Skip to content
Docs

Norynta public docs

Norynta RFQ Provider Pilot

Zero-guarantee RFQ provider protocol, signed-quote contract, risk controls, conformance flow, and activation gates.

RFQ/JIT Quote-Provider Pilot

Status: reviewed-provider pilot; no fixed reward or revenue guarantee.

Prospective providers can apply at /liquidity. The initial application asks about strategy, experience, categories, self-funded capital range, and technical readiness. Do not submit a private key, seed phrase, or callback secret. A public signing wallet and HTTPS callback are requested only after private review.

Approved providers operate a public HTTPS callback that receives bounded quote requests and returns an executable order signed by the provider's registered Solana wallet. Providers keep their wallet secret keys. Norynta stores only the wallet public key and callback URL.

Request authentication

Norynta sends POST requests with:

content-type: application/json
x-norynta-rfq-schema: 2026-07-17
x-norynta-signature: sha256=<hex HMAC-SHA256 of the exact request body>

The provider must compute the HMAC over the raw body using the separately provisioned pilot signing secret and reject a mismatch before parsing or signing anything. Use constant-time comparison and rotate the secret if it may have been exposed.

Request body

{
  "schemaVersion": "2026-07-17",
  "requestId": "uuid",
  "taker": "Solana public key",
  "eventPubkey": "event public key",
  "outcomeIndex": 0,
  "takerSide": "buy",
  "orderType": "fok",
  "targetSizeShares": 10,
  "maxCostCents": 600,
  "referencePriceCents": 50,
  "priceBoundaryCents": 60,
  "expiresAt": 1784300000,
  "guaranteeMicros": 0,
  "compensationMode": "spread_only"
}

For a taker buy, the maker order side is sell and its price must not exceed priceBoundaryCents. For a taker sell, the maker side is buy and its price must not be below the boundary. FOK responses must quote exactly the target size; FAK responses may quote less. The order notional must remain within the taker and provider caps.

Response body

Return HTTP 2xx with content-type: application/json:

{
  "schemaVersion": "2026-07-17",
  "requestId": "same request id",
  "makerOrder": {
    "owner": "registered provider wallet",
    "event": "event public key",
    "outcomeIndex": 0,
    "side": "sell",
    "priceCents": 50,
    "sizeShares": 10,
    "nonce": "monotonically increasing integer string",
    "expiryTs": 1784300000
  },
  "makerSignature": "base58 Solana order signature",
  "makerQuoteSignature": "base58 taker-bound quote signature"
}

makerSignature signs the Norynta CLOB v2 order message. makerQuoteSignature signs the RFQ quote message that binds the same maker order to the request's taker wallet. Both signatures must be produced by the registered provider wallet.

Norynta does not follow redirects. The callback must use a public HTTPS address that does not resolve to a private or reserved network. Slow, oversized, non-JSON, expired, invalid, mismatched, or worse-than-boundary responses are discarded. Among valid responses, a buy uses the lowest price and a sell uses the highest; ties prefer more executable size and then lower response latency. Return HTTP 204 with an empty body when risk or inventory limits require a clean decline. A decline is measured separately from invalid responses and does not need to include a wallet signature.

Pilot economics and controls

  • Fixed guarantee: zero.
  • Provider capital: supplied and risk-managed by the provider.
  • Compensation: trading spread only during the initial pilot.
  • Hidden priority or guaranteed flow: none.
  • Jurisdiction, surveillance, market, size, notional, expiry, and circuit breakers remain authoritative.
  • Norynta may pause or offboard a provider immediately when integrity or operational checks fail.

Complete development conformance before any production activation. Contact the liquidity operations team for the signing-message fixtures, callback secret, approved wallet record, and activation evidence requirements.

Reference implementation and conformance

Norynta provides an executable callback and a local, zero-fund self-test:

npm run rfq-provider:self-test

Approved integration teams can run the callback with npm run rfq-provider:reference and certify a deployed endpoint with npm run rfq-provider:conformance. Private keys and HMAC secrets must be provided through the provider's secret manager and must never be committed, emailed, or included in conformance evidence.

The reference callback is fail-closed: quoting is disabled by default, and an operator must explicitly enable it with at least one allowed development event. It supports a configurable spread, maximum quote size, maximum notional, and short quote lifetime. It also caches authenticated request decisions, rejects a request ID reused with a different body, and reserves aggregate quote exposure across concurrent requests. The single-process file-backed state survives restarts but is an example rather than a substitute for transactional multi-replica coordination, independent fair-value, inventory, fill, P&L, and kill-switch controls before a provider risks production capital.

The current reference runtime also accepts timestamped, HMAC-authenticated lifecycle notifications at POST /fills. It persistently and idempotently tracks partial/full fills, signed inventory, average entry price, cash flow, and realized P&L. It declines new quotes when position, gross exposure, daily loss, fair-value freshness, or manual kill-switch limits fail. Operators must still reconcile this ledger against on-chain balances and settlement records.