short.win

A Solana protocol for permissionless peer-to-peer token lending, built to short memecoins, including pump.fun launches still on the bonding curve. Lenders deposit tokens into a per-token pool and earn rent. A borrower posts SOL margin; the program borrows the tokens and sells them in the same transaction, and buys them back on close, liquidation or expiry, pricing every leg with exact on-chain venue math (pump.fun curve, PumpSwap, Raydium AMM v4 and CPMM). When a buyback is impossible, lenders are repaid in SOL.

• What it does and why: docs/SPEC.md
• How it is built: docs/design/ARCHITECTURE.md and docs/design/ECONOMICS.md
• Toolchain, build and test commands: docs/DEVELOPMENT.md
• For auditors: docs/AUDIT.md (scope, threat model, known issues); reporting a vulnerability: SECURITY.md

Status: milestones M0–M10 built (the ≥ 24-hour fuzz criterion met for M7 by run 2, for M10 by run 4 and on the final program bytes by run E, tests/fuzz/README.md): the program with every venue (pump.fun curve, PumpSwap, Raydium AMM v4 and CPMM), the keeper, the indexer and API, and the web frontend (apps/web, with its Playwright E2E on a local validator). Pending: M10's external audit (docs/AUDIT.md). Not deployed.

Layout

programs/shortwin/            Anchor 1.2.0 program
crates/shortwin-math/         no_std protocol math shared by program, keeper and frontend
crates/shortwin-math-wasm/    wasm-bindgen facade over shortwin-math
crates/shortwin-venue-state/  no_std readers of venue, mint, Pyth and ProgramData accounts
clients/js/                   @shortwin/client, generated by Codama from the IDL
services/                     keeper and indexer + API (Rust workspace of its own)
apps/web/                     the web frontend (M9; docs/design/FRONTEND.md)
packages/math-wasm/           browser build of shortwin-math-wasm for apps/web
tests/litesvm/                program tests (LiteSVM 0.16) with the invariant hooks
tests/bench/                  Mollusk CU benches (math primitives, M1 instructions)
tests/fixtures/               mainnet account dumps with checksums
tests/mock_cpamm/             the test-only mock venue program (M2)
scripts/                      config gate, test-venue build, protocol ALT, fixture dumps
docs/                         spec, design, research, development guide

Licence

short.win is source-available, not open source. REUSE.toml gives every file's licence, and the licence texts are in LICENSES/.

• The protocol (the program, crates, keeper, indexer, tests and scripts): the Business Source License 1.1 (LICENSE). Non-production use is free. Production use is allowed when it interacts with the official short.win deployment: keepers, liquidators, indexers, front ends, wallets and CPI integrations (GRANTS.md). Each version becomes Apache-2.0 on 2030-10-01, or four years after its first public release if that is earlier.
• The TypeScript client (clients/js, with the IDL) and the indexer's API description: Apache-2.0.
• The documentation: CC BY-NC-ND 4.0.
• The web app (apps/web, packages/math-wasm) and the brand (the name and the logo): all rights reserved.
• Third-party files keep their own licences: THIRD_PARTY_NOTICES.md.