Flow of Funds#
Where your money actually lives at every stage of a Seesaw market — from your wallet, through the protocol's on-chain accounts, and back out.
This page is the public-friendly walkthrough. For the on-chain validation model behind every fund movement, see the security model.
The one-paragraph version#
Every dollar you put into Seesaw sits in a program-derived account (PDA) — an on-chain account that only the program's own logic can move money out of. No protocol operator, market creator, or other trader holds a private key to your collateral. The only funds that ever reach an operator-controlled account are earned trading fees, split at trade time. Every exit path (cancel, withdraw, sell, redeem, refund) pays only the owner recorded on the position or order — with one deliberate exception: funds you abandon for more than 7 days after a market resolves can eventually be swept to the market creator at teardown. Claim on time and that exception never touches you (see Risks).
The map#
Three asset types move through the system:
| Asset | Where it lives | What it's for |
|---|---|---|
| Settlement stablecoin (USDT at launch) | Market vault PDA; your wallet | All collateral, payouts, and fees |
| YES / NO share tokens | Your token accounts; escrow PDAs (while sell orders rest) | Tradable claims on the outcome, backed 1:1 |
| SOL (lamports) | Account rent deposits + small prepaid crank rewards | Never trading capital; rent is recoverable |
Stage 1 — Money in#
There are two doors in, and both lead to the market vault:
| Instruction | What happens |
|---|---|
| MintShares (0x07) | You deposit N USDT → the vault; the program mints you N YES and N NO shares. A full pair for every dollar. |
| DepositFunds (0x08) | You deposit N USDT → the vault; your internal trader-ledger balance is credited N (no tokens minted). |
Pair-minting is why the protocol can always pay winners: every YES+NO pair in existence corresponds to exactly one stablecoin unit sitting in the vault. Only one side can win, so the vault always covers the payout (the solvency invariant).
Placing a buy order also moves money in: the order's collateral
(shares × price) transfers from your wallet into the vault and stays
locked under your order until it fills or you cancel.
Stage 2 — Trading: fills move existing money, never create it#
A match on the order book is a transfer, not a mint:
- A resting sell order has already escrowed real share tokens in the market's YES or NO escrow PDA. When it fills, those shares move from escrow to the buyer.
- A resting buy order has already locked stablecoin in the vault. When it fills, the seller's proceeds are paid out of the vault.
- The taker fee (the only fee — makers pay zero) is carved out of the fill and split immediately: 50% protocol / 10% market creator / 40% referrer (see Treasury & Fee Split and Referrals).
"Free funds" order variants (0x0D–0x0F) trade against your internal trader-ledger balances instead of your wallet — same vault, same rules, just no token transfer per order.
Stage 3 — Money out, any time trading is open#
Nothing locks you in while a market is live:
| Exit | Instruction(s) | Where the money goes |
|---|---|---|
| Cancel a buy order | CancelOrder (0x10–0x13) | Locked collateral: vault → your wallet |
| Cancel a sell order | CancelOrder | Escrowed shares: escrow → your share account |
| Withdraw ledger balance | WithdrawFunds (0x09) | Free balance: vault → your wallet |
| Materialize ledger shares | WithdrawShares (0x0A) | Shares minted to your account (fully backed) |
| Sell your shares | PlaceOrder | Proceeds: vault → you, at the fill price |
| Reclaim an expired order | ReclaimExpiredOrder (0x19) | Refund to the maker; the permissionless caller may take a 10 bps bounty (capped at 0.1 stablecoin) |
Stage 4 — Settlement#
When the market resolves, every share converts to stablecoin at a fixed rate set solely by the oracle outcome:
| Outcome | YES pays | NO pays |
|---|---|---|
| UP (end ≥ start) | 1.00 (full) | 0 |
| DOWN | 0 | 1.00 (full) |
| EXPIRED (no oracle) | 0.50 | 0.50 |
Redeem (0x1A) burns your shares and pays you from the vault. One call also drains your free ledger balance and — after resolution — releases collateral still locked under buy orders that never filled. Payouts round down; fees round up: rounding always favors the protocol's solvency, by design.
Two permissionless safety nets exist for stuck or abandoned situations:
- ForceClose (0x1B) — for a market that expired without resolving: refunds a position's locked order collateral to the position owner.
- MarkPositionSettled (0x1C) — after the 7-day grace window: a third party can settle an abandoned position, and the owed value is paid to the owner, never to the caller.
Stage 5 — The 7-day clock and teardown#
This is the one stage where inaction can cost you money:
- Days 0–7 after resolution: only you can settle your position. Redeem pays out everything you're owed.
- After day 7: the market becomes eligible for cleanup.
MarkPositionSettledpays abandoned positions to their owners — but nobody is obligated to run it, and abandoned unfilled buy-order collateral can be removed without refund on the terminal path. - CloseMarket (0x1E) finally tears the market down (it requires: 7 days elapsed, all positions settled, zero outstanding shares, creator fees disbursed). Any residual vault dust and abandoned terminal-forfeit value is swept to the market creator — permanently.
The rule: claim within 7 days of resolution. Full details and the risk framing in Risks and Claiming Winnings.
SOL rent: a round trip#
Solana accounts require rent deposits. Every lamport comes back:
| Account | Rent paid by | Returned to (at close) |
|---|---|---|
| Your position account | You | You (ClosePosition 0x1D) |
| Market, order book, vault, mints, escrows | Market creator | Market creator |
| Prepaid crank rewards (5 × 0.0002 SOL) | Market creator | Paid to lifecycle crankers; any unused remainder returns with market rent |
Appendix: every fund movement (reference)#
| Stage | Instruction | Stablecoin movement | Who can receive |
|---|---|---|---|
| In | MintShares (0x07) | You → vault (pair-mints YES+NO to you) | — |
| In | DepositFunds (0x08) | You → vault (ledger credit) | — |
| In | PlaceOrder bid (0x0B) | You → vault (locked under order) | — |
| Trading | PlaceOrder fill | Vault → seller; vault → fee recipients (50/10/40) | Maker, treasury, creator, referrer |
| Out | CancelOrder (0x10–0x13) | Vault → order owner (bids); escrow → owner (asks) | Order owner only |
| Out | WithdrawFunds (0x09) | Vault → you (free balance only) | Signing trader only |
| Out | ReclaimExpiredOrder (0x19) | Vault/escrow → maker (+ ≤0.1 USDT caller bounty) | Maker; caller (bounty only) |
| Settlement | Redeem (0x1A) | Vault → holder, at the outcome rate | Share holder only |
| Settlement | ForceClose (0x1B) | Vault → position owner (expired markets) | Position owner only |
| Settlement | MarkPositionSettled (0x1C) | Vault → position owner (post-grace sweep) | Position owner only |
| Fees | ClaimCreatorFees (0x23) | Vault → market creator (destination fixed) | Market creator only |
| Fees | ClaimReferrerEarnings (0x24) | Referrer treasury shard → referrer | Referrer only (must sign) |
| Teardown | CloseMarket (0x1E) | Residual dust + abandoned value → market creator | Market creator |
Related docs#
- Risks — the unclaimed-funds risk and how to avoid it
- Settlement — payout mechanics in depth
- Treasury & Fee Split and Referrals — where fees go