How PROPHIT works, in detail.

The program enforces six invariants that make PROPHIT a capital-allocating protocol rather than a trust-me trading sheet. These run inside the execute_trade / resolve_market instructions and cannot be bypassed by the UI or the worker.

• Platform TVL cap — platform cannot hold more than max_tvl USDC across all agent vaults combined.
• Per-position cap (10%) — a single execute_trade cannot exceed 10% of agent bankroll. Enforced againstbankroll_current, not initial.
• Market share cap (5%) — no agent can hold more than 5% of a market’s combined YES+NO pool. Prevents single-agent cornering.
• Slippage guard (≤2%) — |actual - expected| ≤ 200 bps, else the tx reverts. Uses expected_price_bpscommitted at signing time.
• Drawdown auto-pause (30%) — if (peak - current) / peak > max_drawdown_bps, the program atomically flips the agent to paused in the same tx as the losing trade.
• Commit-reveal resolution — admin posts sha256(reveal) at market creation; resolution requires the preimage. Prevents outcome rugging after trades land.

When user A creates an agent and user B calls copy_agent with that agent’s id, the program stamps parent_agent_id on the new agent. Every downstream execute_trade on the child agent invokes pay_royalty, which streams copy_royalty_bps / 10_000 of that trade’s positive PnL from the child vault to the parent creator’s wallet.

Why this only works on Solana. A child taking 20 trades a day at $5 each pays ~$0.02 royalties per trade. On Ethereum L1 the base tx fee alone would dwarf the payment. On Solana this royalty stream is economically viable. It’s the reason the top copyable agent model exists here and not on EVM.

The platform keeps a small platform_cut_of_royalty_bps (default 10%) of each royalty payment — the business model is creator-aligned, not fee-trap.

Every tick (~60s on the worker, 5min on GitHub Actions cron) the platform pulls live prices from Polymarket’s Gamma API and Manifold Markets’ search API. Rows land in external_markets with UNIQUE(source, external_id) upsert; snapshots land in external_market_snapshots so the price chart on each market detail page has real time-series.

When an agent’s decide() runs, we pre-load the linked external reference per candidate market. Groq sees something like: MARKET 2001 · “BTC above $110k” · PROPHIT=50% · Manifold=3% · spread=+47% · ext_vol=$12.5M, and the system prompt instructs it to prefer the external side on ≥5% spreads unless the thesis gives specific reason to disagree. That’s the arb narrative: agents trade the mispricing between PROPHIT’s pool and the real-world consensus.

Polymarket is the primary signal (deep liquidity, real money). Manifold is the global-reachability fallback (Polymarket is geo-blocked on several ISPs). Kalshi support is plumbed in but not yet active; the oracle pipeline accepts arbitrary source values.

Every agent is bound at creation to an immutable executor public key. That keypair signs every execute_trade and close_position for the agent. Even an agent owner cannot issue a trade directly — they can only pause, resume, retire, deposit, or withdraw.

This separation means the executor (run by PROPHIT infra) is the only party who can make bad trades; the owner is the only party who can touch funds. Compromise one key, you don’t own the other’s half of the attack surface.

• programs/prophit/ — Anchor program, Rust. 13 instructions, 4 account types (Platform, Market, Agent, Position, Trade).
• packages/sdk/ — hand-rolled TypeScript instruction builders using @solana/web3.js primitives + borsh encoding + sha256 discriminators. IDL-free because Anchor’s IDL generator breaks under Rust 1.95 proc-macro2.
• apps/worker/ — continuous trading loop. decide.ts (Groq tool call) → execute.ts (executor-signed tx) → resolve.ts (CoinGecko oracle for BTC markets, UMA/gamma for external). Syncs Polymarket + Manifold every tick.
• apps/web/ — Next.js 14 App Router. Phantom SIWS, all the UI surfaces, server-signed close-position route, Groq-powered market-insights endpoint.