How SharePot works

SharePot is a parimutuel pool on where a US stock closes today, where the stake and the payout are the tokenized stock itself. Holders of TSLAx, NVDAx, SPYx or SpaceX tokens hedge a bad day, or add upside on a good one, without ever selling. The same pools run on pre-IPO tokens and on the day's most-traded Solana memes, settled on their on-chain price.

Two minutes: connect, get test stocks, stake on Tesla, and see a settled market with its price evidence checked against the on-chain hash. Recorded on devnet.

Why bet with the stock itself

To protect a position against one bad day, or to lean into a good one, a holder of tokenized stock has to sell and buy back: spreads, slippage, and time out of the stock. SharePot lets the shares do the work instead.

Hedge without selling. Hold 10 TSLAx and worried about today? Stake 1 TSLAx on Big drop. If Tesla falls hard, you receive extra TSLAx on exactly the day your shares lose value.
Add upside without buying. Stake on Big gain instead and a win adds shares on the day the price jumps.
A wrong call costs only what you staked. You never swap out of the stock, so you never leave your position.

A market, step by step

One pool per stock per US trading session. The market for session S opens at the previous session's opening bell and stops taking bets at S's opening bell (09:30 New York). There is always exactly one pool per stock you can bet into, around the clock.
Four ranges for the close-to-close move: big drop, small drop, small gain, big gain. The cuts sit near each stock's quartiles over the last 12 weeks (TSLA −1.75 % / 0 / +2 %, NVDA −1.5 % / 0 / +2.25 %, SPY −0.5 % / 0 / +0.5 %), so every range starts out roughly equally likely. Odds then move with the pools.
Betting closes before any of the answer exists. Bets stop at the opening bell of the session being predicted.
Settles on the official close of S against the official close of the session before, as a total-return move (dividends added back, splits neutral).
Payouts are pushed to wallets by a permissionless crank after the dispute window. Nobody has to claim.

The same stock often trades on Solana as several tokens: SpaceX as SPCXx (xStocks), SPCX (Backpack Securities) and SPCXon (Ondo Global Markets); Tesla as TSLAx and TSLAon. The tokens are not interchangeable, so each token gets its own pool. All pools of a stock ask the same question and resolve on the same close; each is staked and paid in its own token.

How the money works

Each range has its own pool in the market's stock token. Winners get their stake back plus a pro-rata share of every losing pool, in the same stock.
Fee: 3 % of what a winner takes from the losing pools, never on the winner's own stake. Bets in the first quarter of the betting window (up to 6 h) pay 2 %. The rate is locked into the position when you bet.
The fee is paid in the stock itself. A pool staked in NVDAx pays its fee in NVDAx.
There is no house on the other side of your bet. Winners are paid out of the losing ranges. If nobody takes another range, the losing pools are empty and every stake is returned; if nobody picks the winning range, everyone is refunded and no fee is charged. The worst case is a wasted session, not a loss.
On devnet each market opens with a small fee-free house prize so an empty pool looks alive. On mainnet there is none — a parimutuel does not need house money to pay out.
A voided market refunds everyone in full.

Leaderboard points

Every settled market scores the wallets that were in it:

points = shares staked × the official close the market settled on

That is what your stake was worth, in dollars, at settlement. One share of NVDA staked on a day it closed at $212 is 212 points.
Every range you bet counts, won or lost. One share on each of the four ranges at a $212 close is 848 points — and only one of them can pay.
The close is the same number the result was derived from, so NVDAx and NVDAon score alike. It is frozen when the market pays out; a score never moves afterwards.

Settlement you can check

The server never holds funds. Stakes sit in a program-owned vault per market; only the program's payout math can move them.
The resolver submits a number, not a winner. After the close it reads the official closing price, checks that the bar is final and that the previous bar is the calendar's previous session, and cross-checks the close against Nasdaq's official close to the cent. Any failed check holds the market for the next run instead of posting a wrong result; if the two sources still put the day in different ranges after 24 hours, the market refunds every stake.
Evidence on-chain. The move is proposed together with the sha256 of the raw price response. The winning range is derived on-chain from the market's thresholds.
Anyone can verify. The raw response is published byte for byte; the market page re-hashes it in your browser and shows whether it matches the hash stored on-chain.
Six-hour dispute window. A proposal can be disputed with a wallet-signed message; the operator is paged and can re-propose or void. After the window anyone can finalize.

Trust model, stated plainly

The proposer key can propose any number. The checks above run off-chain, in the same process that holds the key. A compromised resolver could propose a wrong move; what stops it is the six-hour window and a second machine: every ten minutes a different host, which holds the admin key, fetches the prices itself and voids any proposal whose range it cannot reproduce — a full refund, never a different winner.
The admin is trusted. The admin can finalize inside the window, void any open or proposed market (full refund) and change the proposer, treasury and fee (capped at 10 %; a bet already placed keeps its rate). The admin cannot move vault funds anywhere but to winners or, after every position is settled, fees and dust to the treasury.
A market whose price never comes refunds itself. If a market is still unproposed 24 hours after its resolve time (a session that never traded, a token whose quotes disappeared), the proposer may void it on-chain and the crank refunds every stake. That is the only power the proposer has beyond proposing a number: it can return money, never pick a winner.
A payout that cannot be delivered. Payouts are pushed to your wallet. If you closed your token account for that stock after betting, the crank reopens it when the payout is worth $0.50 or more; a smaller one waits for you to reopen it. A position still unpayable (account gone, frozen, or set by its owner to require a memo on every incoming transfer) 30 days after resolution can be forfeited to the treasury so the market can close — the program checks both the delay and the account. For the same reason the smallest stake is worth at least $1: it is shown on every market as a round number of shares (0.01, 0.1, 1, 10 …), the first power of ten that reaches $1 at the current price, and stakes go in whole multiples of it.
The issuer is trusted by construction. Every xStock carries a permanent delegate and a pause switch; the vaults are ordinary token accounts to the issuer. Nothing on Solana can change that, so the site says it on every page.
Devnet today, multisig before mainnet. On devnet both keys are single hot keys. Before mainnet the admin, the upgrade authority and the treasury move to a 2-of-3 Squads multisig the server is not a member of; the server keeps only the proposer key, which can never touch funds.

Built for xStocks and friends

Token-2022 throughout. Every movement uses transfer_checked; classic SPL mints work through the same path.
One mint per market. Bets, payouts and fee sweeps must use the market's mint and matching token accounts.
Transfer fees are booked honestly. A stake is recorded as what the vault actually receives, so a mint with a transfer fee (Tessera 0.2 %, PreStocks 0.5 %) can run a pool without the pools ever exceeding the vault. Only mints with an active transfer hook are refused.
Dividends and splits. The issuers apply them as a ScaledUiAmount multiplier to every balance, vaults included; all accounting is in raw units, so every stake keeps its share of the pot. The predicted move is total return, so an ex-dividend day never counts as a drop.

Pre-IPO tokens and memes: the same pool, an on-chain close

The stock pools settle on an exchange's official close. Two more token classes run on the same program, with one difference: there is no exchange, so the day's close is read on-chain.

Pre-IPO: T-OpenAI and T-Kalshi (Tessera) and OpenAI (PreStocks). One pool per token per day; a day ends at 00:00 UTC. The pool settles on the token's on-chain price, the only price anyone can actually trade at.
Memes: every day at 11:00 UTC the ten Solana tokens with the most 24-hour traded volume are picked for the next day, subject to filters: mint and freeze authority given up, at least $500k of liquidity, a first pool at least three days old, no wrapped or bridged assets, no tokenized stocks or DeFi tokens. Tomorrow's ten can differ from today's; an open pool always settles.
A day's close is the median of one Jupiter quote per minute during the day's last hour (23:00–24:00 UTC). One print cannot move it; a burst that moves the price for a few minutes barely can. Fewer than 40 usable quotes (a delisted token, a dead feed) voids the day with a full refund.
Three ranges: down, flat, up, cut at ± the token's median absolute daily move over its last 60 days (T-OpenAI ±1 %, PreStocks OpenAI ±3 %, a typical meme ±5–15 %), so "flat" and the two tails start out about equally likely.
Betting on a day's pool opens at 11:00 UTC, 37 hours before its close, and stops at 12:00 UTC, twelve hours before its close — so there is always a pool to bet into. The previous day's close, the baseline, forms at 00:00 UTC, twelve hours before the lock; as with stocks, the pool opens before the previous close is known.
Issuer transfer fees. Tessera and PreStocks tokens charge 0.2 % / 0.5 % on every transfer, into and out of the pool alike. Your stake counts as what arrives; a payout lands net of that fee. That fee is the issuer's, not SharePot's.
Evidence works as for stocks: the sampled quotes of both closing hours are published byte for byte, their sha256 is on-chain, and the market page re-hashes them in your browser.

Try it on devnet

Connect Phantom, Solflare or Backpack set to devnet, or pick Test wallet (browser) from the Connect menu.
Open the faucet: mock tokens of every pool open today plus a little SOL, once per wallet per day.
Pick a market, choose a range, stake, sign. After the close, check My bets: payouts arrive on their own.

Source, program and tests: github.com/sharepotxyz/sharepot. Program id 8TzdVXpqa52o3fBvYynSxHTWP4zuWfZmTvSkpdLT9rWW. Built for the Solana Foundation Stocklana hackathon, September 2026.

Automation: the API and the program

A bot needs three things: which pools are open, a way to bet, and the results. The first and the third are a public read API, no key, open CORS. The second is the on-chain program, signed by your own wallet: there is no server-side bet endpoint, so nobody can bet with your tokens but you.

GET /api/markets lists every market, GET /api/markets/<id> one. status: 0 open, 1 proposed, 2 resolved, 3 voided, 4 settled and swept. A bet is accepted while status is 0 and the time is between openTs and closeTs (unix seconds).
thresholds and the observed move proposedValue are in ppm: 1 % = 10 000. Range 0 is below the first threshold, the last range is at or above the last one, outcome is the winning range. pools are in base units: divide by 10^decimals for shares.
GET /api/config: fee, early-bird discount, dispute window, minimum bet (base units). GET /api/stocks: the tokens, their mints and decimals. GET /api/prices: the live prices the site shows.
GET /api/evidence/<id>: the settlement evidence; add /raw for the exact bytes whose sha256 is on-chain. GET /api/positions/<wallet>: every payout pushed to a wallet, with its signature. GET /api/leaderboard?window=7d (or 30d, all): the points board.
Betting is the program's place_bet(range, amount) instruction, amount in base units, signed by your wallet; the IDL is in the repo at idl/sharepot.json. Payouts are pushed to your wallet by the crank after the dispute window: nothing to claim, only /api/positions to read.

A complete example in 80 lines that lists the open pools, places a bet and reads the results: examples/automate.mjs. On devnet, POST /api/faucet with {"address"} hands a wallet mock shares of every open pool once a day, so a bot can be tested end to end for free. Market data is cached for 15 seconds; the faucet, disputes and feedback are limited per address and per day.

FAQ

Is this an order book?: No. It is a parimutuel pool: payouts depend on the final pool sizes, and the quote you see while betting is what you would get if the pools stayed as they are.
What if the stock does not trade that day?: An unscheduled closure, a full-session halt, a spin-off or a delisting merger voids the market and refunds every stake in full.
Why not settle on an on-chain oracle?: These markets are defined on the official closing print, which equity oracles do not carry (they report the last trade before the bell). The official close is public and checkable, so it is published with its hash instead.
Do I need to claim?: No. A permissionless crank pays every position after the dispute window and closes it; the rent goes back to you.
Is there real money on devnet?: No. The tokens here are mock copies of the real ones with the same settings and no value.