Eyehood: forecasts read from the pool

Eyehood is a forecast market on Solana for coins that graduated on pump.fun and trade in their PumpSwap pool. Each market asks whether a coin's market cap will be above or below a target at a date. Stakes form a parimutuel pot in SOL, the answer is the median of the coin's own pool price over a window, and every market holds at most what it would cost to fake that answer, divided by 1.25. Stakes sit in a vault wallet run by the Eyehood keeper. There is no smart contract; instead every input and every transfer is public, so anyone can recompute each answer and each payout.

Forecast markets need an answer, and the answer usually comes from someone: an operator, a committee, a vote. For small coins that is worse than slow. The coins people most want to forecast are exactly the ones whose price one wallet can move for a few minutes.

Eyehood takes the opinion out and prices the attack. The answer is read from the pool itself, as a median that a short push cannot move, and a market is only allowed to grow as large as the push would cost.

Markets open at 19:00 UTC on a fixed schedule, and a newly listed coin gets its first markets as soon as it has an hour of readings. The keeper takes the median price over that hour as the reference and writes six markets, one per strike, for each date.

The deadline is the first 20:00 UTC at or after opening time plus the duration. Betting closes when the window starts.

The keeper reads every listed pool in one request at a random moment every 8 to 30 seconds. A read is the pool's SOL (its quote vault plus its virtual quote reserve, which PumpSwap prices swaps on) and its token vault; the price is their ratio. A 5-minute slot's reading is the median of the reads inside it. median(from, to) is the lower median of the slot readings in a range, and there is no answer when fewer than 60% of the slots hold one.

Reading at random moments, from the state at the end of a block, means a buy and a sell inside one block (a sandwich, or a Jito bundle) is never observed. Readings are stored permanently.

Thirty seconds after the deadline the keeper reads the median over the market's window and writes one of three results:

• YES for an above market when the median price is at or above the strike, and for a below market when it is at or below it;
• NO otherwise;
• VOID when the window has under 60% coverage, or when either side is empty.

Because readings never expire, a market settled late gets the same answer as one settled on time.

All stakes on a market form one pot T = Y + N. At settlement the fee f = 1% is taken from the pot and the winning side shares the rest:

payout(w) = s(w) ÷ S × T × (1 − f)

where s(w) is the wallet's stake on the winning side and S is that side's total, rounded down to the lamport; the rounding dust joins the fee. A void market returns every stake in full. The implied chance of yes is Y ÷ T; it moves until betting closes. Payouts are pushed to the staking wallet; nothing is claimed.

A PumpSwap pool is constant product. With SOL reserve R, moving the market cap by a factor k needs about R × |√k − 1| SOL of buying or selling. A median only moves if that push is held between random reads for more than half of the window, while traders sell into it and the pool charges its fee φ both ways, so the keeper prices the attack as

cost = R × |√k − 1| × (2φ + 0.35 × window hours ÷ 2)
cap = cost ÷ 1.25

Example: R = 100 SOL, φ = 0.3%, 1.25× over 24 hours. Push 11.80 SOL, cost 4.20 SOL, cap 3.36 SOL. Markets whose cap would be under 1 SOL are refused at opening.

Limit. The cap only goes down: before each bet it is recomputed from the live pool and the lower of the two applies, so liquidity added to inflate a cap and pulled later does not help.

80% of every fee goes to the treasury and 20% to the keeper wallet, which pays the network fee of every payout and refund. Void markets pay no fee.

Stakes sit in a vault wallet whose key is held by the keeper. Users trust the keeper to pay; there is no on-chain enforcement. The design keeps that trust checkable: bets and payouts are plain SOL transfers, the rules here are complete, and the keeper publishes every reading, stake and payout of every market (GET /book/<id>). Money in open markets is capped (25 SOL at launch).

• Bets. A bet is a SOL transfer to the vault with the memo eyehood:<market>:<Y|N>. The keeper applies each transfer exactly once; anything it cannot take is refunded to the sender.
• Payouts. Paid in batches from the vault. A batch's signature is recorded before it is sent, so a crash can never pay twice.
• Health. The keeper's /health fails when its fee wallet is empty, reads go stale, the vault holds less than it owes, or its loop stalls, and it alerts the operator.
• Empty markets. A market opens with no money in it. Until someone bets, the chance shown is the model's estimate, marked with ~. If one side is still empty when betting closes, every stake is refunded.

• The keeper holds the vault key: theft or loss of it loses the vault. The launch cap bounds this.
• The code is tested against a copy of mainnet but not externally audited.
• A wrong side loses its whole stake. Memecoins move fast.
• pump.fun sets PumpSwap's fees and can change pool parameters, including its virtual reserves.
• If the keeper stops reading during a window, that market voids instead of answering; if it stops paying, payouts wait.

Solana mainnet.