no mercy.
no retry.
HORDE races redundant transaction paths for one intent on Solana. Each path carries its own swap, its own slippage, its own escape route. All target the same Intent PDA. Sealevel serializes the write-lock. The first path in flips the flag to FULFILLED. The survivor reaches the safe room. Every other path lands too late. Its whole transaction reverts atomically. Its swap rolls back. Its output disappears. Double execution is not prevented. It is impossible.
No retries on single-path gamble. No 42-minute human reaction window after a liquidation. No MEV-exposed public mempool. Only slot-level redundancy and a winner-takes-all flag.
write-lock
is the blade.
Sealevel schedules conflicting writes serially. We weaponize that. All paths collide on one PDA. Exactly one survives. The rest eat the revert.
- phase · 01survivor
Pick your routes
N independent escape paths: Jupiter quote, Raydium pool, Meteora DLMM. Each path ships as [swap_ix, fulfill_path_ix] in one tx.
- phase · 02sprint
Swarm broadcast
All paths submitted together via Jito private bundle. Public mempool optional but MEV-exposed times N.
- phase · 03chokepoint
Race the write-lock
Validators see all paths target the same Intent PDA. Sealevel serializes. First tx to land reads status = Pending.
- phase · 04safe room
Survivor flips flag
Winning fulfill_path verifies output delta ≥ expected_min, sets status = Fulfilled, stamps winning_slot.
- phase · 05dead on arrival
Horde eats losers
Every later path hits status != Pending → IntentNotPending → whole tx reverts → its swap rolls back atomically.
- phase · 06extraction
Reclaim rent
After terminal state, creator calls close_intent. Rent returns. Registry counter holds. Specimen archived.
know the horde.
they don't stop.
Send one intent.
Release the swarm.
One survives.
The rest die
on arrival.
paper trail.
programs/horde/src/lib.rs, in /api/health and in /.well-known/horde.json. Cross-verify bots find the same string on all four surfaces.skeleton.
weapons rack
- ▸initialize_registry — one-time global init
- ▸create_intent — PDA per (creator, intent_id)
- ▸fulfill_path — delta check + winner flip
- ▸expire_intent — permissionless past deadline
- ▸cancel_intent — creator only, pending only
- ▸close_intent — rent reclaim, terminal only
cold storage
- ▸IntentRegistry (global): admin, counters, version
- ▸Intent (per-intent): status, paths_attempted, winning_path_index
- ▸pre_balance snapshot on create
- ▸output_mint + output_account tracked
- ▸expiry window [25, 216000] slots
- ▸max_paths capped at 5
bodybag tags
- ▸IntentNotPending — losers land here
- ▸IntentExpired — past deadline
- ▸OutputBelowMinimum — delta too low
- ▸OutputMintMismatch / OutputAccountMismatch
- ▸MaxPathsExceeded / InvalidMaxPaths
- ▸Unauthorized — non-creator action
- ▸InvalidExpirySlot — bad window
- ▸BalanceOverflow / MathOverflow
raw combat log.
$ anchor test --manifest-path programs/horde/Cargo.toml
Compiling horde v0.1.0
Finished release [optimized] target(s) in 7m 41s
running 13 tests
test test_01_initialize_registry ............ ok
test test_02_create_intent .................. ok
test test_03_fulfill_path_winner_takes_all .. ok // safe room reached
test test_04_fulfill_below_minimum_fails .... ok
test test_05_cancel_intent .................. ok
test test_06_expire_intent .................. ok
test test_07_close_intent_reclaims_rent ..... ok
test test_08_cannot_close_pending_intent .... ok
test test_09_wrong_owner_cannot_cancel ...... ok
test test_10_invalid_max_paths .............. ok
test test_11_invalid_expiry ................. ok
test test_12_cannot_fulfill_expired ......... ok
test test_13_pre_balance_tracking ........... ok
test result: ok. 13 passed; 0 failed; finished in 0.17s
$ solana program deploy target/deploy/horde.so
Program Id: BhGJRju8uDCK3wiVT7kkLJZcTuV1AJDBZpxrDxcF9Evm
Signature: ZBc2FdEtJjWcp72YMTAgEWbzVGvZe3p9kZgsx2pphQkrXTdjc4x8pzqVPVpe5onV2PkvXSPs3eMKvWH6uWfEoek
$ ts-node sdk/devnet_integration_test.ts
[5] fulfill_path(0) tx ok -> status=Fulfilled winning_path=0 output=1000
[7] fulfill_path(1) rejected: IntentNotPending (6000)
state unchanged, winning_path still 0
[9] close_intent rent reclaimed: 0.00203428 SOL
>> dedup proven live on solana-devnet.same string.
four sources.
Listing bots and trading aggregators verify a project by cross-checking its program id across independent surfaces. HORDE pins the identical base58 string on all four.
what isn't
here yet.
professional audit
No third-party audit. The devnet program is verified by 13 unit tests and a live e2e devnet integration. Unaudited code does not custody mainnet value.
jito bundle integration
Spec requires private mempool submission for MEV protection at N-path broadcast. Current SDK uses plain RPC. Bundle path planned before mainnet.
dex cpi path
fulfill_path verifies output balance delta. Compound tx [swap_ix, fulfill_path_ix] with Jupiter / Raydium / Meteora not yet shipped as reference.
upgrade authority multisig
Program upgrade authority is a single keypair. Transition to Squads-based multisig scheduled before mainnet.
No roadmap. Dates lie. Surfaces ship or they don't. This page reflects the state of the outbreak as of publication.