permissionless perp engine for solana memecoins. any printr / pump.fun token gets a leveraged market in 60s. up to 20×. coin-margined. fully onchain.
follow @cookolator on x for devnet drops, market launches, and the occasional kitchen pic.
inspired by @aeyakovenko's percolator — but cookolator is the shipping version, tuned for memes:
- haircut + A/K lazy indices from the percolator spec, but with per-token warmup calibrated to memecoin velocity (seconds, not minutes)
- no ADL queues, no frontrun — the math settles everyone proportionally
- 1 USDC mainnet → 5,000 USDC devnet, built-in sybil gate
- 82% of fees to insurance LPs. forever. uncapped.
percolator is the research paper. cookolator is the frying pan. 🍳
devnet soon.
⚠️ NOT AUDITED. RESEARCH ENGINE. Do not put real money into this until at minimum a third-party review. The engine math is inherited from percolator and verified with Kani; the memecoin wrapper around it is fresh code.
a perp risk engine, in rust, no_std, that you point at any spl token and it gives you a coin-margined perpetual market in one transaction. no governance. no listing committee. no human-in-the-loop.
a memecoin gets price action; cookolator gives it leverage. the moment a token is launched on printr or pump.fun, anyone can crank a init_market ix against the cookolator program and an ungated 20× perp market exists for that token, with funding, liquidations, insurance, and ADL all running off the same engine.
the trick is that there is no human-discretion path anywhere in the hot loop. liquidations don't pick targets. ADL doesn't enqueue. fees don't get taken in the engine — they get earmarked. funding, mark, and overhang propagate through three pure scalar indices (A, K, F) that every account lazily reads when next touched. order-independent. crank-safe. solana-shaped.
the existing perp DEXes on solana don't list memecoins because their risk machinery wasn't built for assets that 6× in twelve seconds. when an oracle moves faster than a crank, classic engines either:
- let the live book repriceuncapped → bad debt instantly
- pause and call an admin → defeats the point of being onchain
cookolator inherits percolator's third invariant — the price/funding envelope — which says: exposed cranks can only walk the engine forward by one risk-budgeted step at a time, no matter what the oracle says. a memecoin that spikes 50% in a slot doesn't blow up the vault — it gets stair-stepped through capped effective prices, and the wrapper carries the unmatched delta on its own balance sheet.
this is the only known way to ship leverage on assets that move faster than the crank cadence without delegating risk to a human.
cookolator keeps the three percolator invariants verbatim. they are the math that lets the engine run without an operator.
capital is senior. profit is junior. a single global ratio determines how much released positive PnL is actually backed by the vault.
Residual = max(0, V - C_tot - I)
min(Residual, PNL_matured_pos_tot)
h = ----------------------------------
PNL_matured_pos_tot
if fully backed, h = 1. if stressed, h < 1. every profitable account sees the same fraction of its released positive PnL. nobody jumps the queue, because there is no queue.
when a leveraged account goes bankrupt, the residual deficit is socialised through three lazy side-indices instead of a force-close queue:
- A — scales every effective position equally
- K — accumulates mark and ADL overhang
- F — accumulates funding
effective_pos(i) = floor(basis_i * A / a_basis_i)
pnl_delta(i) = floor(|basis_i| * ((K - k_snap_i) * FUNDING_DEN + (F - f_snap_i))
/ (a_basis_i * POS_SCALE * FUNDING_DEN))
settlement is O(1) per account, order-independent, and nobody is singled out. a side that drains is reset deterministically through DrainOnly → ResetPending → Normal.
an exposed crank can only walk the engine through a price/funding step that fits inside the configured one-step risk budget. a memecoin that 3×s in two slots gets cranked as a capped staircase, not a single jump. the envelope is the reason this engine can carry memecoins.
abs(P_new - P_last) * 10_000
<= max_price_move_bps_per_slot * dt * P_last
cookolator tunes max_price_move_bps_per_slot per market based on token velocity rather than a global constant — that is the one piece of the math we touch.
| percolator | cookolator | |
|---|---|---|
| target | research perp engine | shipping perp engine for memecoins |
| audience | exchange builders | retail traders + market makers |
| envelope tuning | global constant | per-token, calibrated to realised volatility |
| warmup | minutes | seconds (memecoin velocity) |
| listing | manual | permissionless init_market |
| sybil gate | not in scope | 1 USDC mainnet / 5,000 USDC devnet faucet rule |
| fee split | not in scope | 82% to insurance LPs forever, uncapped |
| ADL | math-based, no queue | math-based, no queue |
| status | research, kani-verified | research wrapper, devnet soon |
the engine math is unchanged. cookolator is the deployable wrapper around it: solana program, market factory, oracle adapter, fee router, insurance vault, faucet rules.
every market in cookolator routes fees the same way:
- 82% → insurance LP vault (uncapped, forever)
- 9% → cooks (the people who pop a market into existence — paid out of the first 30 days of that market's fees)
- 9% → protocol multisig (treasury — used for audits and infra)
insurance LPs are the senior leg. they earn 82% of every fill on every market in exchange for catching residual deficit when H falls below 1. when the vault is stressed, LPs absorb the haircut pro-rata. when it's healthy, they print.
LP receipts are vault shares — share_price = (V + I) / total_shares, accrued continuously, redeemable after a 24h delay.
mainnet → 1 USDC fee per market init, refundable on first 30d > $10k OI
devnet → 5,000 USDC dust faucet, rate-limited per pubkey
faucet rule is enforced by the same engine that does PnL math: a pubkey that has already drawn from the devnet faucet inside the last 24 hours fails the next init_market closed.
cookolator is pre-devnet as of this commit. roadmap:
- fork + rebrand from percolator
- memecoin-velocity envelope tuning
- permissionless
init_marketflow - insurance-vault accounting (82% routing)
- sybil-gate ix (faucet rule + 1 USDC init fee)
- oracle adapter for printr + pump.fun pools
- devnet deploy
- third-party audit
- mainnet candidate
cookolator is the same no_std rust crate as percolator with a renamed lib. the kani harnesses still run.
cargo install --locked kani-verifier
cargo kani setup
cargo kani
# run the regular test suite
cargo test --features testcookolator is downstream of aeyakovenko/percolator. the H + A/K/F + envelope math, the kani harnesses, and the i128 wide-math primitives are all from there. read the percolator spec first — spec.md in this repo is the same document.
percolator is the research paper. cookolator is the frying pan.
apache-2.0, same as percolator.