SOL, the protocol spends the whole thing on whichever stock is next in the rotation and credits every live broker an equal slice of what came back. Then the rotation moves on to the next stock.

Nothing is on a schedule. Rounds happen because people mint, and they stop when people stop. Six stocks are in the rotation, so the same one comes back around every sixth round.

1. 01MintCollateral locked, surcharge taken, a new NFT created with a vault and six stock accounts of its own.
2. 02RoundThe pot passes 0.1 SOL and is swapped for the next stock. Every live broker is credited the same amount.keeper
3. 03SweepThat credit is moved out of the shared pool and into the broker's own account. Anyone can trigger it, including you.
4. 04ClaimOptional. Pulls stock out of the broker and into your wallet. The broker keeps working, it is just emptier.
5. 05Sell backCollateral returned, accounts closed, rent refunded. The NFT goes to the treasury and is listed on the market.

A full turn costs 0.6 SOL and returns every token you locked. Of that, 0.54 goes to the brokers still holding and 0.06 to the protocol.

Selling back destroys nothing. The NFT keeps its serial and its art, goes on the market, and whoever buys it pays the full surcharge again. What the pot earns tracks how often brokers change hands, not how many were minted, so a sold-out supply does not end it.

That cycling is a behaviour, not a promise. If the token slides, people sell back and do not return. The holder count falls, the pot thins out, and whoever stayed owns a larger share of less. It runs both ways.

release and settle are the only pair the keeper has to itself, because a swap has to be quoted and given a slippage limit. A fill that misses the limit dies inside Jupiter before the round can settle, which is what stops a bad price from being written down as a good one. distribute and sweep are open to anybody: neither can do anything except move stock into the broker that already owns it.

Nothing here is custodial. There is no company account, no multisig over the collateral, no ledger kept off to one side. The collateral sits in a token account owned by the config PDA, unspent surcharges sit in sol_pot, and brokers that have been sold back sit in treasury. All three are program addresses with no private key behind them, so only the program can move what is inside. Every one is derived from the program below.