Montions

Outcome-first binary options on Monad, with a fully onchain central limit order book.

"I want to make $1,000 if MON ends above $1.05 by Friday."

You say what you want to happen. The app finds the market, quotes the price, and you trade against a real onchain order book. Everything that touches money is a contract: the orderbook and matching, the collateral, price oracle, fair-value model, a market-making vault, and the read views the UI uses. There is no backend, no indexer, no off-chain matcher and no signed price feed. The frontend is a static page that reads the chain over RPC.

Built for the Monad Metropolis hackathon — Finance & Trading track.

Why

Options are the right product sold through the wrong interface on the wrong venue. People already trade bounded-loss, asymmetric bets (prediction markets) and unbounded ones (perps); an option is what they want, but strike chains and greeks were built for market makers. The binary is the atom: price is the probability, max loss is the premium. Matching belongs onchain and Monad makes a CLOB in a contract practical: 100% collateral, so no margin engine, no liquidation, no clearing house. Settlement comes first: Pyth's first print at expiry, nobody picks the timestamp. Liquidity, not UX, is the honest bottleneck, so markets are quoted by a model-priced maker and stay open for weeks to months. Full argument and counter-arguments: docs/THESIS.md.

How it works

• A market is a yes/no question settled by a resolver contract, e.g. "MON ≥ $1.05 at 12:00 UTC?".
• One contract pays $1 USDC if its outcome is true and $0 otherwise. YES at 14¢ pays $1 → you win 86¢ per contract if right. NO costs 100¢ − YES price.
• Prices are integer ticks (1–99¢) in a price-time-priority CLOB; matching, escrow and settlement are atomic in MontionsBook. Every contract is 100% collateralised: YES + NO = 1 USDC locked.
• Settlement is deterministic and permissionless:
  • Mainnet: Pyth's signed first price at or after expiry (parsePriceFeedUpdatesUnique) — nobody can pick a favourable timestamp. If no valid price arrives, the market voids 50/50.
  • Testnet/demo: a 60-second TWAP from onchain demo pools (clearly labelled MOCK; manipulable at low liquidity).
• A MakerVault (ERC-4626-style) posts quotes around a fair value computed in Solidity (digital-option N(d2) with realised/configured volatility) so books are never empty. Its risk is capped and stated plainly.

Architecture (all onchain)

Full reference — contracts, units, trade lifecycle, settlement, safety controls, testnet addresses and how to verify them: docs/ONCHAIN.md.

Contract	Role
MontionsBook	Series registry, CLOB (tick bitmaps, FIFO queues), escrow, split/merge, resolution, ERC-1155 YES/NO tokens, views for the UI
PythSettlementResolver / PythOracle	Mainnet settlement and price adapter over Pyth
TwapThresholdResolver / OracleHub / SpotPool	Demo/testnet TWAP oracle over onchain pools
TimelockOpResolver	Event markets, e.g. "did this governance operation execute?"
Quoter / PricingLib	Fair value, book-walking quotes, one-call snapshots for the UI
MakerVault	Onchain market maker with exposure caps

Safety controls: owner can pause new risk only (exits always work), set launch caps, and hand ownership to a Safe in two steps. The owner can never move user funds or change an outcome. See docs/THREAT_MODEL.md.

Quick start (local)

scripts/dev-up.sh                 # anvil + contracts + 108 seeded markets + vault liquidity + price bot  (~3 min)
cd app && pnpm install && pnpm dev   # http://127.0.0.1:5175 — built-in dev wallet, faucet included
scripts/dev-down.sh

Tests: forge test (245 tests incl. fuzz, invariants, and differential replay against an independent Python model) · pnpm --dir sdk test · pnpm --dir bots test.

Deploy

• Testnet (demo oracle): fund the throwaway deployer, then scripts/testnet-deploy.sh — see docs/DEPLOY.md.
• Mainnet: docs/MAINNET.md and docs/LAUNCH_CHECKLIST.md. Not launched.

Honest status

• Mainnet is NOT live and is not ready for real funds. Open gates: a professional audit, legal review, a Safe-owned deployment, a testnet soak, and live Pyth settlement verification (Pyth's Hermes now requires an API key).
• What has been done: two independent AI security reviews, a 7-property invariant suite, differential testing against a second implementation, and a rehearsal on a local fork of Monad mainnet using real USDC and the real Pyth contract (deploy guards, handover, trading, 50/50 void path). No transaction has been sent to a live mainnet.
• USDC is issuer-controlled: Circle can freeze an address, including the Book.
• Binary options may be restricted in your jurisdiction. Nothing here is financial or legal advice.

Repo map

src/ contracts · test/ Foundry tests (test/diff = differential replay) · tools/refmodel independent Python model · script/ deploy & seed · scripts/ ops (dev env, fork rehearsal, verifier) · bots/ keeper + demo price bot · sdk/ TypeScript SDK · app/ frontend · docs/ spec, threat model, runbooks.

License: MIT.