The complete description of the afloat program, written for someone who wants to check it rather than trust it.
The coin has a fixed supply of 1,000,000,000 with six decimals. Its mint authority and freeze authority are revoked. It trades in its own pool, and the program reads that pool's token vault to measure displacement. The coin is not a share of anything and the hull owes nobody anything; it is a program that spends a fee stream according to fixed rules.
The coin's creator fee recipient is a program derived address owned by the hull. Fees accumulate there in SOL. The claim instruction moves them into the hull and routes them to a tank in the same transaction. Nobody holds a key to the fee account and the program has no instruction that sends SOL from it anywhere except into a tank.
There are three tanks with target shares of 40% USDC, 35% SOL and 25% ZEC. On each claim the program computes each tank's current share of the hull's value in SOL and routes the whole claim to the tank whose share is furthest below its target. The claim is swapped into that tank's token through the pool route recorded in the state account and deposited. The tank record's cost basis is increased by the SOL amount of the claim. The tank's fills counter increases by one.
At every crank the program values each tank in SOL from the swap pool's reserves for that token, writes the value to the tank record, and sums the three into the hull value. Gain is value divided by cost basis minus one. The trim rule selects the tank with the highest gain whenever a tank has to be spent or released.
The waterline is stored in lamports per one million base units. It is zero until the first claim, when it is set to the pool price. On a buy wave with the price above the waterline, the new waterline is the old waterline plus one eighth of the difference. It is never reduced. While a breach is open it does not change at all.
Draft is (waterline minus price) divided by the waterline, defined when the price is below the waterline. Freeboard is (price minus waterline) divided by the waterline, defined when the price is above it. The trim band is half a percent either side of the waterline. Inside the band no action fires and the mode is trim.
The crank instruction reads the pool's token vault balance, subtracts the last recorded token reserve, divides the absolute difference by the current supply and compares the result with forty basis points. Below the threshold the instruction fails and nothing is written. At or above it, the instruction records a wave: the slot, whether the reserve rose (a sell) or fell (a buy), the displacement, the price, the draft or freeboard, the action taken and its amount. It then updates the last reserve and the last price, recomputes the mode, and advances the register head by hashing the previous head with the new wave record. The crank is callable by anyone and carries no fee.
Buy wave above the waterline and not in trim: raise the waterline, release two percent of the selected tank into a payout round, mode becomes buoyant. Buy wave within the band: nothing, mode trim. Buy wave below the waterline: nothing, mode submerged (or refloated, see breaches). Sell wave below the waterline and not breached: spend from the selected tank, buy the coin, burn it, mode submerged. Sell wave below the waterline while breached: spend as above but never below the floor reserve, mode breached. Sell wave above the waterline: nothing, mode stays buoyant.
Spend equals hull value times draft times one half, capped at one fifth of the selected tank's value. The spend is swapped from the tank's token to SOL and then into the coin through the coin's pool, and the tokens received are burned in the same instruction. The tank's spends counter increases by one, its cost basis is reduced in proportion to the share of the tank spent, and total bought and total burned both increase by the tokens received.
A round is opened by a buy wave above the waterline. The program moves two percent of the selected tank into a round vault and writes a round account with the index, slot, tank and total. The payout bot computes every holder's weight from on chain balances and entry history, builds a merkle tree of (wallet, amount), writes the root and recipient count into the round account, and sends each amount. A round is closed when its vault is empty. Rounds and their roots never leave the chain.
For each wallet the bot keeps the average entry draft, weighted by tokens bought: when a wallet buys under the waterline, the draft at that slot is averaged into its entry draft weighted by the size of the buy; when a wallet buys at or above the waterline, zero is averaged in the same way. The factor is one plus four times the average entry draft, capped at five. Any sell of any size sets the average entry draft to zero and therefore the factor to one. Weight is balance times factor. A wallet's share of a round is its weight divided by the sum of all weights.
When a crank computes a draft of sixty percent or more and no breach is open, it opens one: it freezes the waterline, sets the floor reserve to thirty percent of the current hull value, records the opening slot and mode becomes breached. While breached, payouts do not run and buys are capped so that no tank falls below its share of the floor reserve. When a buy wave brings the price to or above the frozen waterline, the breach is closed: the closing slot, deepest draft, wave count and SOL spent are written to the breach record, the waterline unfreezes, mode becomes refloated, and the next wave of any kind moves the mode to whichever state the price then implies.
The register head is a 32 byte hash. On creation it is the hash of the mint. On every wave it becomes the hash of the previous head concatenated with the 40 byte wave record. Anyone holding the full sequence of wave records can recompute the head and compare it with the one in the state account. The ring buffer holds the last 256 records; older records remain in transaction history.
The program is deployed with a human readable name shown on explorers. Its upgrade authority is a multisig. The state account's parameters (target shares, threshold, step fraction, payout fraction, cap fraction, breach draft, floor fraction) are constants compiled into the program, not fields, so they cannot be changed without an upgrade.
Price and candles come from Birdeye through a server function that holds the key. Supply comes from the mint, read on the server in the same call as the price. The state account, the tank vaults, the pool token vault and the round accounts are read from Solana RPC in the browser and re read when they change. Nothing on this site is computed from anything else.