Tokenized stocks, priced in the open.
A self-custodial exchange on Solana. Every quote starts from a verified oracle mid and settles in USDC, with spread, skew and fee on separate lines. Trade from your own wallet and sign once.
- Chainlink Data Streams with a Pyth cross-check
- Built for Solana
- Settles in USDC
- $ARCTER: 44zqYYFSSkZgogHno3WcqmdCXJSdC2mn8dwFahqVpump
Pay
Receive
- Verified mid
- 177.40 USDC
- Spread · 10.0 bps at ×1.0
- 9.99 USDC
- Skew
- +0 bps
- Protocol fee · 2.0 bps
- 2.00 USDC
Every cost line is shown before you sign
Markets shown: NVDAx, Tier A; SPYx, Tier A; AAPLx, Tier A; MSFTx, Tier A; QQQx, Tier A; TSLAx, Tier B; AMZNx, Tier B; PLTRx, Tier C.
Four terms, and anyone can redo the sum
Reserves decide how wide a quote is, never where it sits. The formula is public, so a holder with the same inputs reaches the same result. Figures below work through one NVDAx quote.
price = verified mid + half-spread × regime ± skew + protocol fee
- verified midTerm 1
177.40 USDC
Chainlink Data Streams is the primary source, with Pyth as a cross-check. A stale report, or a gap between the two beyond a set band, halts the market.
- half-spread × regimeTerm 2
10.0 bps, ×1.0
Tier A starts from 10 bps per side. The regime then multiplies it: OPEN keeps ×1.0, EXTENDED applies ×1.5 and CLOSED applies ×3.0.
- skewTerm 3
+0 bps
A vault away from its 50/50 target charges more on the crowded side and less on the helpful side, within ±15 bps on Tier A.
- protocol feeTerm 4
2.0 bps
A distinct ticket line and a distinct field in the fill record. The price itself never absorbs it.
177.61USDC
A mid of 177.40 USDC, worked term by term. The program rejects a Tier A fill more than 75 bps from the verified mid.
Recomputed inside your transaction
The program rebuilds the vault price from the signed report and the Market account as it executes. A front end cannot quote you outside the formula.
A maker must improve on the vault
An ed25519-signed quote from an approved maker must sit inside the oracle band and pay you more than the vault. Signing off-chain costs a maker nothing.
You sign the minimum
Each swap carries a minimum output and an expiry, and a blockhash lapses after about 150 slots anyway. Keep the minimum tight, since sandwich attacks exist on Solana.
The session is part of the price
An equity token can move on Solana at any hour, while the share it tracks has regular trading for about 6.5 hours each weekday. Every market sits in one of four regimes, and three of them quote.
- OPEN
Regular US hours
spread ×1.0 · full clip
- EXTENDED
Either side of regular hours
spread ×1.5 · clip ×0.75
- CLOSED
Home exchange closed
spread ×3.0 · clip ×0.5
A weekend is CLOSED from start to finish. Vaults still quote, at ×3.0 with half the clip, because someone carries the gap into Monday and that risk belongs in the price. The ticket names the regime and its multiplier ahead of your signature. Each signal can only tighten a market, never loosen it. An order placed in regular hours pays a narrower spread, and the ticket makes that comparison easy.
What moves a market to HALTED
4- 1Oracle data passes the session age limit, or Chainlink and Pyth disagree beyond a set bandBack once fresh reports agree
- 2An issuer or feed pause covers a corporate action, or a guardian steps in by handBack once that pause is lifted
- 3A single update shifts the price more than 25%Back once review passes the time lock
- 4A Solana cluster restart happened and its one-hour grace window is still openBack once that window has ended
HALTED stops quotes. Withdrawals continue where safe, though an issuer freeze can hold the token side while USDC stays withdrawable.
Two sources of liquidity, one ticket
Arcter runs two lanes behind a single router. Oracle-centered vaults take everyday sizes, and approved makers sign quotes for larger orders. You see the better of the two as one price.
- Component 1
Vault lane
How it works
One Market account per asset holds that asset and USDC, and quotes both sides around the verified mid. Tier, regime and inventory set the width. Everyday sizes fill here.
The result
You can recompute a fill from public inputs, and depositors are paid from spread. They still carry inventory risk, gap risk and issuer risk.
- Component 2
Maker lane
How it works
Approved makers sign short-lived ed25519 quotes off-chain. The taker's transaction carries the signature, and the native Ed25519 program verifies it during settlement.
The result
Larger sizes avoid walking a curve. A PDA blocks replay, each quote has to sit inside the oracle band, and both legs settle together or not at all.
- Component 3
Router
How it works
The arcter-router program is the single entry point. It enforces your minimum output and expiry, compares the two lanes, and shows you one price on one ticket.
The result
A stock-to-stock trade runs as two legs through USDC under one signature. If a leg fails, the transaction reverts and no tokens move.
Tier A oracle band
75 bps
A hard limit for vault and maker fills alike. The program rejects any Tier A fill further than this from the verified mid.
Protocol fee
2 bps
A separate ticket line. The protocol also keeps 10% of the spread income of each vault, and the SOL network fee comes on top.
Held by Arcter
None
Tokens sit in your wallet or in vault accounts governed by program rules. Your signature moves them, with no standing approvals. Issuer powers still apply.
Participants
Takers
Read the regime and each cost on one ticket, then sign once. Not available to US persons or other excluded jurisdictions.
Depositors
Deposit into a vault and earn spread income. Exit pro rata in kind. An issuer can freeze tokens or move them, including out of a vault.
Makers
Signing off-chain has no network cost. Your quote wins only by paying more than the vault, inside the band, and the taker's transaction settles it.
A listed share already has a price
Constant-product pools suit tokens whose price forms on-chain. An equity token tracks a price formed on an exchange, so Arcter starts from that reference and builds the quote around it. Here is how the two approaches differ.
The midpoint
- Constant-product pool
- The ratio of the two reserves, which moves when someone trades
- Arcter
- A verified oracle report, with an oracle band around every fill
A closed exchange
- Constant-product pool
- Usually no separate charge for gap risk
- Arcter
- CLOSED regime: spread ×3.0 and clip ×0.5, both printed on the ticket
How depositors earn
- Constant-product pool
- Fees, less what arbitrage takes on each outside move
- Arcter
- Spread around the mid, with skew paying to rebalance. Inventory risk remains
Splits and multipliers
- Constant-product pool
- Handling varies by pool and by integration
- Arcter
- Math in raw units, multiplier read per quote, HALTED during an issuer or feed pause
Bigger tickets
- Constant-product pool
- Cost rises with size along the curve
- Arcter
- Approved makers sign quotes held inside the oracle band
Showing the cost
- Constant-product pool
- Often shown as one output figure
- Arcter
- Mid, spread, skew and fee on separate lines, then in the fill record
Pools remain a good fit for assets with no outside price. Proprietary AMMs already quote crypto majors well, though their logic is private. Arcter's bet is a public formula for assets that have a reference.
Solana, with the dates attached
Arcter runs on Solana. This sheet describes the network and its assets as of 7 Nov 2026, so each figure can be checked against its date. Network facts drift, and the date says when they held.
- Slot time
- ~400 msunchanged by the Votor upgrade
- Finality target
- ~150 msVotor, live since 21 Oct 2026
- Base fee
- 5,000lamports per signature, paid in SOL
- xStocks on Solana
- 100+and 250+ Ondo instruments
- Arcter programs
- Upgradeable through a Squads multisig with a time lock
- Consensus
- Proof of Stake, leaders on a published schedule
- xStocks issuer
- Backed Assets (JE) Limited, Jersey, as Token-2022 mints
- Corporate actions
- Scaled UI Amount multiplier on xStocks mints
- Oracle design
- Chainlink Data Streams, with a Pyth cross-check
- Settlement asset
- USDC from Circle, native on Solana
- Transaction limits
- 1,232 bytes, blockhash expiry after about 150 slots
- Last cluster halt
- 6 Feb 2024, 1,000 days clear reported about 2 Nov 2026
- 01
Token-2022 settings sit on the mint, so a venue can read hooks, delegates and multipliers. Issuers can still freeze or move tokens.
- 02
Solana reported about $4.4B of tokenized stock volume in Sept 2026, so the flow Arcter serves already runs here.
- 03
Low base fees keep modest tickets worth executing and short slots narrow the quote gap. Congestion and RPC failures still occur.
What we owe you on every trade
Each commitment is paired with a check you can run yourself, from public on-chain data. A failed check counts as an incident, with a written post-mortem within 14 days.
Itemized fill records
Mid, spread, skew and fee become separate fields in each fill event, matching the ticket you signed.
Checkreconcile a fill against Solscan or the Solana Explorer
A hard oracle band
Any fill beyond the band is rejected by program invariant, whichever lane it came from.
Checkcompare any fill price with the band at its slot
Published fill quality
The gap between every fill and the reference price is reported with nothing filtered out.
Checkrecompute any figure from on-chain events
No payment for order flow
The router gives no liquidity source preference. It picks the better price it can verify.
Checkwork out the cheaper lane from a fill's inputs
Custody stays with you
Each trade moves tokens under your own signature, and no standing approval is ever requested.
Checkinspect the signer list on any swap
No Arcter condition on exits
Withdrawals continue where safe, HALTED included. Issuers sit outside this: they can freeze tokens or move them, even from a vault.
Checkread each mint's extensions and the Ledger halt record
Upgrades come with notice
Programs stay upgradeable, so their code can change. Upgrades and parameter changes pass a Squads multisig and its time lock.
Checkread the upgrade authority on each program account
Verified builds
Every program ships as a verified build. An audit is in progress, and no completed audit report has been published.
Checkrebuild from the tagged source and compare
Straight answers, risks included
Seven things a careful reader would want to know before trusting a venue. The documentation goes further, with quote math, failure cases and open questions.
How do I trade on Arcter?
Connect a Solana wallet, pick two assets, read the itemized price and sign once. The ticket shows mid, spread, skew and fee before you sign, and the fill record keeps the same lines. A failed transaction still costs its SOL network fee. An audit is in progress, and no completed audit report has been published.
Who can use it?
US persons and other excluded jurisdictions cannot use Arcter. Issuers set those lists, and they differ by token and channel. Kraken's xStocks pages exclude the US, Canada, the UK and Australia plus prohibited regions, while Ondo limits UK, Swiss and some EEA access to qualified or professional clients. Each market takes the strictest reading that applies.
Does holding NVDAx make me an NVIDIA shareholder?
No. xStocks are 1:1 backed tracker certificates from Backed Assets (JE) Limited. They give price exposure and no shareholder rights. A Scaled UI Amount multiplier reflects splits and dividends while your raw balance stays put. Mint settings also let an issuer freeze tokens or move them out of any account, so issuer risk stays with the holder.
Why is a Sunday quote wider than a Tuesday one?
The share's exchange is closed, so depositors carry the gap until it reopens. In CLOSED the spread is ×3.0 and the clip ×0.5. Pre-market and after-hours run as EXTENDED, at ×1.5 and ×0.75. The ticket names the regime and multiplier ahead of your signature, and a trade that can wait for OPEN should cost less.
How do vault depositors earn, and what can they lose?
Income is spread from fills, less a 10% protocol share, and it accrues to share value. There are no token emissions or points. Losses can come from inventory held through a price gap or from an issuer: a freeze can hold the token side of a withdrawal, and a permanent delegate can move tokens out of a vault. The unaffected USDC side can still leave. No outcome is guaranteed.
Who can change the rules or the code?
Programs are upgradeable through a Squads multisig with a time lock, so the code can change. Parameter changes take the same path, with reasons published first. Verified builds let anyone match deployed code to its source. A guardian can pause trading but cannot move funds, and quotes come from the public formula, so the team has no way to set one by hand.
Can other apps integrate with Arcter?
Yes. Attestations are held per wallet, so any client can call the router directly, and the router applies the same checks whichever app sends the transaction. The quote formula is public, so an integrator can rebuild a vault price from the same oracle report and Market account and compare it with the fill record.
Know what you paid, whatever the hour.
Arcter is live on Solana, with an audit being conducted. Check out the app, follow the build on X, and reach out with questions or feedback.
