Docs · Concepts
Architecture
reel's programs on Solana in one map: what each one does, the vault authority they share, the accounts they keep, and what the admin can and can't do.
Three programs
Ajvhesd3q6yJFgnBL6vppAJDF7gP6nmksA8WkrTM4vcJ. reel and reel-hook were reviewed and verified end to end on Solana mainnet; their upgrade authority is the reel treasury, BA9VJD2ux2XtQ1diiurBR9pmgqtb33ivs6H8fmSgNPXr. reel-vaults, the periphery program, is verified on mainnet module by module, and its upgrade authority moves to the treasury when that finishes.| Program | Id | What it does |
|---|---|---|
| reel | Ajvhesd3q6yJFgnBL6vppAJDF7gP6nmksA8WkrTM4vcJ | Constant-product pools with the Hook Block pipeline, the launcher, positions, claims and the registries (roots, saved hooks, integrators, referrals, agents, the Hook Blocks Market) |
| reel-hook | oF7b3JDvBhT34SjHPsC1xiZrkgNKwFzPncTxk2TYGdx | The Token-2022 transfer hook of every token reel launches. Holds no funds and never moves tokens |
| reel-vaults | 98oS15W2xt8fa4NCZvHMEv6ZdzVEVeu45prSt85Mb7fK | Periphery beside the pools, off the swap path. Live on Solana mainnet: Holder Pot payouts; the Fee Bridge; the Revenue Router; the recovery reserve; limit orders and the Floor bid, with fill bounties. Deployed, and opens Nov 12 once its mainnet check passes: funded referral and points campaigns. Coming with an upgrade at the same address: Vesting Milestone and Dev Drip; zap vaults, Pool Mesh and Family Pinger; the LP Time-Lock Boost; the Revenue Tokenizer; Pay Later; the Entry Ratio Guarantee. |
reel is written in Pinocchio for SBPF v3. Other venues are planned only at the edges (a locker, a lane for exotic quotes), never on the swap path of a reel pool; limit orders and floor bids run in reel-vaults. Naming a venue implies no partnership.
Why the hook is its own program
Solana lets a program call itself directly, but not re-enter through another program: reel → Token-2022 → reel fails with ReentrancyNotAllowed. A pool sending its own token would trigger exactly that if the hook lived inside reel. So reel-hook is a small separate program. It reads reel's accounts and writes only its own HookHolder records.
A Token-2022 hook runs after balances move and can only allow or refuse a transfer. It can't take a fee or redirect tokens, and it doesn't run on mint or burn. That's why every tax on reel is charged in the pool, and the hook only enforces rules.
VAULT_AUTH
VAULT_AUTH is one PDA, ["vault_auth"] under the reel program, and it owns every token account reel holds: pool vaults, launch escrows, claims vaults and bond vaults. It signs every transfer out of them. Its address: 63XMzPvCCSWq9ygsgshA6bJg5buZNJ3FX6e6YDVrSZ5S.
reel-hook recognises reel's vaults by that owner. reel itself never trusts the owner alone: every instruction checks a vault's address against the pool, launch or mint it belongs to. A vault can only pay (a) the trader in a swap, (b) a position's owner on a remove or a fee collect, (c) a bucket's fixed recipient, (d) the claims vault for a ledger credit, or (e) the burn.
Accounts
Every account starts with an 8-byte tag and stores its canonical bump. Every PDA below is under the reel program unless noted.
| Account | Seeds | Created by |
|---|---|---|
| Config | ["config"] | InitConfig |
| Root | ["root", id] | InitConfig (root 0), RootCreate |
| QuoteListing | ["quote", mint] | QuoteList (admin) |
| Integrator | ["integrator", wallet] | IntegratorSet (admin) |
| SavedHook | ["hook", owner, salt, version] | HookSave |
| Launch | ["launch", base_mint, nonce] | LaunchCreate |
| MintGuard | ["mintguard", mint] | LaunchCreate (new token) |
| Pool | ["pool", root, base_mint, quote_mint, index] | PoolInit |
| Pool vault | ["vault", pool, mint] | PoolSeed |
| Position | ["position", pool, seed_key, nonce] | PositionOpen, PoolSeed, PositionSplit |
| ClaimLedger | ["ledger", wallet, mint] | LedgerOpen (anyone pays) |
| Claims vault | ["claims", mint] | ClaimsVaultOpen |
| WalletCounter | ["wcount", launch, wallet] | WalletCounterOpen |
| Agent | ["agent", wallet] | AgentRegister |
| Referrer | ["referrer", wallet], ["refcode", code] | ReferrerRegister |
| ReferralLink | ["reflink", wallet] | ReferralLink |
| MarketBlock | ["mblock", block_id] | MarketPublish |
| HookHolder (reel-hook) | ["holder", mint, wallet] | reel-hook HolderInit |
| Extra metas (reel-hook) | ["extra-account-metas", mint] | reel-hook InitializeExtraAccountMetaList |
Instruction tags, errors and events are in the errors and events reference; byte layouts ship with the SDK (sdk/src/layouts.json).
What a swap does, in order
- Check the accounts and that the pool is live; read the clock.
- Advance time-driven state: release the LP stream, step the dynamic-fee reference, roll the Storm sample, lapse the managed fee.
- Run the gates: buy pause, sell lock, exact-out during the guard, zap-target feeders, the agent gate, and Market Guard's oracle.
- Price the swap on the curve and compute every charge on the gross amount.
- Charge arbitrage recapture, if the pool runs it and its reference is fresh.
- Settle the amounts and the burn, then the bookkeeping: Wallet Cap, King of the Pool, the gap opener, the sandwich window and the counters.
- Move tokens in, then out (signed by
VAULT_AUTH), then the burn, the ledger credits and any reward mint. - Check that every vault still covers what the pool owes.
Admin powers
The admin is Config.admin, transferable in two steps. Every power is listed here.
Can: set the treasury, the fee keeper and the bond mint; set fees for future pools and launches within bounds (launch fee ≤ 0.01 SOL, root fee ≤ 1 SOL, minimum fee ≤ 1%, share floor 20–50%, referral ≤ 50%, recapture protocol ≤ 25%, integrator ≤ 50%); list quotes and integrators; keep the market-hours calendar; admit market blocks; set a pool's deposit cap, which only gates new deposits; pause new pools, launches or roots.
Can't: move user funds or any bucket anywhere but its fixed recipient; change a pool's parameters; pause swaps, withdrawals, fee collection or claims; mint, freeze, or change a mint's hook.
The fee keeper (Config.fee_keeper, set by the admin) records and drips every Fee Bridge in reel-vaults. It chooses when, within each bridge's max_per_drip per min_interval, and can't send a bridge's funds anywhere but its destination pool's LP stream and the drip tip. After 7 days without a keeper call on a bridge, anyone may record and drip it under the same caps.