Pool Architecture

MAGMA's distribution economics run through a set of on-chain pools, each an Anchor program on Solana, each with a distinct role. The backing vault fans out to them via Cross-Program Invocations (CPIs) at resolution time.

Flywheel economics — locked, built & host-tested, not yet live end-to-end

The distribution model on this page is MAGMA's locked "flywheel" economics: a reputation-tiered fee funds the reward pools, and the Conviction / Discovery / Streak / NFT multipliers re-weight a bounded pool — they never mint new tokens (combined multiplier hard-capped at 12.5×; proven solvent across a ~1,005,760-scenario sweep). Crucially, on yield-family markets no participant principal is ever captured — false_forge_bps = 0, capital_loss_bps = 0, and the fee is drawn from yield, never principal. The pool programs are live on devnet, but the flywheel wiring (fee-funding + on-chain multiplier re-weighting) is built and host-tested, staged behind a devnet upgrade currently on hold pending backend cutover — the *_state/vault_config accounts are not yet initialized on-chain. The legacy "35% FALSE-resolution principal forfeit" model is retired.

Pool	Program	Devnet program ID	Role
Forge	magma_forge_pool	DMYpMVZir21LjdDKf3cTszE1LgtX5UfMMfhLpPz7yoa1	Resolution economics — collects forfeit, distributes to winners
Seam	magma_seam_pool	DxpmLeT35zN2WUNAxAVHcuKNPJjyUyodvjMCLhVFop8Y	Creator royalty (7% of Forge on TRUE)
Core	magma_core_pool	4vvYQhVzmvwDo1zCG4iP8e4T4CBvkM3pVnTz2t3AnHja	Protocol treasury (5% of Forge on TRUE)
Echo	magma_echo_pool	2k8zA7Y6b7wSDaymCQhTuh8EPJykQrEUbFUhipSMArHw	Yield-funded community draw; absorbs the Seam share (37%) of the FALSE forfeit
Ruffler	magma_ruffler	3jf4MTyxVdN4GPMsv67wL14GjtWmJsm6V7TWohae4vxT	Weekly prize draw, independent ticket economy

The Forge Pool

The Forge is where resolution economics happen. It is the winner-subsidy pool: correct backers claim from it, weighted by backing × combined multiplier. No principal is ever captured — the Forge is funded only by realized yield and the reputation-tiered fee, never by anyone's deposit. Its inflows differ by outcome:

• On TRUE resolution, every backer reclaims 100% of principal; the realized DeFi yield the pool earned funds the winner distribution, and the reputation-tiered fee is split across the pools. The fee is a rate on principal (Initiate 2.5% → Volcanic 0%, TIER_FEE_BPS = [250,200,150,150,100,0]) but is drawn from — and capped at — realized yield (require!(fee ≤ total_yield)), so it never touches principal.
• On FALSE resolution, the incorrect backer keeps 100% of principal and forfeits only the realized yield their stake earned (false_forge_bps = 0 — the legacy 35% principal forfeit is retired). That forfeited-yield "capture" routes to Core (5%) and the Echo Pool (the remainder); the Forge FALSE leg is intentionally dropped.

The fee split that funds the pools on TRUE — shares of the fee, which is itself drawn from yield, never from principal:

Recipient	Share of fee	BPS	Role
Forge → correct backers (by backing × combined multiplier)	58%	FORGE_TRUE_BPS = 5800	Winner subsidy — the largest slice
Seam (creator royalty)	7%	SEAM_BPS = 700	TRUE only
Core (protocol treasury)	5%	CORE_BPS = 500
Platform (treasury, direct)	2%	PLATFORM_BPS = 200	Volcanic override routes this into the Forge subsidy

The backing × combined_multiplier weighting means a Volcanic-tier participant on a Supervolcano streak takes a substantially larger share than an Initiate backing the same amount — but the multiplier only re-weights the bounded pool; it never mints. The combined multiplier is hard-capped at 12.5×, and aggregate claims are clipped so pool_out ≤ realized yield + subsidy. See Conviction Score for the full multiplier stack.

Sweep mechanic

Unclaimed Forge positions older than 90 days are swept to the Echo Pool, preventing capital from being locked indefinitely.

The Seam Pool

The Seam Pool is the creator royalty system. On every TRUE resolution, 7% (700 bps) of the yield distribution flows to the Seam Pool for the narrative creator.

• The rate is fixed at 7% (700 bps) — not variable by Creator Score or tier.
• It fires only on TRUE resolution, never on FALSE or REFUND. On FALSE there is no creator royalty — the forfeited-yield capture routes to Core and the Echo Pool instead (see the Forge split above).
• Payment is automatic — no platform approval required.
• It is 7% of the TRUE yield distribution, not of the narrative backing pool directly.

Why fixed at 7%: the rate is a hardcoded constant in the Anchor program. A variable rate would require a dynamic lookup at resolution time (creator's tier then versus at creation), introducing disputes and edge cases. A fixed rate is auditable, predictable, and fair to all creators.

Sweep mechanic

Unclaimed Seam royalties older than 180 days are swept to the treasury.

The Core Pool

The Core Pool is the protocol treasury. It takes a 5% (500 bps) slice on both outcomes — 5% of the TRUE fee distribution and 5% of the FALSE forfeited-yield capture. It accumulates protocol revenue from all narrative resolutions across all chains and is controlled by the treasury multisig. Post-TGE, the Core Pool will distribute revenue to $MAGMA stakers (a V4 feature) — see Token Economics.

The Echo Pool

The Echo Pool is the protocol's community yield distribution — a weekly prize draw funded primarily by the DeFi yield generated by backing capital across the protocol. It also absorbs the bulk of the FALSE forfeited-yield capture: on a FALSE resolution the incorrect backer keeps all principal and forfeits only realized yield, and the remainder of that capture (after Core's 5%) routes to the Echo Pool.

The Echo Pool is not an airdrop and not a fixed emission schedule. It fills based on how much conviction capital is actively locked: more capital committed to narratives means more yield generated means a larger Echo Pool. Pool size is directly proportional to active backing volume.

How it fills

Three sources fill the pool each epoch:

• DeFi yield on backing capital — SOL locked to back narratives earns lending yield in integrated protocols (Kamino and others) during the window; a portion flows to the Echo Pool at epoch end.
• The FALSE forfeited-yield capture — the Echo slice of each FALSE backer's forfeited yield (principal is never forfeited; see the Forge split).
• Epoch allocations from resolved pools — a portion of protocol revenue from resolutions flows in each epoch.

Ticket economy

Participants earn Echo Pool tickets by contributing to the protocol:

• Correct narrative backings — base tickets proportional to the backing amount.
• Eruption Streak tier — multiplies ticket earnings; Supervolcano participants earn substantially more tickets per correct backing than Initiate participants.
• Narrative creation — publishing narratives that resolve correctly earns creator tickets proportional to the pool volume attracted.
• Protocol missions — completing mission categories earns bonus tickets.

Higher streak tiers multiply earnings because sustained accuracy is the hardest signal to manufacture and the most valuable thing the protocol can reward.

The draw

At epoch end, a Pyth Entropy VRF draws winners from the ticket pool. Each correct backer's ticket allocation is stored in an EchoTicket PDA on-chain before the draw, and the VRF proof is committed on-chain before any distribution executes — no one, insider or otherwise, can influence the outcome. Ticket holdings translate to probability-weighted chances.

Why this is not an airdrop

Airdrop	Echo Pool
Fixed emission	Funded by activity — fills based on what participants do
Rewards capital/early presence	Earned through verified accuracy at minimum stake + streak
Flat weighting	Weighted by contribution quality (streak tier)
Permanent allocation	Resets each epoch — stop contributing, stop accumulating

Activation requirement

The Echo Pool VRF draw activates only after the oracle achieves sufficient accuracy on a minimum number of resolved narratives. This prevents a systematic oracle bias from misallocating yield. Below the activation threshold, the pool accumulates and activates once the reliability condition is met.

The Ruffler

The Ruffler is a separate weekly prize draw with its own ticket economy, VRF mechanics, and anti-sybil rules. It is distinct from the Echo Pool but shares the same underlying signal — strong Eruption Streak history and active backing.

Prize structure

Each weekly round distributes a minimum prize pool across five positions:

Position	Share
1st	55%
2nd	20%
3rd	12%
4th	8%
5th	5%

The prize pool accumulates from protocol participation activity each epoch.

Ticket economy and anti-sybil rules

Participants purchase Ruffler tickets, but ticket weight is not uniform and entry is capped. All of the following are enforced in-contract:

Rule	Threshold
DEGEN holder multiplier	1.15x ticket weight for DEGEN token holders
Maximum tickets per wallet	2 per round
Wallet age	Minimum 60 days old
Narrative backing recency	Active backing in the last 30 days required
Flagged-wallet exclusion	Correlation-detector flags are excluded

The 2-ticket cap is the primary anti-whale protection: a single wallet cannot dominate a draw regardless of capital. Because these rules are enforced at the contract level (not just the backend), a fresh wallet created for a Sybil attack cannot participate regardless of ticket purchases.

Provably fair randomness

The Ruffler uses Pyth Entropy VRF. The proof is committed on-chain before any prize release:

request VRF → wait for callback → commit proof on-chain → select winner → execute prize release

No step can be manipulated after the VRF is requested; anyone can verify the proof independently, and the result is deterministic given the VRF output and the ticket list.

Keeper-down failsafe (permissionless)

The primary draw is fulfilled by a relayed-VRF oracle, which creates a liveness risk: if the oracle key goes dark after a draw is requested, the round could freeze — winners selected by nobody, prizes never released. The Ruffler adds two permissionless failsafes so a requested draw can always be settled or safely rolled over, without weakening the primary path. Both open only after a grace window (ROLLOVER_GRACE_SECONDS) measured from the scheduled draw time, so a live oracle always gets first crack.

Instruction	Caller	When	Randomness	Outcome
fulfill_draw	Oracle	After the draw is requested	Relayed Switchboard VRF	Weighted top-5 winners
settle_draw_permissionless	Anyone	After the grace window	SlotHashes sysvar folded with a caller seed (on-chain, testnet-grade)	Weighted top-5 winners
force_rollover	Anyone	After the grace window	None	Rollover — only for a draw that provably cannot pay (zero tickets, or pool below MIN_POOL_LAMPORTS)

settle_draw_permissionless derives randomness on-chain (never caller-supplied) and drives the same shared select_top_winners routine as the oracle path, so the two triggers can never diverge — only the entropy source differs. On-chain slot-hash entropy is verifiable and grind-resistant but weaker than the relayed VRF, so it is a keeper-down fallback, not the default. force_rollover is hard-gated to draws that cannot pay a prize, so it can never deny a real winner; a payable draw can only be settled by a path that actually selects winners. The same failsafe pair exists in the Echo Pool (with its force_rollover rolling the pool forward to the next epoch).

Status — built and host-tested, not yet on the deployed bytecode

Both permissionless entrypoints are implemented and covered by host tests, but they were added after the base program's devnet deploy and are not yet upgraded onto the live program — designed and built, staged for a devnet upgrade. Mainnet additionally targets oracle_threshold ≥ 3, a 48-hour prize timelock, and a hardened grace window.

Correlation detector

A backend correlation detector flags wallet clusters showing coordinated behavior — wallets backing opposite sides of the same narrative, funded from the same source within a short window, sharing near-identical backing patterns, or hitting identical outcomes at statistically improbable rates. Flagged wallets have Ruffler eligibility suspended until reviewed by an admin.

Cross-pool CPI flow

At resolution, magma_backing_vault orchestrates the entire distribution through Cross-Program Invocations in a fixed sequence:

1. finalize_resolution executes on the vault (after threshold + 48h timelock).
2. Vault calculates each participant's outcome.
3. CPI to the Forge → receives the fee to split (TRUE) or the forfeited-yield capture (FALSE).
4. Forge calculates the 58 / 7 / 5 + platform split of the fee (TRUE).
5. On TRUE: CPI to Seam records the creator's 7% claimable royalty.
6. On FALSE: there is no creator royalty — the forfeited-yield capture routes to Core (5%) and Echo (remainder).
7. CPI to Core records the 5% treasury allocation (on both outcomes).
8. CPI to the Echo pool → records the backer's ticket allocation for the epoch.
9. TRUE backers' Forge claim records created (registerTrueBacker).
10. Participants claim their shares from each respective pool.

Audit scope

All pool accounts and CPI call sequences are included in the external security audit scope. See Security.