Priced by math. Bounded by design.
Fair pricing, bounded risk, reliable settlement — properties, not claims.
LMSR Automated Market Making
Price is probability. The market maker's worst-case loss is a known constant.
- Price is a probabilitytwo sides sum just over 1 — that gap is the spread
- Liquidity parameter bsets market depth
- Worst-case lossknown before bet one
The instantaneous price is the partial derivative of the cost function — a clean probability. The two tradeable sides are quoted around it and sum slightly above 1; that difference is the engine margin, and any merchant markup is added on top of it.
Real-Time Exposure Management
Worst-case exposure, recomputed on every bet, kept inside your limit.
- Live monitoringno batch lag
- Limits & loss capsper market
- Automatic handlingno trading desk
Deterministic Settlement
Event resolves, settlement runs itself — every payout traces to its bet.
- Adjudicationrepeatable pipeline
- Idempotent payoutsafe to retry
- Reconcilable cyclesbet ↔ payout
Availability You Can Contract On
A contracted callback window, idempotency on every call, and bounded retries — when they run out we return an explicit uncertain-result signal rather than a silent failure.
- 0s
Default callback window
- 0%
Idempotency
- 4 then 20
Retry ceiling
SLA figures are the target service commitment written into integration agreements, not measured availability. The callback window is set per merchant and defaults to 3 seconds. Retries are bounded: 3 by default (4 attempts total), with exponential backoff, and only for network errors or 5xx — a 402 insufficient-balance reply is never retried. If every attempt fails the call resolves as uncertain execution (HTTP 502), which your side must reconcile; it is not a confirmed failure. What happens next depends on the direction of the money. Recovering a debit is bounded twice over: after the callback's 4 attempts, a reconciliation worker retries with backoff up to 20 more times and then dead-letters the entry for a human. A credit owed to the player is never dead-lettered automatically — it keeps retrying under a capped backoff and raises a critical alert until it lands or a human steps in. Build a reconciliation path on your side for both terminal states; they are reachable.
Architectural, Not Decorative
Run your own wallet and funds never enter our systems — the operator only issues instructions, and it refuses them outright rather than falling back to holding money. Use the hosted wallet instead and balances do sit with us; that is the trade you make for skipping the integration.
- 0-CUSTODYZero-custody boundary (self-hosted wallet)
- LEAST-PRIVLeast-privilege access
- ENCRYPTEDEncrypted transport
- AUDIT-LOGTraceable audit trail