A covered call, between two wallets. The writer deposits the stock and sets the terms. The holder chooses how much to exercise before expiry. Stock and strike change hands together.
The stock goes in first. The premium goes straight to the writer. The holder decides when to pay the strike, before expiry.
No margin, no price trigger, no priority token. One holder, with the choice to exercise in full or in parts.
The entire stock lot is deposited before the call can be bought.
ONE is live on Solana mainnet. The calls on the sheet are open to buy; connect a wallet to write your own.
Read the specification →Three plates (10) and one pin (18). The stock (12) sits on one side of the pin, the strike (16) on the other. The gate (24) and its lock (28) guard the holder's end. Nothing in it reads a price.
The writer (26) moves the lot into a vault the call owns, then names, once, the strike K for the whole lot, the premium P and the expiry. What the call promises is already inside it.
Every new call, on any stock, can be bought only by a wallet that locks ONE (32) in the lock (28). When the slots run out the gate (24) opens to anyone, and the ONE comes back whole.
P moves from the buyer to the writer (26) in the same transaction, and the buyer becomes the holder (30). A call has one holder.
At any hour before expiry the holder pays K. The pin (18) shears: the lot moves to the holder and the USDC to the writer, in one transaction. It cannot shear again.
No price feed, no oracle, no margin, no keeper. Two wallets, and the stock between them.
Gate open. The next call written, on any stock, shuts it for 151 slots.
No call with this number has been written on Solana mainnet. Open a call from Calls or Yours: every call name links to its own detail.
All calls[0001]This document describes one: a call option on a tokenized stock in which the stock itself is placed inside the call when the call is written, and is delivered to whoever holds the call when they pay the strike. Any tokenized stock that passes the check in [0013] can be written.
[0002]A listed option has a clearinghouse between its two sides. The clearinghouse guarantees that the writer performs, takes margin to make sure of it, and works while the market is open. A cash-settled option also needs a price to settle against.
[0003]On Solana the stock now sits in the same kind of wallet as the money: xStocks are Token-2022 tokens. A call can hold the very stock it promises, so the guarantee is the stock in the vault. Prior art, as read on 14 October 2026:
| Prior art | What exists | What this device does |
|---|---|---|
| xOptions | The same idea on devnet. Trades use a mock mint; the code follows the classic token program. | Uses the Token-2022 stock itself. |
| Manifest / DUAL | Live options on mainnet. The exercise path fixes the classic token program. | Token-2022 on the stock side, classic on the USDC side. |
| Acta | Collateralised options with RFQ, premium and physical settlement. The markets read were WSOL/USDC. | No maker registration or keeper on the path. |
| Tender / POC | Physical calls with a Token-2022 allowlist that excludes ScaledUiAmount and non-USDC freeze authority. | Accepts stock mints that carry both, as every xStock read in [0025] does. |
| PowerTrade | xStock options settled in USDC, with margin. | Delivers the stock. No margin. |
[0004]None of this is claimed as invention. The difference is narrow and practical: a real xStock, held as collateral and delivered on exercise, between two wallets dealing directly.
[0005]A writer picks a stock, deposits an exact raw amount of it, and names, once, a total strike in USDC, a premium and an expiry time. A buyer pays the premium and holds the call. The holder may pay the strike once, at any slot before expiry, and the stock and the USDC change places in one transaction.
[0006]Nothing in the device reads a price, and nothing is left to clear. It enforces the terms two wallets agreed to.
[0007]For the first 151 slots of each new call, whatever the stock, only a wallet that locks ONE against it may buy it. The ONE is returned whole.
[0008]FIG. 1 is a section through one call: the stock (12) held behind the pin (18) in the housing (10), and the strike (16) entering from the holder's side. FIG. 1A shows the two after the pin has sheared. On the front page it replays each release, whatever the stock.
[0009]FIGS. 2A onward are the calls on the sheet, each drawn when it is written, each with its own gate (24) and, once bought, the holder's mark (30). Each has a detail of its own.
[0010]FIGS. 3A to 3C are the holder's end of a call, enlarged: the gate (24) shut, the gate shut with ONE (32) placed in the lock (28) at its hinge, and the gate open with the ONE given back. On the front page they sit under FIG. 1.
[0011]FIG. 4 is a call being written, with the strike (16) drawn in phantom lines at the place it will take.
[0012]Write. The writer (26) picks a stock mint and moves a lot, a whole number of raw units, into a vault owned by the call. The strike is a total in USDC for the whole lot, not a price per share. Lot and strike are fixed at writing. The screen shows shares and the per-share strike by applying the mint's current multiplier, so a dividend or split that moves the multiplier travels with the lot.
[0013]The check. At writing, the program reads the stock mint. A classic token mint passes; a Token-2022 mint passes only if it sets no transfer hook program, configures no transfer fee, and does not start new accounts frozen. No list is kept by hand: a stock token that passes can be written.
[0014]The premium. The writer names the premium P. On Write it starts at a fair value worked out in this page, F = n·(S·N(d1) − k·N(d2)), where d1 = (ln(S/k) + σ²T/2) / σ√T and d2 = d1 − σ√T: S is the Jupiter price of one share now, n the lot in shares, k = K/n the strike per share, T the years to expiry, σ the volatility of the last 30 daily closes annualised by √252, with no rate and no dividend. A P the writer types replaces F, and a link brings F back. The program never sees F; it keeps the P that is signed.
[0015]Buy. The buyer pays the premium. It goes to the writer in the same transaction, and the buyer becomes the holder (30). A call has one holder.
[0016]The gate. For the first 151 slots after writing, the life of a recent blockhash, only a wallet that locks ONE (32) against the call may buy it. The ONE goes into the lock (28) at the gate (24); once those slots end, the wallet that locked it takes it back whole. Each call bought this way takes a lock of its own. When the gate opens, anyone may buy. The gate narrows the race for a new call to wallets that hold ONE; it does not end it. Inside the gate, the first lock to land wins.
[0017]Call. The holder pays the total strike once, at any moment before expiry. The USDC moves to the writer and the lot moves to the holder in the same transaction. The pin (18) is a flag that can be set once; a second call fails.
[0018]Reclaim. Once the chain clock reaches the expiry time, the writer of a call that was not exercised takes the lot back.
[0019]Cancel. Before anyone buys, the writer may cancel and take the lot back. A bought call cannot be canceled.
[0020]What it refuses. No price feed, no oracle, no cash settlement, no partial exercise, no second exercise, no margin, no keeper, and no path by which an operator withdraws the stock behind a live call.
[0021]Example 1: writing. On Write, the writer picks the stock and types the lot in shares; the raw amount it fixes appears beneath. The strike K goes in as a total for the lot, and its per-share value and its distance from the price now appear beneath. The expiry is set in UTC, after the gate, and P starts at its fair value [0014]. Write the call moves the lot into the vault, and the call joins Calls with its gate counting. Recorded on-chain, 2026-10-17: call 0000 written with 0.01 99H8…cRk9, raw 1 000 000, K 2.00 and P 0.10 USDC, expiry 2026-10-17 00:14 UTC (tx 3vFz…62gf).
[0022]Example 2: buying inside the gate. The buyer holds 1 000 000 ONE and P in USDC. Under Priority, FIG. 3A lists the calls still inside their gate. Lock ONE & buy pays the premium to the writer and makes the call the buyer's, and the ONE waits in its lock (FIG. 3B). When the gate ends, Take back, under Priority or on Yours, returns it whole (FIG. 3C). Recorded on-chain, 2026-10-17: call 0003 bought inside its gate with 0.005 ONE locked (tx 5SGJ…W3b1), and the ONE taken back whole at slot 511 887 013 (tx 2EZC…YBBY).
[0023]Example 3: buying after the gate, and calling. Once the gate is open, the call's button on Calls is Buy, with its premium. Until expiry, the holder finds the call under Held by you on Yours, or on its own page; Call once, with its strike, pays K and the stock lands in the holder's wallet in the same transaction. Recorded on-chain, 2026-10-17: call 0000 bought for P 0.10 USDC, paid to its writer in the same transaction (tx 4y8C…TxDN). Recorded on-chain, 2026-10-17: call 0000 released, 2.00 USDC to its writer and 0.01 99H8…cRk9 (raw 1 000 000) to its holder (tx 2dYy…U35E).
[0024]Example 4: the writer takes the lot back. Under Written by you on Yours, Cancel · take it back returns the lot while no one has bought, and Reclaim the stock returns it once the expiry passes uncalled. Recorded on-chain, 2026-10-17: call 0001 canceled before sale, 0.01 99H8…cRk9 (raw 1 000 000) back to its writer (tx 2DgJ…zPSY). Recorded on-chain, 2026-10-17: call 0002 reclaimed after expiry, 0.01 99H8…cRk9 (raw 1 000 000) back to its writer (tx 5CJ5…JKim).
[0025]Twelve xStock mints were read on mainnet at slot 457 358 990. All twelve are Token-2022 with decimals 8, a freeze authority, a permanent delegate, a pausable configuration (none paused), ScaledUiAmount, a transfer hook field with no program, no transfer fee, and new accounts that start initialized. They differ only in multiplier.
| Stock | Mint | Multiplier |
|---|---|---|
| NVDAx | Xsc9qvGR1efVDFGLrVsmkzv3qi45LTBjeUKSPmx9qEh | 1.001701196801074 |
| TSLAx | XsDoVfqeBukxuZHWhdvWHBhgEHjGNst4MLodqsJHzoB | 1 |
| AAPLx | XsbEhLAtcf6HdfpFZ5xEMdqW8nfAvcsP5bdudRLJzJp | 1.0032690125398187 |
| SPYx | XsoCS1TfEyfFhfvj8EtZ528L3CaKBDBRqRapnBbDF2W | 1.005714560286254 |
| GOOGLx | XsCPL9dNWBMvFtTmwcCA5v3xWPSMEBCszbQdiLLq6aN | 1.0023772500603487 |
| METAx | Xsa62P5mvPszXL1krVUnU5ar38bBSVcWAB6fmPCo5Zu | 1.0028515433272898 |
| MSTRx | XsP7xzNPvEHS1m6qfanPUGjNmdnmsLKEoNAnHjdxxyZ | 1 |
| COINx | Xs7ZdzSHLU9ftNJsii5fCeJhoRWSC32SQGzGQtePxNu | 1 |
| AMZNx | Xs3eBt7uRfJX8QUs4suhyU8p2M6DoUDrJyWBa8LLZsg | 1 |
| QQQx | Xs8S1uUs1zvS2p7iwtsG3b6fkhpvmwz4GYU3gWAmWHZ | 1.0034560758968376 |
| HOODx | XsvNBAYkrDRNhA7wPHQfX3ZUXZyZLdnCQDfHZ56bzpg | 1 |
| CRCLx | XsueG8BtpquVJX9LVLLEGuViXUungE6WmK5YZ3p3bd1 | 1 |
[0026]Other xStocks were not read for this document. The check in [0013] decides at writing.
[0027]Each xStock carries a freeze authority, a pause and a permanent delegate, held by its issuer, and this device cannot remove them. A frozen vault or a paused mint stops a call from settling. A permanent delegate can move stock out of a vault; a call whose vault then holds less than its lot cannot be bought or called, and its writer takes back what is left.
[0028]one is one program on Solana mainnet, at GRzKU9i3Cs7A5Euf9gGZjbRnpypw7DzaU3hWRfUgpYTa. Its source is published at github.com/call-once/once-program, and the program at that address is built from it: the hash of the deployed program and the hash of a build of that source are the same, and anyone can compute both. What the claims below say, that source does.
[0029]This page reads the program's accounts every few seconds and draws them as they stand. Slots are the chain's, and times are the chain clock's, in UTC.
[0030]This site borrows the form of a patent document: numbered parts, INID codes, numbered paragraphs, claims. Nothing here is a patent, a patent application, or a claim of priority.
What is claimed is: