Surf docs

How it works

Surf lets you go long or short on selected Solana memecoins with 1x to 3x leverage, using USDC as collateral. There is no order book: every trade is against a single house vault, at the oracle price.

You deposit USDC once, get a trading balance, and trade from it. After you click Enable trading, your wallet signs one message that authorises a 24-hour session key in your browser, so individual trades don't need a wallet popup. The session key can open and close positions for you; it can't withdraw.

Your position is tracked in USD notional. PnL is size × (mark − entry) / entry for longs and the reverse for shorts. You can close all or part of a position, add margin, and set take-profit and stop-loss triggers that a keeper executes for you.

Custody & funds

Surf is custodial. Deposited USDC is held in a vault wallet whose key is held by the Surf server. The rules on this page are enforced by the server's engine and its ledger, not by an on-chain program, so you are trusting the operator to run them honestly and keep the key safe.

• Deposit: send USDC from your wallet to the vault's token account (the Deposit button does this). It's credited to the wallet that sent it, usually within seconds.
• Withdraw: your wallet signs a withdrawal message (always the wallet itself, never the session key). The server pays out on-chain within seconds. Only free balance can be withdrawn, not collateral in open positions.
• One-way house money: the engine has no admin withdrawal. House USDC only leaves the vault to pay traders.
• Proof of reserves: the Vault page compares the vault's live on-chain USDC balance with everything the engine owes (house balance, collateral, user balances and pending withdrawals). If the vault ever holds less, trading is paused automatically.

Depositing & withdrawing SOL

• Your trading balance is always USDC. SOL you deposit is swapped to USDC automatically via Jupiter at the market price (on devnet the swap is simulated at the live SOL price), and the USDC it produces is credited once converted, usually within a minute.
• Send from your own wallet, not an exchange. A SOL deposit is credited to the wallet that signed and paid for the transfer, so exchange withdrawals would be credited to the exchange.
• Minimums: 0.01 SOL per deposit (smaller transfers aren't credited) and $5 per SOL withdrawal.
• SOL withdrawals debit USDC from your balance and are swapped to SOL at the price when they're paid, so the SOL you receive can differ slightly from the estimate. If the swap fails, the USDC goes back to your balance.

Liquidity

Every trade settles against one USDC house vault. Its liquidity is what pays winning traders, and it is funded by the token's dev wallets (the StonkFun creator/dev wallets) in two ways:

• Creator-fee sweeps (automatic): the dev wallet holding the StonkFun Fee Key NFT claims the token's creator fees, swaps them to USDC via Jupiter and deposits them into the vault.
• Direct top-ups: USDC, or SOL (auto-converted to USDC), sent to the vault from a listed dev wallet is credited as house liquidity, not to that wallet's own trading balance.

It's one-way. Neither the dev wallets nor the operator can withdraw house liquidity: there is no admin withdrawal in the engine. It only leaves the vault to pay traders' winnings. Trading fees and losing positions also flow into it.

When liquidity is tight: every position reserves its maximum payout (300% of collateral) when it opens. If the vault can't reserve that, the open is rejected (“Vault can't cover this position's max payout”), and the borrow fee rises steeply as utilisation climbs. Closing, adding margin and withdrawing your balance still work.

The dev wallets are listed under Addresses, and the Vault page shows how much each has contributed. On devnet the vault also has a separate admin test seed, which is not from the dev wallets.

Fees

• Open and close: 0.10% of notional each. The open fee comes out of your collateral, and position size is set so leverage is exact after the fee: $100 at 3x gives a $299.10 position with $99.70 collateral.
• Borrow fee, charged per hour on notional and paid to the vault. It follows a kinked curve on vault utilisation (reserved payouts ÷ house liquidity): 0.0005%/h at 0%, 0.0025%/h at the 80% kink, rising steeply to 0.0225%/h at 100%.
• Funding, based on the long/short open-interest imbalance: up to 0.01%/h at full imbalance. The majority side pays and the minority side earns on its (smaller) notional. The difference goes to the vault, so funding never makes the vault a net payer.

Fees accrue continuously and are settled whenever you interact with the position or it is closed.

Liquidation

equity       = collateral + pnl − borrow owed − funding owed − close fee
liquidatable ⇔ equity < size × maintenance margin (10% by default)

liq. price (long)  ≈ entry × (1 − (C − mm × S) / S)
liq. price (short) ≈ entry × (1 + (C − mm × S) / S)

The UI includes accrued fees in the liquidation price it shows. For example, a $100 3x long is liquidated after a price drop of about 23.3%; at 1x the drop is about 90%. The keeper checks every position continuously and liquidates it at the oracle price. Your remaining equity goes to the vault; you get nothing back.

Limits

• $10 minimum collateral per position.
• 3x maximum leverage, in 0.1x steps. Some markets may have a lower cap.
• 300% profit cap: a position can win at most 3× its collateral. That amount is reserved in the vault when you open, so every winning position can always be paid. If the vault can't reserve it, the trade is rejected.
• Per-market caps on open interest per side and on single-position size, both as a share of house liquidity.

Oracle & execution

Prices come from Pyth. Markets without a Pyth feed use a median of several DEX price sources, checked against a recent average. The engine fetches a fresh price for every trade and rejects prices that are older than 30 seconds, have too wide a confidence interval, or deviate too far from their recent average.

Trades execute at the edge of the confidence band, not the mid price: long opens and short closes at price + conf, short opens and long closes at price − conf. This removes most of the edge from trading on oracle noise. Liquidations and TP/SL triggers use the mid price, but TP/SL orders fill at the band price when executed, so fills can gap past your trigger. Your slippage setting bounds the worst acceptable price.

Circuit breaker

If a market's price moves more than 15% within 60 seconds, the market is automatically halted and the trade that triggered it doesn't execute. While a market is halted or reduce-only, new positions can't be opened. The admin can also pause the whole protocol.

Risks

• You can lose all your collateral. Leverage magnifies losses and liquidation returns nothing.
• Custodial risk: funds are held by the operator's server wallet. A compromised server or key, or an operator who stops honouring withdrawals, can lose your deposit.
• Unaudited software. Bugs in the engine, keeper or UI can lose funds.
• Oracle risk: wrong, stale or manipulated prices, and memecoin volatility, can cause bad fills or liquidations.
• Keeper risk: TP/SL execution, liquidations and withdrawal payouts all depend on the operator's keeper being online.
• Vault capacity: when the vault is heavily used, new positions and margin additions may be rejected.
• Regulation: leveraged crypto derivatives are restricted for retail users in some jurisdictions, including the UK and US. Access from restricted regions is blocked.

Addresses

The wallets Surf runs, so you can check every deposit, payout and fee sweep yourself on Solscan.