Pick up to 5 assets and weights. Holders deposit USDC and get a token that mirrors the whole basket. They can hold it, send it, trade it, and redeem it any time for every asset inside or for USDC. Nobody can withdraw the assets, because the program has no instruction for that.
potbot.fun · Live POTFolios · How it works · Roadmap · Docs
Colosseum Crypto World's Fair entry (Sept 14 to Oct 12, 2026). What was built during the Fair, where it lives and how to verify it in two minutes: HACKATHON.md · judges page
- What it is
- Try it in two minutes
- How it works
- Live on devnet
- Security
- Limits today and the path to mainnet
- Repository map
- Build, test, run
- Documentation
- History
A POTFolio is an on-chain basket with a token on top.
| Role | What they do | What they cannot do |
|---|---|---|
| Creator | Picks 2 to 5 assets and weights, names the token, earns 40% of the entry fee forever. | Touch the assets. Can only pause deposits or cap the size. |
| Holder | Deposits USDC, receives tokens at the basket's current value (NAV). Redeems any time for every asset in kind or for USDC in one transaction. | Be locked in. Exit needs no oracle, no keeper, and cannot be paused. |
| Keeper | Buys and rebalances the basket toward target weights. Anyone can run one. | Trade past target, trade more than 25% of NAV at once, or deliver less than the Pyth-priced minimum. The whole transaction reverts. |
| PotBot | Runs the site, the keeper and the price operator; takes 20% of the entry fee. | Withdraw. There is no such instruction. Upgrades and asset listing go behind a multisig before mainnet. |
Fees: 0.30% on entry (40% creator, 40% referrer, 20% protocol), 0.50% on exit stays in the Pot for remaining holders, 0.10% on conversion to USDC. Details in fees and economics.
On potbot.fun/portfolios, devnet, with any Solana wallet or an email sign-in:
- Open a POTFolio and click Get test USDC. An empty wallet also receives a little SOL for fees.
- Deposit. One wallet prompt. The program mints your tokens at NAV; the basket is bought leg by leg right after, visible in the activity feed.
- Redeem for the assets or for USDC. One wallet prompt again.
- Open My Dashboard for your positions, share of each Pot, P&L, created Pots and invite links.
Every step is a real devnet transaction with an Explorer link. The same flow from a terminal, through the same server routes the site uses:
cd apps/web
POT_INDEX_WALLET_KEYPAIR=judge.json POT_INDEX_BASE_URL=https://potbot.fun \
npx tsx scripts/pot-index-operator-flow.ts faucet # 1,000 tUSDC + 0.1 SOL
npx tsx scripts/pot-index-operator-flow.ts deposit <mint> 40 # mint at NAV, basket bought
npx tsx scripts/pot-index-operator-flow.ts exit <mint> 5000000 # 5 tokens back in kind (base units)
npx tsx scripts/pot-index-operator-flow.ts exit-usdc <mint> 15000000 # 15 tokens as USDC, on-chain minimumcreator create_pot → add_leg ×2..5 → finalize_pot → set_index_metadata one tx, token exists (Pot… mint, name, logo)
holder deposit(usdc) → fee split → mint at Pyth NAV one signature
keeper rebalance_open … swap … rebalance_close bounded, atomic, toward target only
holder exit(shares) → every asset pro-rata, in kind never pausable, no oracle
holder exit_usdc_open … sell legs … exit_usdc_close USDC in one tx, program-enforced minimum
nobody withdraw no such instruction
Single ledger. The SPL token supply is the only record of ownership. Mint on deposit, burn on exit, no internal balances to drift.
Honest price. Deposits are priced from Pyth pull updates no older than 60 seconds (cap enforced in code), confidence at most 2%, priced at price ± confidence against the Pot. Stale prices block deposits, never exits.
One signature. The price operator refreshes Pyth prices into persistent price accounts, prepares the single holder transaction and hands it to the wallet. After the holder signs, the operator submits it and, for deposits, buys the basket as keeper. The holder signs once; the program checks everything. Details in operations.
Bounded keepers. rebalance_open reads the transaction through the Instructions sysvar and refuses unless a matching rebalance_close follows. Trades move toward target weights only, at most 25% of NAV per trade, and must deliver at least the Pyth value minus the slippage band, or everything reverts.
Metadata on-chain. Metaplex metadata is attached by the program, so the token shows its name and logo in every wallet.
Program reference with every instruction, account, limit and error code: program.md.
Program DfKKe9oiPb8E98qxZ95otU3D5y1L1U3L2Eh3A7HQiUxr (Explorer), 17 instructions, v1.1 since Oct 12. Five showcase POTFolios with live Pyth prices and test tokens:
| POTFolio | Basket | Mint |
|---|---|---|
Solana Blue Chips $SBC |
SOL 50 / BTC 30 / ETH 20 | PotSvA4… |
Solana Native $SOLN |
SOL 50 / JitoSOL 30 / PYTH 20 | Potgd4g… |
Majors 5 $MJR5 |
BTC 35 / ETH 25 / SOL 20 / BNB 10 / XRP 10 | PotgdAt… |
Wall St on Solana $WSTS |
TSLAx 40 / QQQx 40 / SOL 20 | Potsmds… |
Doge & Sol $DGSL |
DOGE 60 / SOL 40 | Potsts7… |
Anyone can create their own at potbot.fun/portfolios/new. Devnet legs are test mints priced from real Pyth feeds; swaps run against a PotBot market maker. On mainnet the legs are the real tokens and the swaps go through Jupiter.
Three reviews before the Fair closed: Oct 8 and Oct 10 against the Solana Foundation program-security checklist (the second by a reviewer that had not seen the code being written), and Oct 11 an independent human review by a Solana engineer. Result: no fund-draining path from an unprivileged account, no critical or high findings.
The Oct 11 review showed that the Oct 10 oracle fix was not one: a pull oracle accepts old signed ticks posted now, so a slot check does not bound price age. The fix is the age window itself: 60 seconds, hard cap in code, with a test that rejects a 45-second-old tick 10% below market.
What the program enforces: oracle age cap and conservative confidence pricing, rebalance deadband and cooldown, per-trade cap and slippage floor, two-step admin, exit safety valve against a stale rebalance flag, USDC cannot be registered as a leg, 1 USDC minimum deposit.
Known and accepted on devnet: a depositor can self-refer from a second wallet (registered referrers later); the slippage band is a floor a keeper can take in full; upgrade authority and admin are one key until the Squads multisig lands. Every finding, with status, is in security.md. Report issues per SECURITY.md.
Fixed weights. Up to 5 assets. Devnet swaps through a PotBot market maker, not Jupiter. One operator key.
Before the first mainnet deposit: Squads 2-of-3 multisig with a timelock on upgrade authority, admin and asset registration; deploy and init_config in one transaction; verified build on Explorer; external audit of the final version; Jupiter for exits to USDC; a capped flagship POTFolio. Then: Managed POTFolios (creator adjusts inside a public mandate with a timelock), Community POTFolios (holders vote with the token), 10 assets, a POTFolio/USDC pool on Meteora, Creator POTFolios built from a public profile. Live roadmap: potbot.fun/roadmap · mainnet checklist.
packages/pot-index/ pot_index Anchor program (the POTFolio protocol) + LiteSVM tests ← start here
programs/pot_index/src/ lib.rs (17 instructions), instructions/, state/, oracle.rs, constants.rs
tests/pot_flow.rs 12 end-to-end tests
apps/web/ Next.js app: landing, /portfolios, /portfolios/new, /portfolios/[mint], /dashboard, /learn, /roadmap, /mainnet
src/lib/pot-index/ client builders, Pyth helpers, registry, operator (server), garden levels
src/app/api/pot-index/ tx/prepare + tx/submit (one-signature flow), faucet, NAV history, token metadata
src/hooks/usePotIndex.ts deposit / exit / exit-usdc from the browser
scripts/ devnet init, keeper, operator flow, metadata, config
docs/potfolio/ overview, program, fees, keepers, garden mode, security, landscape, operations, FAQ
packages/program/ pot_vault: PotBot v2 governed vaults (previous hackathon, kept for reference)
packages/sdk/ apps/api/ apps/keeper/ apps/bot/ apps/potbot-mcp/ PotBot v2 supporting services
# program (Anchor 1.2.1, Solana CLI 4.3, Rust 1.89)
cd packages/pot-index
./test.sh # SBPF build + LiteSVM suite, 12 tests
anchor build # deployable artifact + IDL
# web
cd apps/web
cp .env.example .env.local # PYTH_API_KEY, POT_INDEX_FAUCET_KEYPAIR (devnet operator), NEXT_PUBLIC_SOLANA_RPC_URL
npm install && npx next dev
# devnet operations (docs/potfolio/operations.md)
npm run pot-index:init # assets, inventory, showcase Pots
npm run pot-index:keeper -- --loop 300 # keeper over all showcase Pots
npx tsx scripts/pot-index-set-config.ts showCI runs the program tests and the web build on every push.
| Doc | What it covers |
|---|---|
| overview.md | The product, the pivot from governed vaults to the token, who it is for |
| program.md | Every instruction, account, limit and error code |
| fees-and-economics.md | Fee split, creator and referrer economics, revenue model |
| keepers.md | Rebalance bounds, keeper incentives, price operator |
| security.md | Three reviews, every finding and its status, trust model |
| operations.md | Deploy history, one-signature flow, judge run |
| landscape.md | Symmetry, Cesto, DiversiFi, GLAM, Ondo and what POTFolio adds |
| faq.md | Questions holders and creators ask |
PotBot started as a Telegram group that wanted to trade from one wallet. Three Colosseum hackathons, one idea:
- Group trading (v1): a shared pot, votes on trades, one treasury for the group.
- Governed vaults (v2, Solana Frontier): non-custodial vaults with strategies, capital in program-owned accounts, the group governs. Program
pot_vault, MCP server for AI agents. Kept in this repo underpackages/programandapps/. - The token (POTFolio, Crypto World's Fair): the vault wrapped into a single liquid token anyone can hold. This is the product PotBot keeps building after the Fair.
Founder: Yehor (YD), Amsterdam. Y-DAO Amsterdam · Superteam NL. MIT license.