How Hushfill fills
a big order quietly.

Hushfill is a Solana program and a desk for tokenized stocks (xStocks). You place one order with a limit; the program holds your funds in the order's own vault and only lets fills through at your limit or better. Fills come from two places: other Hushfill orders on the other side, crossed off the pool, and small slices routed through Jupiter. When the order is done, or its time is up, everything comes back to your wallet.

01How it works

1. —Place. Pick a stock, buy with USDC or sell the tokens you hold, set your limit, slice size and expiry. One signature moves the funds into your order's vault.
2. —Cross. Every minute the keeper looks for orders on the other side whose limit overlaps yours. They trade with each other at the midpoint of both limits. No pool is touched, so there is no price impact.
3. —Slice. What is left fills a slice at a time through Jupiter, at most one slice per order per minute, and only when the quote clears your limit. The program checks the result again.
4. —Deliver. When the order is filled or expired, the keeper closes it: what you bought, what was left and the rent of every account go back to your wallet. You can close it yourself at any time.

02Orders

An order is an account of the Hushfill program, derived from your wallet and a nonce, with two token accounts it controls: the input vault (USDC for a buy, the stock token for a sell) and the output vault. It records:

• —side buy or sell, and the stock token it trades against USDC.
• —amount the input you deposited. filled_in and filled_out track what has been used and received.
• —limit USDC per whole stock token: the most a buy pays, the least a sell takes. It is set in the token's on-chain units; the desk converts the price your wallet shows using the token's scaled-UI multiplier.
• —slice_max the largest slice, and interval the seconds between slices (60 on the desk).
• —expires between one minute and seven days ahead. After it, nothing fills and the keeper returns the funds.

03Rules the program enforces

These are checks in the program, not policies. When one would fail, the whole transaction fails and nothing moves.

• —A buy never fills above its limit and a sell never below it, in crosses and in slices, rounded in your favour.
• —A slice is all or nothing: slice_begin hands at most slice_max to the keeper and refuses to run unless a matching slice_end for the same order follows in the same transaction; slice_end checks that the keeper's token account is back where it started and that your output vault grew by at least what your limit requires.
• —The output of a slice must land in your order's vault. Diverting it, keeping one atom of the input, or pairing a slice with another order's end are all refused (each one is a test).
• —Only the Config's keeper key can cross or slice. Only you can close your order early; the keeper can close it only once it is filled (less than one cent left) or expired, and the funds still go to you.
• —Pausing the desk stops new orders, crosses and slices. It never stops a close.

04Crosses

A buy and a sell on the same stock cross when the buy's limit is at or above the sell's. The price is the midpoint of the two limits, so both get their limit or better. The size is the most both have left, and the buyer's fee is reserved first. The stock goes from the seller's vault to the buyer's, the USDC the other way, and neither touches a pool.

05Slices

Each minute, for every order not yet filled, the keeper asks Jupiter for the best route of one slice. If the quote would land past the order's limit, the slice is skipped and the order waits. Otherwise it sends one transaction: slice_begin, the Jupiter swap paying straight into your order's output vault, then slice_end. Splitting a big order this way lets the pools refill between slices, which is where the savings come from; your limit holds regardless.

06Closing and cancelling

Closing an order sends the unused input and everything bought to your wallet, closes both vaults and the order account, and returns all of their rent to you (about 0.01 SOL). On the desk, Cancel does this for an open order and Collect for a filled one. The keeper does it by itself once an order is filled or expired.

07Fees

• —0.10% of the USDC side of every fill, crossed or sliced, to the Hushfill treasury. A buy pays it on top of the USDC swapped, a sell from the proceeds. The program caps it at 1%.
• —Slices also pay the pool fee of their route, as any swap does, plus Solana network fees, paid by the keeper.
• —Placing, cancelling and collecting are free; the rent you put down comes back.

08The stock tokens

The desk trades 20 xStocks, issued by Backed on Solana: NVDAx, TSLAx, SPYx, QQQx, AAPLx, METAx, GOOGLx, AMZNx, MSFTx, COINx, HOODx, MSTRx, CRCLx, GLDx, SPCXx, NFLXx, PLTRx, AVGOx, GMEx, MCDx. They are Token-2022 tokens with eight decimals and a scaled UI amount: wallets show the on-chain amount times a multiplier the issuer updates for dividends and corporate actions. Their issuer keeps controls over them (it can pause transfers and move tokens), and sets where they may be held. Hushfill does not issue them, hold the underlying shares or vouch for their backing.

09Addresses

The program is built and tested; it opens on Solana mainnet tonight. It stays upgradeable until an outside audit, so fixes can ship fast; the upgrade authority is the deployer key.

10Risks

• —Smart-contract risk: the program is tested (including a keeper that tries to cheat) but not audited yet.
• —Market risk: a limit caps your price, it does not stop the stock from moving. An order can fill and the stock keep falling.
• —Fill risk: if the market stays past your limit, your order may not fill before it expires. Nothing is lost; the funds come back.
• —Issuer risk: the stock tokens depend on their issuer, who can pause or move them and decides who may hold them.
• —Not available where these tokens are restricted, including to US persons under the issuer's terms. You are responsible for the laws that apply to you.

11HUSHFILL

HUSHFILL is the project's coin on Solana. Its contract address shows on the home page and the desk once it is live. Fees go to the Hushfill treasury.