Instruction Account & Validation Reference#
This reference lists, for every Seesaw instruction, the accounts it expects and the validation it performs on them. Integrators building transactions can use it to assemble the correct account list and to understand which conditions cause a given instruction to reject.
The 51 public instructions occupy a contiguous discriminator range 0x00–0x32. A single internal binary event recorder is isolated at 0xFF and is never invoked directly by users.
Legend: S = signer, W = writable, R = read-only, PDA = program-derived address validation, ATA = SPL token account mint/authority validation.
Shared Validation Primitives#
| Primitive | Validation performed |
|---|---|
load_config_context | Program owner, exact size, account discriminator, config PDA/bump, authority fields, treasury recipients, settlement mint, fee/limit/pause/post-only fields. |
load_market_context | Program owner, exact size, account discriminator, market PDA derived from feed id/duration/market id/creator/bump, settlement mint, vault/escrow/mint bumps, emergency status, dynamic num_seats. |
load_orderbook_context | Program owner, exact size, discriminator, orderbook.market == market, orderbook PDA. |
load_position_context | Program owner, exact size, discriminator, position PDA from market/owner/bump. |
load_trader_ledger_context | Dynamic v2 ledger only: nonzero market seat count, header market/capacity, exact PDA. |
| Token loaders | SPL Token v1 owner/layout, mint equality, authority equality, vault/escrow/mint PDAs, treasury-recipient index/address binding, referrer-treasury shard PDA and authority. |
| Recorder tail splitter | Fixed-shape processors accept either exact base accounts or exact base + self-program + log-authority. Lone recorder accounts and surplus accounts reject. |
| Referral triple loader | Place-order referral accounts are all-or-none and exact: referral PDA, referrer earnings PDA, treasury shard PDA, expiry, referee/referrer identity, treasury index, mint, and authority all validate. |
Instruction Matrix#
| Disc | Instruction | Accounts received | Current validation |
|---|---|---|---|
0x00 | InitializeConfig | config W, authority S/W, treasury_recipient_0..7 R, default_settlement_mint R, system_program R, program_data R | Exact 13 base accounts or recorder tail. Authority signs. Config PDA is uninitialized/system/rent-valid. Settlement mint is valid. All 8 treasury recipients are SPL Token v1 accounts for the default mint, nonzero, and pairwise distinct. Program-data account is owned by the upgradeable loader and its upgrade authority equals authority. Fee, tick, duration, and limit args validate before write. |
0x01 | UpdateAuthority | config W, authority S | Exact 2 base accounts or recorder tail. Current authority signs. Nonzero self-succession rejects. Zero new authority is the explicit pending-rotation cancel sentinel. |
0x02 | ClaimAuthority | config W, pending_authority S | Exact 2 base accounts or recorder tail. Pending authority signs. 48h timelock must have elapsed. Pending authority fields clear after claim. |
0x03 | CreateMarket | market W, orderbook W, vault W, yes_mint W, no_mint W, asset_state W, config W, pyth_feed R, settlement_mint R, payer S/W, system_program R, token_program R, yes_escrow W, no_escrow W, trader_ledger W | Exact 15 base accounts or recorder tail. Config not paused. Payer signs. Current 26-byte payload only: confidence guard, duration, oracle jump guard, canonical 512/512 book sizes, valid dynamic seat count. Current epoch, duration bounds, Pyth owner/feed/freshness/confidence/jump checks, settlement mint, all PDAs, writable account distinctness, fee config, and dynamic ledger initialization validate. |
0x04 | SnapshotEnd | market W, pyth_feed R, caller S/W, config R | Exact 4 base accounts or recorder tail. Caller signs. Config and market load. Pyth feed address/id/owner/freshness/confidence validate. End snapshot is idempotent and closer reward is paid only on state update with rent-safe lamport arithmetic. |
0x05 | ResolveMarket | market W, asset_state W, caller S/W, config R, vault W, creator_token_account W, settlement_mint R, token_program R | Exact 8 base accounts or recorder tail. Caller signs. Config, market, asset-state PDA/feed binding, state transition, outcome computation, vault mint/authority, creator destination mint/authority, and creator-fee disbursement/defer logic validate. Already-resolved idempotence still validates asset-state binding. |
0x06 | ExpireMarket | Base: market W, asset_state R, caller S/W, config R, vault W, creator_token_account W, settlement_mint R, token_program R. Optional exact pyth_feed R late-resolution group. | Exact 8 or 9 base accounts, optionally recorder tail. Caller signs. Config/market/asset-state/feed binding, expiry eligibility, optional late Pyth capture, fallback expiry, closer reward, and creator-fee transfer/defer token checks validate. |
0x07 | MintShares | market W, yes_mint W, no_mint W, user_yes_ata W, user_no_ata W, user_stablecoin_ata W, vault W, user S, config R, token_program R, settlement_mint R | Exact 11 base accounts or recorder tail. User signs. Config/market/token context validates. Amount, trading window, pause, emergency, cap, vault post-balance, and market solvency checks run. |
0x08 | DepositFunds | market W, trader_ledger W, user_position W, user_stablecoin_ata W, vault W, user S/W, config R, token_program R, settlement_mint R | Exact 9 base accounts or recorder tail. User signs. Config/market/position/ledger load. Config pause enforced. Vault, settlement mint, and user ATA mint/authority validate. Nonzero amount transfers to vault and credits signer-keyed slot.quote_free. |
0x09 | WithdrawFunds | Same as DepositFunds | Exact 9 base accounts or recorder tail. User signs. Config/market/position/ledger load. Position binds to user/market. Vault, settlement mint, and user ATA validate. Available slot.quote_free is debited before market-signed SPL transfer to user. |
0x0A | WithdrawShares | market W, user_position W, selected mint W, user_token_account W, user S, config R, token_program R, orderbook W, trader_ledger W, optional exact settlement-cleanup group | Exact base shape plus product-required cleanup group/recorder tail. User signs. Config/market/orderbook/position/trader-ledger load. Token type selects canonical YES/NO mint PDA. User token account mint/authority validate before debiting ledger free shares and minting SPL shares. |
0x0B | PlaceOrder | 18 base place accounts: market, orderbook, position, user stablecoin/vault/treasury token accounts, user S/W, config, token/system programs, settlement/share mints, YES/NO escrows, user YES/NO ATAs, trader ledger; optional exact referral triple and/or recorder tail | User signs. Exact allowed account totals only. Config, market, orderbook, position binding, trader-ledger slot, token/PDA bundle, pause/emergency, order args, self-trade behavior, match limit, expiry, post-only/IOC policy, treasury index/address, maker price band, fee conservation, and optional referral triple validate before settlement. |
0x0C | PlaceMultiplePostOnlyOrders | Same place-order surface | User signs. Shared place-order loaders validate once. Every batch entry must be post-only, in limits, within maker price band, and non-crossing under the reject flag. Any invalid entry reverts the whole instruction. |
0x0D | SwapWithFreeFunds | Same place-order surface | User signs. Shared place-order validation. Wrapper coerces IOC/take-only semantics and routes user-side collateral/share movement through trader-ledger free buckets. Fee/referral token CPIs still use the validated token bundle. |
0x0E | PlaceLimitOrderWithFreeFunds | Same place-order surface | User signs. Shared place-order validation. IOC/take-only payloads reject at wrapper boundary; resting user-side settlement routes through free funds. |
0x0F | PlaceMultiplePostOnlyOrdersWithFreeFunds | Same place-order surface | User signs. Shared place-order validation and atomic post-only batch semantics; user-side settlement routes through free funds. |
0x10 | CancelOrder | 15 cancel/refund accounts: market, orderbook, position, user token account, vault, user S, token program, settlement mint, YES/NO escrows, user YES/NO ATAs, YES/NO mints, trader ledger | Exact 15 base accounts or recorder tail. User signs. Market/orderbook/position/ledger bind. Market cancelability and token refund bundle validate. Target order must exist and belong to the position. |
0x11 | CancelMultipleOrdersById | Same cancel/refund surface | Exact 15 base accounts or recorder tail. User signs. Empty explicit id list rejects. Each order id must exist and belong to the position before cancel/refund. |
0x12 | CancelAllOrders | Same cancel/refund surface | Exact 15 base accounts or recorder tail. User signs and position binds before scanning. Empty owned set is a post-validation no-op. Scan/cancel loop is bounded by MAX_BULK_CANCEL_LIMIT. |
0x13 | CancelUpTo | Same cancel/refund surface | Exact 15 base accounts or recorder tail. User signs. Side, price threshold, max count, owner, and market cancelability validate before bounded scan/refund. |
0x14 | ReduceOrder | Same cancel/refund surface | Exact 15 base accounts or recorder tail. User signs. Target order owner and nonzero reduce quantity validate. Full-size delegates to cancel; partial reduce preserves priority and releases exact collateral/share delta. |
0x15 | CancelMultipleOrdersByIdWithFreeFunds | Lean FF cancel accounts: market W, orderbook W, user_position W, user S, trader_ledger W | Exact 5 base accounts or recorder tail. User signs. Market/orderbook/position/ledger bind. Each id must exist and belong to the position. Refunds credit slot.{quote,yes,no}_free; no token refund accounts are accepted. |
0x16 | CancelAllOrdersWithFreeFunds | Same lean FF cancel surface | Exact 5 base accounts or recorder tail. User signs and position binds before scanning. Empty set is post-validation no-op. Loop is bounded. |
0x17 | CancelUpToWithFreeFunds | Same lean FF cancel surface | Exact 5 base accounts or recorder tail. User signs. Side/price/max-count/owner criteria mirror CancelUpTo; refunds route to ledger free buckets. |
0x18 | ReduceOrderWithFreeFunds | Same lean FF cancel surface | Exact 5 base accounts or recorder tail. User signs. Full-size delegates to lean FF cancel; partial reduce releases quote/YES/NO locks into free buckets. |
0x19 | ReclaimExpiredOrder | 16 reclaim accounts: market, orderbook, maker position, maker token account, vault, maker R, caller S, token program, settlement mint, YES/NO escrows, maker YES/NO ATAs, YES/NO mints, trader ledger; optional exact caller bounty ATA | Exact 16 or 17 base accounts, optionally recorder tail. Caller signs. Market/orderbook/position/ledger/token bundle validate. Order must exist, belong to maker, and be expired/claimable. Bounty ATA validates mint/authority when supplied. |
0x1A | Redeem | Token-only shape: market, YES/NO mints, user YES/NO ATAs, user stablecoin ATA, vault, user S when amount > 0, token program, settlement mint. Position-settlement shape adds user position, orderbook, trader ledger. | Exact 10 or 13 account product shape, optionally recorder tail. Market must be redeemable. Token context validates. Position shape binds position/orderbook/ledger, debits ledger free shares first, burns SPL remainder, transfers payout, and advances settled count only when all buckets are empty. |
0x1B | ForceClose | market W, position W, vault W, user_stablecoin_ata W, caller S/W, config R, token_program R, settlement_mint R, orderbook W, trader_ledger W, YES/NO escrows W, YES/NO mints W | Exact 14 base accounts or recorder tail. Caller signs. Config, market, position, vault, owner ATA, orderbook, dynamic ledger, escrow/mint PDAs validate. Eligibility requires unresolved market past expiration window; resolved/expired outcomes reject. |
0x1C | MarkPositionSettled | position W, market W, trader_ledger W, caller S, vault W, owner_settlement_ata W, settlement_mint R, token_program R (+ optional self_program R, log_authority W recorder tail) | Exact 8 base accounts or optional 2-account recorder tail (10 total). Caller signs. Position PDA/owner/market binding, market terminal/grace state, dynamic ledger PDA/header, and strict post-grace empty-value predicate validate. Owner's redeemable value is transferred from the vault to owner_settlement_ata via a market-signed TransferChecked CPI before the settled counter advances. |
0x1D | ClosePosition | position W, market R, owner W, caller S, system_program R | Exact 5 base accounts or recorder tail. Loads position and market, verifies owner/caller policy, requires closeable settled or erased-market conditions, and closes lamports to owner. |
0x1E | CloseMarket | market W, creator W, caller S, config R, system_program R, vault W, token_program R, orderbook W, YES/NO escrows W, trader_ledger W, creator_stablecoin_ata W | Exact 12 base accounts or recorder tail. Caller signs. System/token programs, config, market, creator, vault, orderbook, escrows, dynamic ledger, and creator ATA validate. Market must be resolved, past timeout, supply/positions/creator-fees drained. Dust sweeps to creator then vault/escrows/market/orderbook/ledger close. |
0x1F | UpdateFeeConfig | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. One-hour cooldown after first update. Fee cap/decay bounds and protocol/creator/referrer shares summing to 10_000 validate before write. |
0x20 | UpdateTreasuryRecipients | config W, authority S, treasury_recipient_0..7 R | Exact 10 base accounts or recorder tail. Authority signs. Rate limit, recipient SPL Token v1 owner/layout, mint equality, nonzero addresses, and pairwise distinctness validate before atomic replacement. |
0x21 | SetReferrer | referral W, referee S/W, referrer R, referrer_earnings R, system_program R | Exact 5 base accounts or recorder tail. Referee signs. Self-referral rejects. Referral PDA must be uninitialized. Referrer earnings PDA must match referrer and be program-owned/typed. |
0x22 | InitReferrerEarningsAccount | referrer_earnings W, referrer S/W, referrer_treasury W, settlement_mint R, config R, system_program R, token_program R | Exact 7 base accounts or recorder tail. Referrer signs and pays rent. Treasury index is in range. Referrer earnings PDA is uninitialized. Settlement mint equals config default. Treasury shard PDA is either valid existing SPL token account or is created with shard PDA authority. |
0x23 | ClaimCreatorFees | market W, vault W, creator_token_account W, settlement_mint R, caller S, token_program R | Exact 6 base accounts or recorder tail. Permissionless caller signs. Market creator pins destination authority. Vault PDA/mint/authority and destination mint/authority validate. Terminal market and nonzero accumulated creator fees required before market-signed transfer and same-amount debit. |
0x24 | ClaimReferrerEarnings | referrer_earnings W, referrer_treasury W, referrer_token_account W, settlement_mint R, referrer S, token_program R, config R | Exact 7 base accounts or recorder tail. Referrer signs. Earnings PDA/type/referrer, nonzero accumulated amount, settlement mint, bounded treasury index, shard PDA/token account, and destination mint/authority validate before shard-signed transfer and same-amount debit. |
0x25 | Pause | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Sets global pause flag. |
0x26 | Unpause | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Clears global pause flag. |
0x27 | EnablePostOnlyMode | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Enables global post-only mode. |
0x28 | DisablePostOnlyMode | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Disables global post-only mode. |
0x29 | UpdateTickSize | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Tick size bounds/divisibility validate before write. |
0x2A | UpdateMinRestingNotional | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Minimum resting notional validates before write. |
0x2B | UpdateMarketCap | market W, config R, authority S | Exact 3 base accounts or recorder tail. Protocol admin or market creator signs. Market must be trading. Nonzero cap cannot be below current YES/NO supply; zero clears cap. |
0x2C | SetMarketEmergencyStatus | config R, market W, authority S | Exact 3 base accounts or recorder tail. Protocol admin may set any value; market creator may only set/clear PostOnly while not overriding stronger admin states. Market must be trading. |
0x2D | ForceCancelMarketOrders | config R, market/orderbook/position/vault/escrow/mint/refund token bundle, maker R, authority S, trader ledger W | Exact 17 base accounts or recorder tail. Admin signs. Market must be ForceCancelOnly. Order exists and maker/token/PDA/ledger bundle validate. Cancel/reclaim delta applies before token CPIs; no TTL or bounty path. |
0x2E | EnsureTraderLedgerSpace | payer S/W, trader_ledger W, market R, system_program R | Exact 4 base accounts or optional 2-account recorder tail. Idempotent prelude that grows the trader_ledger PDA past Solana's 10240-byte MAX_PERMITTED_DATA_INCREASE cap; required before CreateMarket when the ledger must be extended. Payer signs. Ledger PDA, header market/capacity, and target seat count validate. No-op if already at or above target capacity. |
0x2F | UpdateOperationalParams | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Admin-only setter for the operational parameters (closer reward, max price staleness, market expiration window, min/max market duration, max order size). Each supplied value validates against its bounds before write. |
0x30 | ProposePythProgramId | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Stages a non-current oracle program ID for target 0 (push-owner) or 1 (Receiver owner) behind the 48h oracle timelock. Invalid targets and current-value proposals reject atomically; all-zero ID cancels any pending proposal and clears the target. |
0x31 | ApplyPythProgramId | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Requires a pending oracle update and elapsed timelock. Applies the pending ID into the slot selected by pending_pyth_target, then clears pending ID, eligibility timestamp, and target. |
0x32 | UpdateMarketDefaults | config W, authority S | Exact 2 base accounts or recorder tail. Authority signs. Fee-only update; settlement-mint rotation is disabled and any nonzero settlement_mint arg rejects with InvalidState. All-sentinel update rejects. Fee updates validate against config fee bounds. |
0xFF | LOG | log_authority S plus binary recorder payload | Intercepted before public parser. Exact one account. Signer must be log-authority PDA. Payload version, authority kind, length, and event count validate. This is internal self-CPI only, not a public user instruction. |