Risks

The imbalance is public before the cross#

Reveals happen on chain, in the window before the open. From the first reveal, anyone can read each revealed order and add up the imbalance. It stops mattering at the cross. With default parameters the exposure is at most about 30.5 minutes: the 30 minutes from reveal start to the open, the 30-second open delay, and the few seconds the price capture takes. Lull measures this interval on every lull, from the first reveal to the price capture.

P_open is Pyth's price of the underlying stock in its regular session, aggregated across publishers. A watcher cannot move it by trading an xStock pool. A watcher can trade on other venues with the information, much as traders use the imbalance data that exchanges publish before their own opening auctions.

Your own order is public from the moment your reveal lands. Revealing later in the window shortens that time but raises the risk of missing the window. Deposits are public too, so a standing balance hides your side better than a deposit made during the lull.

AAPLx issuer controls#

The AAPLx mint carries issuer powers that apply to every AAPLx token account, the market's vault included:

• Permanent delegate. The issuer can move AAPLx out of any account, including the vault.
• Pause. The issuer can pause transfers. AAPLx deposits and withdrawals then fail. The cross and claims only change balances inside the market, so they still run.
• Freeze. The issuer can freeze a token account, yours or the vault's, which stops transfers out of it.

Oracle dependence#

The cross depends on one feed, Equity.US.AAPL/USD. Lull checks that each price is fully verified, belongs to that feed and was published inside the capture window. An uncertain price triggers the TWAP fallback, and a missing price cancels the lull. A price that passes every check and is still wrong would be used. See P_open.

Capture is permissionless, and the first valid capture wins. Whoever captures can only choose among prices published in the capture window (30 seconds by default). Lull's crank posts the first update after the open plus the delay and captures it, so its captures are exact. Someone else can still capture first from Pyth's feed account inside the window. The exactness flag records which of the two happened.

Crank liveness and cancellation#

Every step after the reveal window is permissionless: forfeit, price capture, tally, finalize and claim. Lull's crank sends them, and anyone else can too. If nobody captures a price inside the capture window, the lull cannot be priced. After the pricing deadline (2 minutes 30 seconds after the open by default), anyone can cancel it, and every revealed order is refunded in full. A cancelled lull means no trade at that open. It does not cost revealed orders anything.

Market authority#

Each market has an authority. It can:

• Publish lulls with their close, reveal and open times. The program cannot check these against Pyth's schedule. It does enforce close < reveal start < reveal end ≤ open, and it accepts a lull only before that lull's reveal window starts.
• Change market parameters within bounds the program checks. New minimums and a new maximum spread apply to reveals from then on, and new pricing rules apply to lulls not yet priced. The bond is fixed per ticket when it is sealed.
• Cancel a lull at any time before it is priced. Revealed orders are refunded in full. Tickets not yet revealed can no longer be revealed, so their bonds are forfeited.

Forfeited bonds go to the market's treasury. The authority cannot move user funds, change a sealed order, or set a lull's price or cross.

Keeping your salts#

A sealed order can only be revealed with its salt, which lives in the browser that sealed it. Losing it forfeits the bond. The export file lets anyone who has it read and reveal your orders, though not change them. See Back up sealed orders.

Missing the reveal#

A reveal that does not land before the window ends forfeits the bond. Network congestion, an unattended wallet or a free balance that is too low can each cause it. Reveal with time to spare. The windows are checked against Solana's clock, which can differ slightly from yours.

Program risk#

Lull is a program on Solana. Deposited funds sit in the market's vault under its control. A flaw in the program, or in the token programs it calls, could affect those funds.