← Home GitHub Join the community ↗
Obscura Whitepaper · v0.1

Private-by-design perpetual futures on Solana

A Percolator-based venue where the order flow that gets traders hunted simply isn't there to hunt.

Draft for discussionJune 2026Testnet preview

Obscura is a perpetual-futures venue on Solana built on Anatoly Yakovenko's open-source Percolator risk engine. It pairs oracle-priced, coin-margined markets with per-market liquidity vaults and an account-local risk engine that keeps the system solvent without forced auto-deleveraging. Because fills price off an oracle against a vault rather than a public order book, the resting-order and mempool surfaces that enable stop-loss hunting and sandwich attacks are absent by construction — while settlement stays fully on-chain and verifiable. This paper describes the architecture, the risk math, the privacy model and its honest limits, the optional access controls, the role of $OBSCURA, and the path to a guarded mainnet launch.

Contents
  1. Introduction
  2. Design goals
  3. System overview
  4. Risk engine — H + A/K
  5. Pricing & oracles
  6. Liquidity & margining
  7. Liquidations & recovery
  8. Privacy model
  9. Access model
  10. The $OBSCURA token
  11. Security & verification
  12. Roadmap
  13. Risk disclosures
  14. References

01 Introduction

Perpetual futures are the dominant instrument in on-chain trading: leveraged, expiry-free exposure to an asset's price. On Solana, the design space opened further when Anatoly Yakovenko (Toly) published Percolator, an open-source reference for a self-custodial perps protocol whose risk engine replaces auto-deleveraging with bounded, self-healing coverage. Percolator is permissively licensed and explicitly meant to be forked.

Obscura forks that engine and wraps it with a deliberate stance on a problem most venues ignore: the order flow itself is a liability for the trader who creates it. On a public order book, resting stops and liquidation clusters are visible, and they get used as targets. In a public mempool, a pending trade can be front-run. Obscura's pricing model removes both surfaces — not by hiding settlement, which stays on-chain, but by never creating a public book of intents in the first place.

02 Design goals

03 System overview

Obscura is composed of a small number of independent parts:

04 Risk engine — H + A/K

Percolator's central idea is to replace auto-deleveraging (ADL) — the practice of force-closing profitable traders to cover bankrupt ones — with two mechanisms grounded in proportional equity math.

H — the global coverage ratio

Every account's balance is split into claims with strict seniority: capital (deposited collateral) is senior and always withdrawable; profit (unrealized gains) is junior. The coverage ratio H determines what fraction of junior profit is actually backed by vault reserves at any moment. Crucially, every profitable account sees the same H — there is no queue, no ranking, and no first-come advantage.

H = clamp( Residual / Profittotal, 0, 1 )
where Residual = max(0, Vault − Capitaltotal − Insurance)
withdrawable profit for an account = Profitaccount × H

As system stress falls, H rises back toward 1 on its own — the engine is self-healing rather than dependent on an administrator to intervene.

A/K — lazy side indices

When a liquidation goes bankrupt (the position's losses exceed its margin), the deficit must be absorbed. Rather than scanning the whole book, Percolator distributes that deficit across the opposing side using lazy accumulator indices — an O(1) update per event. Each affected account reconciles its share only when it is next touched, so there is no global scan and no sequential bottleneck.

Invariant. Withdrawable value can never exceed backed capital. Flat accounts always keep their deposits. Obscura uses this engine as-is; the wrapper around it does not relax this guarantee.

05 Pricing & oracles

Marks are oracle-derived, not taken from a resting order book. Where a Pyth feed exists for an asset, it is used directly; for long-tail tokens without coverage, the protocol reads a pinned on-chain DEX-pool exponential moving average, removing dependence on any single external publisher.

Trades fill against a market's liquidity vault in one of two matcher modes: a passive mode (oracle price ± a spread) or a virtual constant-impact curve that prices size against simulated depth. Either way, there is no public limit-order book whose resting orders could be read and targeted.

06 Liquidity & margining

Each market has its own liquidity vault. Anyone can deposit and become a passive maker, earning spread and a share of fees; because vaults are per-market, the risk of any one market is isolated from the rest. An insurance reserve sits between trader PnL and LP equity, absorbing losses before they reach makers and rebuilding from fees.

Markets are coin-margined: collateral is the token being traded, and PnL settles in that token. This keeps the design self-contained per market and bounds the assets at risk to the market's own token.

07 Liquidations & recovery

Liquidation is account-local and permissionless. Any keeper can crank a health check against an account; an unhealthy account either makes bounded, deterministic progress toward health or routes to a recovery path whose price is set by the engine, not chosen by the caller. There is no global scan, no liquidation race, and no discretionary intervention.

Separately, anyone can run the on-chain audit-crank: an invariant check over a market's books. If something does not balance, the market auto-pauses before the discrepancy can compound — turning a silent bug into a loud, contained stop.

08 Privacy model

"Private-by-design" here is precise, and it is worth stating its limits plainly.

What is removed. There is no public limit-order book, so there are no resting stops or liquidation orders for anyone to read and hunt. Fills price off an oracle against a vault rather than a public queue, so there is no pending order in a mempool for a searcher to sandwich. Your intent — the thing other venues leak before you execute — is not broadcast.

What is not claimed. Settlement is on-chain. Positions, balances and liquidations clear in the open, which is exactly what makes solvency verifiable. Obscura does not offer anonymity, untraceability, or concealment of executed trades, and nothing here should be read as a tool to evade lawful oversight. The privacy is in the absence of an order-flow surface, not in hiding what has settled.

09 Access model

Obscura launches open: no waitlist, no invite. The underlying program, however, retains an optional, operator-configurable access layer — an on-chain allowlist and/or token- or NFT-gating — that a private deployment can enable. Where required, operators are expected to apply jurisdictional geofencing and comply with applicable law; the access layer is a compliance tool, and the project does not endorse using it to serve prohibited users.

10 The $OBSCURA token

$OBSCURA is the venue's coordination token. Anticipated utility includes fee and liquidity-provider incentives, market-creation rights, and governance over protocol parameters as the system decentralizes. Total supply and distribution are to be finalized and published before any token event.

Not an investment. $OBSCURA is described here for its intended utility only. It is not a share, not a claim on protocol revenue, and not a promise of profit or appreciation. Nothing in this paper is an offer to sell or a solicitation to buy any token or financial product.

An illustrative model of the proposed buyback-and-burn supply mechanism is available on the tokenomics page.

11 Security & verification

The Percolator risk engine carries formal, model-checked proofs (via the Kani model checker) of its key invariants — the properties that keep withdrawable value bounded by backed capital. Those proofs cover the engine. They do not automatically cover Obscura's wrapper, access layer, or any divergence we introduce.

Accordingly: Obscura's program goes through independent external audit and a public bug bounty before any public funds are accepted; the audit-crank provides continuous on-chain solvency verification with auto-pause; administrative authority is held by a multisig with a two-step handover, not a single key; and the upgrade-authority policy (retained during testing, with burning under consideration once stable) is published rather than implicit.

12 Roadmap

13 Risk disclosures

Perpetual futures are high-risk instruments. Leverage magnifies losses as well as gains, and a position can be fully liquidated. Smart-contract risk, oracle risk (stale or manipulated feeds, especially in thin markets), liquidity risk, and key-management risk all apply. The current release is a testnet preview with simulated fills — no real value is at stake and nothing is executed on-chain. The live release follows external audit and may be unavailable in some jurisdictions. This document is informational, is not financial, legal, or tax advice, and is not an offer of any product.

14 References

← Back to Obscura