Torch Market

Every token is its own margin market. Treasury-backed lending, real-token short selling, on-chain pricing. No oracles. No LPs. No bootstrapping.

Security Scan

The skill's code, instructions, and requested environment variables are coherent with a Solana protocol/SDK for building and optionally submitting Torch Market transactions; nothing requested is disproportionate to that purpose.

Purpose & Capability

Name/description (Torch Market, Solana margin/short/lending protocol) match the included SDK code and agent metadata. The declared primary credential is SOLANA_RPC_URL and an optional SOLANA_PRIVATE_KEY for signing — both expected for a Solana SDK. No unrelated credentials or binaries are requested.

Instruction Scope

SKILL.md instructs read/query/build flows (get quote → build tx → sign/send) and explicitly supports read-only mode when no private key is provided. The instructions and included SDK methods focus on on-chain queries and transaction building/submission; they do not ask to read unrelated system files or to exfiltrate non-protocol data.

Install Mechanism

This is instruction-first (no forced install). The SDK is bundled under lib/torchsdk/ and an optional npm install entry (torchsdk@^10.2.0) is declared. No remote arbitrary downloads, URL shorteners, or external installers are used — risk is limited but the bundled code increases the static surface the agent can execute.

Credentials

Only SOLANA_RPC_URL (required) and SOLANA_PRIVATE_KEY (optional) plus TORCH_NETWORK (optional) are requested. That is proportionate for a Solana SDK that can operate in read-only or signing mode. Metadata correctly marks the private key as sensitive. (Note: top-level registry summary showed a formatting artifact '[object Object]' for env vars — verify the actual env names when installing.)

Persistence & Privilege

The skill does not request always:true and does not enable autonomous model invocation (disable-model-invocation: true). No system-wide config writes or cross-skill modifications are present. The agent-run privileges are constrained to explicit user invocation.

Assessment

This skill appears to be what it says: a Solana protocol SDK + instruction set for reading state and building/submitting Torch Market transactions. Before installing: (1) Verify env var names (the registry summary had a formatting glitch); ensure you provide only an HTTPS SOLANA_RPC_URL you trust. (2) If you supply SOLANA_PRIVATE_KEY, only use a disposable controller key (the SKILL.md explicitly warns never to use a vault authority key). Do not give long-term/treasury keys. (3) The SDK is bundled in the skill — review the included lib/torchsdk/ files or run in a sandbox/testnet first if you want to validate behavior. (4) Disable-model-invocation is set, so the skill cannot be invoked autonomously, reducing risk. (5) If you plan to sign transactions, prefer local signing (keep keys off shared systems) and monitor RPC endpoints and funds; if unsure, use read-only mode (omit SOLANA_PRIVATE_KEY) to inspect quotes and unsigned txs only.

Every token launched on torch gets a funded treasury, a 300M token lending reserve, margin lending, short selling, and on-chain pricing — all live from migration.

No external LPs. No oracle feeds. No protocol token. No bootstrapping.

What Torch Is

A protocol where every token launches with its own margin market.

• Lending: borrow SOL against token collateral from the token's own treasury
• Short selling: borrow real tokens from the 300M treasury lock, sell on the real market
• Pricing: Raydium pool reserves — no external oracle
• Liquidation: permissionless — anyone can call
• Parameters: immutable on-chain — no admin key changes them

Shorts are not synthetic. Borrowed tokens are real. Selling them moves the real price. Short sellers are market participants contributing to price discovery.

Token Lifecycle

CREATE → BOND → MIGRATE → TRADE → MARGIN
                                     │
                                ┌────┴─────┐
                              LEND     SHORT SELL
                                │          │
                              REPAY    CLOSE
                                │          │
                              LIQUIDATE  LIQUIDATE

Bonding — constant-product curve. SOL splits: curve (100% of tokens to buyer) + treasury (17.5%→2.5% dynamic SOL rate). 2% max wallet. Completes at 100 or 200 SOL.

Migration — permissionless. Creates Raydium pool, burns LP tokens (liquidity locked forever), revokes mint/freeze authority permanently, activates 0.04% transfer fee.

Trading — token trades on Raydium. Transfer fees harvest to treasury as SOL. Treasury grows perpetually.

Margin — two capital pools, two-sided margin:

Pool	Asset	Purpose
Token Treasury	SOL	Lending pool — borrow SOL against token collateral
Treasury Lock	300M tokens	Short pool — borrow real tokens against SOL collateral

Constants

SUPPLY          1,000,000,000 tokens (6 decimals)
CURVE_SUPPLY    700,000,000 (70%)
TREASURY_LOCK   300,000,000 (30%)
MAX_WALLET      2% during bonding
BONDING_TARGET  100 SOL (Flame) / 200 SOL (Torch)
PROTOCOL_FEE    0.5% on buys
TREASURY_RATE   17.5% → 2.5% (dynamic decay)
TRANSFER_FEE    0.04% (post-migration, immutable)
MAX_LTV         50%
LIQ_THRESHOLD   65%
INTEREST        2% per epoch (~7 days)
LIQ_BONUS       10%
UTIL_CAP        80%
BORROW_CAP      5x collateral share of supply
MIN_BORROW      0.1 SOL
PROGRAM_ID      8hbUkonssSEEtkqzwM7ZcZrD9evacM92TcWSooVF4BeT

SDK

GET QUOTE → BUILD TX → SIGN & SEND

One flow, any token state. The SDK auto-routes bonding curve or Raydium DEX based on the quote's source field.

import { getBuyQuote, buildBuyTransaction } from "torchsdk";

const quote = await getBuyQuote(connection, mint, 100_000_000); // 0.1 SOL
const { transaction } = await buildBuyTransaction(connection, {
  mint, buyer: wallet, amount_sol: 100_000_000,
  slippage_bps: 500, vault: vaultCreator, quote,
});
// sign and send — VersionedTransaction, ALT-compressed

Queries

Function	Returns
getTokens(connection, params?)	Token list (filterable, sortable)
getToken(connection, mint)	Full detail: price, treasury, status
getTokenMetadata(connection, mint)	On-chain Token-2022 metadata
getHolders(connection, mint)	Top holders with balance/percentage
getMessages(connection, mint, limit?, opts?)	On-chain memos. { enrich: true } adds SAID
getLendingInfo(connection, mint)	Lending parameters and pool state
getLoanPosition(connection, mint, wallet)	Loan: collateral, debt, LTV, health
getAllLoanPositions(connection, mint)	All loans sorted by liquidation risk
getShortPosition(connection, mint, wallet)	Short: collateral, debt, LTV, health
getBuyQuote(connection, mint, sol)	Tokens out, fees, impact. source: bonding|dex
getSellQuote(connection, mint, tokens)	SOL out, impact. source: bonding|dex
getBorrowQuote(connection, mint, collateral)	Max borrow: LTV, pool, per-user caps
getVault(connection, creator)	Vault state
getVaultForWallet(connection, wallet)	Reverse vault lookup

Trading

Function	Description
buildBuyTransaction	Buy via vault. Auto-routes bonding/DEX
buildDirectBuyTransaction	Buy without vault (human wallets)
sendBuy	Build + simulate + submit vault buy via signAndSendTransaction
sendDirectBuy	Build + simulate + submit direct buy via signAndSendTransaction
buildSellTransaction	Sell via vault. Auto-routes bonding/DEX
buildCreateTokenTransaction	Launch token + treasury + 300M lock
sendCreateToken	Build + simulate + submit token creation (Phantom-friendly)
buildStarTransaction	Star token (0.02 SOL)
buildMigrateTransaction	Migrate to Raydium (permissionless)

Margin (post-migration)

Function	Description
buildBorrowTransaction	Borrow SOL against token collateral
buildRepayTransaction	Repay debt, unlock collateral
buildLiquidateTransaction	Liquidate loan (>65% LTV)
buildOpenShortTransaction	Post SOL, borrow tokens from treasury lock
buildCloseShortTransaction	Return tokens, recover SOL collateral
buildLiquidateShortTransaction	Liquidate short (>65% LTV)
buildClaimProtocolRewardsTransaction	Claim epoch trading rewards

Vault

Function	Signer
buildCreateVaultTransaction	creator
buildDepositVaultTransaction	anyone
buildWithdrawVaultTransaction	authority
buildWithdrawTokensTransaction	authority
buildLinkWalletTransaction	authority
buildUnlinkWalletTransaction	authority
buildTransferAuthorityTransaction	authority

Treasury Cranks (permissionless)

Function	Description
buildHarvestFeesTransaction	Harvest 0.04% transfer fees to treasury
buildSwapFeesToSolTransaction	Swap harvested tokens to SOL via Raydium
buildReclaimFailedTokenTransaction	Reclaim inactive tokens (7+ days)

Vault — Why Funds Are Safe

Human (authority)                   Agent (controller, ~0.01 SOL gas)
  ├── createVault()                  ├── buy(vault)       → vault pays
  ├── depositVault(5 SOL)            ├── sell(vault)      → SOL to vault
  ├── linkWallet(agent)              ├── borrow(vault)    → SOL to vault
  ├── withdrawVault()  ← auth only   ├── repay(vault)     → collateral back
  └── unlinkWallet()   ← instant     ├── openShort(vault) → tokens to vault
                                     └── closeShort(vault)→ SOL to vault

Guarantee	Mechanism
Full custody	Vault holds all SOL and tokens. Controller holds nothing.
Closed loop	Every operation returns value to vault. No leakage.
Authority separation	Creator (immutable) / Authority (transferable) / Controller (disposable)
Instant revocation	Authority unlinks controller in one tx
No extraction	Controllers cannot withdraw. Period.
Isolated positions	One loan per user per token. One short per user per token. No cascading.
Immutable parameters	LTV, liquidation, interest — set at deployment. No admin key changes them.

Key Safety

If SOLANA_PRIVATE_KEY is provided: must be a fresh disposable keypair (~0.01 SOL gas). All capital lives in vault. If compromised: attacker gets dust, authority revokes in one tx. Key never leaves the runtime.

If not provided: read-only mode — queries state, returns unsigned transactions.

Rules:

1. Never ask for a private key or seed phrase.
2. Never log, print, store, or transmit key material.
3. Use a secure HTTPS RPC endpoint.

Risk

Positions can be liquidated. Bad debt is possible in extreme conditions. There is no insurance fund. But:

• Bad debt is isolated — one position going underwater cannot affect any other position
• Per-user caps prevent pool concentration — one user cannot drain the lending pool
• 20% of treasury SOL is always reserved (utilization cap)
• Liquidation is permissionless — no keeper dependency

Verification

58 Kani proof harnesses. 59 end-to-end tests. All passing. Core arithmetic formally verified. See VERIFICATION.md.

Links

• torch.market | Whitepaper
• SDK: lib/torchsdk/ | npm | source
• Program: 8hbUkonssSEEtkqzwM7ZcZrD9evacM92TcWSooVF4BeT