Browse documentation
From wallet connection to private perp settlement.
Anqa is a perpetual-futures exchange whose live book and trader portfolios execute inside a Private Ephemeral Rollup. This guide explains how to use the terminal, what the protocol guarantees, what remains public, and where the trust boundaries actually are.
Use test funds only
The current deployment is on Solana devnet. “USDC” in the terminal is faucet-issued test collateral with no monetary value. The resident maker and delayed auto-matcher are test infrastructure, not a promise about production liquidity.
Open your first position
The first interaction establishes custody, privacy and a trade-only browser session. After that, opening, cancelling and closing positions does not require wallet popups.
Connect a Solana devnet wallet
Use the wallet button in the top-right. The wallet remains the only authority allowed to deposit, withdraw, grant a session or revoke one.
Get test USDC
Open Deposit, select the deposit tab and press Get test USDC. The faucet sends the current hub's test mint to your wallet.
Deposit into your trading account
Enter an amount and approve the wallet transaction. Base-layer USDC moves into the custody vault; the keeper credits the monotonic deposit ledger into your private portfolio.
Enable one-click trading
The onboarding transaction opens and permission-protects your portfolio, delegates it to the rollup, and grants the browser's session key. A grant lasts up to seven days and works across all markets.
Choose a market and direction
Pick BTC, SOL, ETH, XRP, DOGE, SUI, BNB, gold (XAU), silver (XAG), Brent, WTI crude or copper. Select Long if you expect the price to rise, or Short if you expect it to fall.
Choose collateral, leverage and order behaviour
Collateral is the amount allocated behind this asset's position. Position value is approximately collateral × leverage, rounded to the market's lot size. Review the estimated liquidation price before submitting.
Watch the canonical result
A marketable order first shows as Matching, then becomes a position only after the settlement keeper updates the private portfolio. A non-marketable limit appears under Resting orders until it trades or is cancelled.
Current devnet matching behaviour
To make testing predictable, an unchanged user order that remains on a book is given at least ten seconds in the Resting Orders terminal, then the funded test maker submits the exact opposite IOC. Cancelling or amending the order removes or restarts that timer. Normal marketable orders can still fill immediately against displayed venue liquidity.
What you are trading
A perpetual future is a leveraged contract that tracks an asset's price without giving you the asset and without an expiry date. Anqa positions are accounting entries between a long and a short; BTC, SOL or ETH never moves through the venue.
Profit when the mark rises
A long's unrealized PnL is approximately (current mark − entry price) × position size. It loses when the mark falls.
Profit when the mark falls
A short reverses that calculation: (entry price − current mark) × position size. It loses when the mark rises.
A simple leverage example
Allocate $100 at 10× and the target position value is about $1,000. A 1% favourable move produces roughly $10 of PnL before configured fees and funding—about 10% on the $100 allocation. A 1% adverse move loses roughly the same amount. Leverage multiplies return on collateral in both directions; it does not change the underlying price move.
| Field | Meaning |
|---|---|
| Collateral | The dollar allocation recorded behind this asset's position and its isolated liquidation budget. |
| Leverage | Target notional divided by the collateral entered on the ticket. |
| Position size | The resulting base-asset quantity after rounding down to whole protocol lots. |
| Entry | The volume-weighted execution price of the settled position. |
| Mark | The accepted oracle price used to value the position and judge risk. |
| PnL | Unrealized gain or loss from entry to mark, plus protocol accounting such as funding when enabled. |
| ROE | PnL divided by allocated margin, expressed as a percentage. |
| Liquidation price | An estimate of where the position's collateral no longer covers its loss and maintenance requirement. |
Liquidation is not a stop loss
A stop loss is a user-selected reduce-only exit. Liquidation is the protocol's solvency backstop and may execute after collateral has already been consumed by loss and maintenance margin. Use position sizing and a stop loss; do not treat the liquidation estimate as an execution target.
Read the terminal
The UI separates public market information, your authenticated private state and explicit custody actions.
| Area | What it means | Visibility |
|---|---|---|
| Market bar | Mark, 24h range/change, open interest, fill count and resting totals. | Public aggregates |
| Chart | External candles plus Anqa fill markers, your position entry and estimated liquidation line. | Mixed public/private |
| Order book | Aggregated shown prices and totals. Hidden orders are excluded; owners never appear. | Public mirror |
| Trades | Settled price, size and time from the fill tape. | Public, anonymous |
| Trade ticket | Direction, collateral, leverage, price, order type, TP/SL and visibility. | Local + authenticated |
| Positions | Your size, entry, mark, PnL, ROE, margin and close action across all markets. | Private to members |
| Resting orders | Only your live orders, including whether each is shown or hidden. | Private owner mirror |
| Account | Wallet balance, portfolio equity, allocated margin and custody controls. | Private + base custody |
| Proof | Anonymous RPC probes and TEE attestation evidence. | Public verification |
Mark is not execution
The mark drives risk and previews. Your actual entry is the resting maker price recorded by the fill.
Orders are not positions
A resting or pending order reserves margin, but the position row appears only after successful settlement.
Portfolio value is not wallet balance
Wallet USDC is outside custody; portfolio equity is inside the trading account. Deposit and withdraw bridge them.
Orders, visibility and fills
Anqa keeps central-limit-order-book semantics: strict price-time priority, partial fills, real counterparties and self-trade prevention. Privacy changes who can inspect the queue; it does not change queue fairness.
Sends an immediate-or-cancel order through the available book. It fills at resting maker prices, not necessarily at the displayed mark.
Opening or closing now when execution matters more than an exact price.
Crosses immediately when marketable; otherwise the unfilled amount rests until it fills or you cancel it.
Naming the worst price you will accept and allowing the order to wait.
Must add liquidity. If it would cross an existing order, the protocol rejects it instead.
Guaranteeing that you are a maker rather than a taker.
Fills whatever is immediately available at or better than your limit, then discards the remainder.
Taking available liquidity without leaving anything resting.
The entire requested size must be available immediately inside your limit or nothing is matched.
Avoiding partial execution.
Included in aggregate depth
Other traders may see total shown size at its price, but never the owner. You retain normal price-time priority and see the identifiable row only in your own Resting Orders tab.
Excluded from aggregate depth
The order remains in the same matching queue with the same priority and margin requirement. It becomes public only as an anonymous tape print after settlement. Hiding buys no priority and costs no priority.
Why a submitted order can appear to disappear
An incoming order may match immediately and leave the resting book before settlement. The UI shows it as Matching while the fill is pending. If the oracle band or Percolator refuses settlement, the queue entry is consumed and any unsafe maker remainder is cancelled so one bad fill cannot block every fill behind it. Only the private portfolio is authoritative evidence that a position opened.
Market configuration also carries taker-fee and maker-rebate fields. The configured taker fee is applied during risk settlement; devnet parameters may be zero or change between test hubs. Read the deployed market configuration rather than assuming a production fee schedule.
What a Private Ephemeral Rollup does
A PER is a temporary, high-speed execution environment for selected Solana accounts. It is not a second public blockchain and it is not a conventional gossip network where every peer receives every byte.
Delegate
Program accounts such as the book, portfolios and risk state are handed to the MagicBlock delegation program. Base-chain configuration and custody remain on Solana.
Execute
The sequencer executes the same Solana program instructions at rollup latency. Private account reads are filtered by permission membership; writes still obey program authorization and PDA constraints.
Commit
Rollup state can be checkpointed back to Solana. Anqa refuses to commit a portfolio with open exposure, because publishing that snapshot would reveal position and liquidation information.
Why running your own RPC does not reveal the live book
A normal Solana RPC can serve only the last base-layer state. The current book lives in the delegated rollup account, not in Solana's peer-to-peer ledger stream. A rollup replica is a client of the primary validator and reaches private state through the same authenticated ingress; it does not receive an unrestricted gossip copy. Without a valid membership token, the private account query returns null.
Important distinction: access control, not ciphertext
Book and portfolio bytes are plaintext while the matching program operates on them. Privacy comes from account permissions enforced by a TEE-backed validator and from remote attestation of that validator—not from zero-knowledge proofs, threshold encryption or encrypted matching. The matching environment can process the data; unauthorized RPC clients should not receive it.
What is private, what is public, and who is trusted
The protocol deliberately publishes enough to establish a market while withholding trader identity and live exposure.
| Data | Public reader | Portfolio owner / engine |
|---|---|---|
| Market configuration | Readable | Readable |
| Pyth index and accepted mark | Readable | Readable |
| Shown aggregate depth | Readable by price total | Readable |
| Hidden aggregate depth | Not counted | Engine can match it |
| Full book and order owners | RPC returns null | Engine reads; owner sees own mirror |
| Position, entry, margin and PnL | RPC returns null while private/delegated | Owner and keeper members read |
| Settled fill | Price, size, time | Same public print plus private account changes |
| Wallet token balance | Public Solana account data | Public Solana account data |
| Session grant public key and expiry | Public base-layer grant | Same; secret key stays in browser |
Unpermissioned observation
Other traders, ordinary bots, public RPC clients and replica clients without membership should not be able to enumerate book owners or query private portfolios.
Compromised client or failed TEE assumptions
Browser malware can steal a session key, and privacy ultimately depends on the validator running the attested code inside the stated hardware boundary. Read the Proof panel instead of treating “private” as a slogan.
Custody on Solana, execution in the rollup
The split limits what an execution-layer failure can do: trading state moves quickly in the PER, while token custody remains governed by base-layer instructions.
Tokens move only here. Configuration is permanent and publicly auditable.
Matching, risk checks, settlement, PnL and liquidation execute here.
The hub model
Markets 930–943 share one USDC vault, one Percolator risk group and one portfolio per trader. Each market still has its own book, oracle state, depth mirror and tape. The UI allocates collateral per asset for isolated liquidation while the account's free equity and admission certificate are evaluated at the shared portfolio level.
The complete life of a trade
Matching and risk settlement are separate on a dark book because the taker is not allowed to discover the maker accounts it crossed.
Deposit
SolanaUSDC enters the vault and the trader's monotonic ledger increases. No position exists yet.
Claim and delegate
BoundaryThe portfolio is credited from the ledger, permission-protected and delegated into the PER.
Authorize
Solana → browserThe wallet grants a browser session key trading rights for up to seven days.
Place order
PERThe program authenticates the owner/session, checks the oracle band, refreshes account health, verifies free margin and reserves margin for any resting or pending quantity.
Match
PER bookThe book walks strict price-time priority. The maker's resting price determines execution. Self-crosses remove the owner's resting order instead of producing a fake fill.
Queue
Dark boundaryThe book records taker, maker, side, price and size in a private FIFO pending ring. The public still learns nothing.
Settle
PER riskThe keeper cranks the relevant market, refreshes both portfolios and asks Percolator to mint the long/short pair.
An accepted fill publishes only market, price, size, sequence and time. Refused fills are consumed without a tape print.
Mark, fund and liquidate
PEROracle cranks update risk state; portfolio refreshes realize losses and update PnL. Trigger and liquidation paths are permissionless but rule-bound.
Close and withdraw
PER → SolanaReduce-only closing flattens exposure. The rollup authorizes a withdrawal receipt; only the base vault transfers tokens.
What Percolator does—and what Anqa adds
Percolator is the solvency authority embedded inside Anqa. The wrapper does not reimplement its margin arithmetic; it supplies the exchange mechanics and security boundaries around it.
Portfolio solvency
Position netting, equity, initial and maintenance requirements, PnL realization, funding accounting, loss/profit backing, health certificates, liquidation and bad-debt transitions.
Exchange semantics
Custody, authentication, oracle acceptance, price ticks and lots, the CLOB, order-margin reservation, private matching, isolated collateral metadata, fill settlement and the public tape.
How the ticket maps to risk
collateral × selected leveragetarget notional ÷ effective order price, rounded down to whole lotscertified equity − position requirement − reserved order margin(mark − entry) × size for a long; reversed for a shortThe venue's initial-margin requirement is 5% (20×). The UI can preview up to 25×, but an order above 20× needs enough additional free portfolio equity to satisfy the kernel. The on-chain check, not the slider, is final.
Isolated risk inside a shared account
Your hub portfolio is shared across markets, but the amount entered as collateral is recorded against the selected asset. The isolated liquidator compares that position's own collateral, blended entry, PnL and maintenance requirement. When that asset is underwater, the protocol can close it without treating every other asset allocation as its liquidation budget.
Losses are senior; unproven wins are junior
Portfolio refreshes crystallize losses against real backing before profit becomes withdrawable capital. This prevents two accounts from both treating the same unsettled gain as senior collateral. The keeper expires stale backing buckets and realizes eligible PnL, but the kernel decides what is safe.
Oracle policy, funding and circuit breakers
A perp trade creates exposure at its execution price, so accepting arbitrary caller prices would create value from nothing. Anqa pins each market to a Pyth feed and bounds every fill around the accepted mark. On devnet the commodity markets (gold, silver, Brent, WTI, copper) use the authority-published Custom oracle instead, because nobody pushes those Pyth feeds there: the keeper signs in the same Pyth gold price read from Solana mainnet, and delayed public quotes for the rest.
Pinned feed
A caller cannot substitute another asset's oracle account.
Maximum age
Stale prices halt risk transitions instead of silently becoming marks.
Confidence
A wide Pyth confidence interval is treated as an unreliable market.
Cross-source deviation
Large disagreement with the configured secondary source is rejected.
Move band
Sudden moves are bounded per crank and converge over repeated accepted steps.
Execution band
Orders and queued fills must remain within the market's allowed distance from mark.
| Price | Purpose | Where you see it |
|---|---|---|
| Index | External Pyth reference before protocol acceptance. | Chart / market data |
| Mark | Accepted risk price for PnL, margin and liquidation. | Market bar and ticket |
| Order limit | Worst price the trader authorizes. | Ticket and Resting Orders |
| Fill / entry | Maker price at which settlement created exposure. | Tape and Positions |
Percolator supports funding accrual between long and short domains. The keeper advances the venue clock and funding state in bounded segments so an outage cannot skip an arbitrarily large accrual interval. The current devnet configuration may use a zero funding input while the mechanism is exercised and monitored.
Session keys remove popups without moving custody authority
The browser creates one keypair per wallet and stores it locally. The owner grants its public key a platform-wide trading session; the secret key never needs to leave that browser storage.
| Action | Signer | Wallet popup? |
|---|---|---|
| Connect wallet | Wallet | Connection approval depends on wallet |
| Deposit / top up | Wallet owner | Yes |
| Grant or renew session | Wallet owner | Yes, once per grant |
| Place, cancel or modify order | Session key | No |
| Close position | Session key | No |
| Arm / cancel TP or SL | Session key | No |
| Withdraw | Wallet owner + protocol authorization | Yes |
| Revoke session | Wallet owner | Yes |
Trade-only authority
The on-chain instruction verifies that the supplied session belongs to the portfolio owner, matches the browser signer and has not expired. Custody instructions still require the wallet owner.
Seven-day maximum
A grant expires after at most seven days and can be revoked without the session key. A compromised key can trade the account until expiry/revocation, so use a trusted browser profile and revoke unfamiliar sessions.
Keeper, maker and devnet auto-matcher
These processes make the venue usable, but they have different roles. None should be confused with the risk authority.
Keeper
LivenessRelays oracle data, advances the venue clock, cranks mark/funding, settles private FIFO fills, publishes depth and owner mirrors, credits deposits, refreshes PnL, scans liquidations, checkpoints safe state and restores demo quotes. Settlement is permissionless in rule: wrong accounts or prices fail.
Resident maker
CounterpartyA funded devnet account posts shown bid/ask ladders around the mark. It takes the opposite side of real test positions and absorbs test PnL; it is liquidity, not an oracle or an admin override.
Delayed auto-matcher
Devnet onlyWatches the private queue as an authorized engine reader. After an unchanged user order has rested for at least ten seconds, it clears only its own quotes ahead of that order, submits an exact opposite IOC, restores its ladder and leaves canonical settlement to the keeper.
What happens if the keeper stops?
Orders can still be accepted or matched, but queued fills will not become positions, marks and health can become stale, deposits may wait for credit and liquidation/trigger work pauses. The program should refuse unsafe stale transitions rather than trade blind. Liveness degrades; the keeper does not gain permission to withdraw user funds.
Close, flatten and withdraw
A fill moves no tokens. Custody changes only on deposit and withdrawal, so withdrawing requires the protocol to prove that no live obligation is being abandoned.
Cancel orders
Cancel every resting order. Their reserved margin is a live promise and cannot leave the account.
Close positions
Use Close in the Positions tab. The path is reduce-only and cannot accidentally flip you to the other side.
Withdraw
Open Deposit → Withdraw. The rollup authorizes against flat, refreshed equity; the base vault pays the owner's token account.
The withdrawal handshake separates authorization from token movement: a base receipt identifies the request, the rollup risk state approves an amount it can prove is free, and a base instruction transfers USDC. The rollup never owns the vault's token-signing authority.
Verify the privacy and execution claims
The terminal's Proof panel performs live checks instead of showing a static trust badge.
Same RPC, different answers
The panel opens an unauthenticated connection. A healthy private book and delegated portfolio return null; the public tape returns bytes. Base-chain checks distinguish “permission refused” from “account absent.”
Fresh challenge, fresh quote
The browser generates a random challenge, requests an Intel TDX quote and checks that the response binds to that challenge. Certificate and revocation-chain verification runs server-side; the browser compares the binding itself.
Measurement caveat
Attestation can show that a real TDX environment produced the quote and report its measurement. A complete reproducible-build claim also needs a publicly pinned expected measurement. Until that reference exists, the UI displays the measurement rather than pretending it has judged the build.
When the UI does not show what you expected
| Symptom | Most likely meaning | What to do |
|---|---|---|
| Order is under Resting Orders | Your limit did not cross and is still live. | Wait for a counterparty / devnet matcher, amend it or cancel it. |
| Order vanished but no position yet | It matched and is in the private pending queue, or settlement refused it. | Watch the Matching row and refresh; the portfolio is authoritative. |
| Market order opens nothing | No opposing liquidity, stale risk/oracle state or settlement refusal. | Check the visible error, book side, rollup badge and keeper status. |
| Wallet asks again | The session expired, changed browser storage or has not reached the rollup clone. | Approve one renewal; do not approve repeated unexplained prompts. |
| Cannot withdraw | Open positions, resting orders, pending settlement or unrefreshed loss remains. | Cancel orders, close positions, wait for settlement and retry. |
| Private account returns null | Expected for an unauthenticated reader. | Authenticate as the owner or inspect the Proof verdict. |
| Hidden order absent from ladder | Expected: it is deliberately excluded from public depth. | Use your Resting Orders tab to confirm and cancel it. |
| Limit price rejected | It lies outside the current oracle execution band. | Use the displayed band or wait for the mark to move. |
Common questions
Can I reveal the book with my own Solana RPC?
No. A Solana RPC sees the last base-layer state, not the live delegated account. Rollup replicas use the authenticated primary ingress rather than receiving an unrestricted peer-gossip copy.
Can the matching environment read orders?
Yes—it must process plaintext to match them. The claim is that unauthorized readers and the host outside the attested TEE cannot inspect that state under the stated hardware and software assumptions.
Does Hidden improve queue position?
No. Hidden and shown orders use the same price, then arrival sequence. Hidden changes publication only.
Are my USDC tokens inside the rollup?
No. Tokens stay in the Solana custody vault. The rollup holds accounting state that authorizes what the base layer may later withdraw.
Why wait ten seconds on devnet?
It lets testers observe a real resting row before the test counterparty takes it. The delay belongs to the current demo auto-matcher, not the matching protocol.
Is this production or mainnet?
No. The current venue, collateral faucet, resident maker and auto-matcher are devnet infrastructure.