The Percolator engine
Percopy ports two independent mechanisms from Anatoly Yakovenko's Percolator paper to pooled copy-trading: a fair-exit haircut H and a warmup window for fresh profit. A third — A·K loss socialization — replaces forced liquidations entirely.
H = min(1, equity / liabilities) payout = principal + H · profit_share
When equity tracks liabilities (the normal case), H = 1 and you get 100% of your share. When the pool dips under stress, H falls below 1 — and every withdrawer, including the trader, takes the same proportional haircut simultaneously.
This kills the first-out-wins dynamic that breaks every queue-based vault under stress.
if now - lastProfitAt < warmupSeconds: profit stays in warmup_profit bucket else: matured_profit += warmup_profit warmup_profit = 0
An attacker who pumps a thinly-traded SPL only to dump it back to depositors needs the round-trip to settle and mature. Warmup makes the dump phase as economically loud as the pump phase.
loss = realized_negative_pnl fromInsurance = min(insurance, loss) residual = loss - fromInsurance equity -= loss # liabilities unchanged → next H drops
Drift's auto-deleveraging queue picks victims by metadata. Percolator's A·K math spreads the residual across every remaining subscriber's liability share, then resolves on next H computation — no targeted liquidations, no forced closes.
# things Percopy refuses to ship: - governance veto on withdrawals - emergency pause that locks principal - per-pool admin keys
The only off-ramp from this design is an upgrade authority on the program. Percopy revokes the upgrade key 90 days after mainnet deployment per the launch covenant — there is no protocol-level emergency switch.