Rails documentation

• Quick start: from a connected wallet to your first settled track.
• Opening a position: gauge, grade, run and the math behind your multiplier.
• Predict: back or fade a track someone else laid.
• Parameters and limits: every knob, fee and cap in one table.
• Vault architecture: the counterparty to every position.
• Public ledger: how to re-verify every event yourself.

The principles behind the platform. Where a principle is a rule, the code enforces it and the ledger lets you check it.

The hard parts live in one core: pricing, the vault, settlement, identity, the ledger and the token. A new product is a new front end on that core. An order-book venue has to bootstrap liquidity market by market. Rails solves it once, and every product feeds the same vault. See The engine for how the pieces fit.

• The terminal: live charts for 16 markets and a ticket that prices both sides before you commit.
• Tracks: lay a track with gauge, grade and run, and back it to Hold or Derail.
• Predict: back or fade any live track at odds priced from where the price sits now.
• Dashboard: balance, open positions, history, equity curve and platform stats.
• Leaderboard: players ranked by net score, filtered by period, market and product.
• Public ledger: every event chained by hash, with an endpoint that re-verifies the whole chain.
• Faucet: 10,000 tRAIL every 6 hours for any wallet.

• $RAIL launch on Robinhood Chain.
• Contracts on chain: TrackEngine, RailsVault, ModelRegistry and TestRail deploy to Robinhood Chain testnet, then mainnet.
• Audits: an independent review of the contract suite before mainnet.
• Vault seed: 15% of the $RAIL supply seeds the settlement vault at mainnet, under a timelock.
• Staking: stake $RAIL to back the vault and earn a share of fees.

• More markets across crypto and tokenized stocks.
• Multi-asset tracks that settle on more than one price.
• Longer runs past the 24-hour limit.
• Agent SDK: typed clients and examples for programs that trade.
• New products on the same engine, vault and ledger.

Every track starts at your entry price. The center line leans from there at your grade, and each rail sits one gauge away from it. Rails measures gauge and grade in range, the asset's typical one-hour move, so the same shape carries the same odds on BTC and on TSLA.

center(t) = entry + grade × range × hours since bind
upper rail(t) = center(t) + gauge × range
lower rail(t) = center(t) - gauge × range

Range freezes at bind. From then on the rails follow the grade you chose, and no one can move them.

Tighter, steeper and longer all make Hold harder, so Hold pays more and Derail pays less. On a flat track, gauge and run trade off: a ±1 gauge over one hour, a ±0.5 gauge over 15 minutes and a ±2 gauge over 4 hours all carry the same P of 0.409.

The keeper reads your shape and the asset's range and computes P, the probability that the price stays inside the rails for the whole run. Each side pays the inverse of its own chance to win, less the published spread δ:

Hold: M = (1 - δ) / P
Derail: M = (1 - δ) / (1 - P)
δ = 3%, ceiling ×50, floor ×1.05

A side priced above ×50 pays ×50. The keeper does not offer a side priced below ×1.05. As a rough anchor, a Hold with a 25% chance pays ×3.88.

Sample quotes from the live model. P depends on the shape alone, so these numbers match on every market. Leaning down prices the same as leaning up by the same grade.

The model behind P is described in The engine.

Opening takes one step. The keeper checks your shape against the limits, reads the live mid price and the asset's range, prices your side, confirms the vault can reserve the payout and binds your entry. The entry price and your multiplier lock at that moment and stay fixed for the life of the position.

Prices move while you decide. Send a minimum multiplier with your open and the keeper refuses the open if the fresh quote lands below it, so you never accept worse odds than the ones you saw.

The open fee is the greater of 1% of your deposit and 0.5 tRAIL. The keeper takes it from the deposit at open, win or lose. The rest is your stake, the amount every payout formula multiplies. The vault then reserves stake × (M - 1), so your full payout is covered before your track starts.

deposit = 1,000 tRAIL
open fee = max(1% × 1,000, 0.5) = 10
stake = 1,000 - 10 = 990
at ×2.00: gross payout = 1,980, vault reserve = 990

Then you choose how to leave. See Closing a position.

When the final one-minute bar of the run closes with no touch, the track holds. Hold positions collect stake × M and Derail positions settle at zero. The keeper resolves a held track five seconds after that final bar closes.

You can close an open position any time before its run ends. The keeper values it at your side's current chance to win, from the live price, the time left and the range frozen at bind, then applies the 5% early-close penalty:

value = stake × M × P_win(now) × (1 - 0.05)
payout = value - 10% × max(0, value - stake)

For Hold, P_win stays high while the price sits near the center line and falls as it drifts toward a rail. For Derail it moves the other way. A confirmed close is final. If the price sits on a rail when you ask, the keeper refuses the close because the track is derailing. Once the run is over, the track settles on its own within a minute.

A touch resolves the whole track at once. Every Derail position on it collects stake × M, and every Hold position settles at zero. One verdict settles the creator's position and every Predict position on the track, whichever side each took.

The keeper proves the touch with the one-minute bar that crossed the rail and stores that bar in the ledger. You can fetch the same public bar and check it. The exact judging rules are in Price feed.

Range is the asset's one-sigma move over one hour, in price units. It makes a ±2 gauge the same difficulty on BTC as on TSLA. The keeper blends two estimates of it: 60% weight on the last 6 hours of one-minute bars and 40% on the last 3 days of 15-minute bars.

Each estimate caps outlier returns at six times the median move and weights recent bars more, with half-lives of 90 minutes and 24 hours. The blend follows the current regime without jumping on one spiky minute. A floor of 0.005% per √minute keeps quiet off-hours markets from pricing near-zero volatility, and each market's range refreshes once a minute at most.

Range sizes your track at open and then freezes into your rails. The price against those rails decides every outcome.

Time spent inside the rails pushes P up, and a price drifting toward a rail pulls it down. One flat track with a ±1.5 gauge and a 60-minute run, priced at five moments:

The creator's multiplier stays where it locked. Yours locks when the keeper accepts your position. The ledger records the terms it used (the price's distance to the center line and the minutes left), so you can recompute your multiplier with /api/model. See The engine.

Send a minimum multiplier with your request and the keeper refuses the position if the odds moved below it. The keeper also refuses a prediction while the price sits on a rail, because the track is derailing.

One verdict settles every position on a track. If the price touches a rail, Derail wins and Hold settles at zero. If the track holds to the end, Hold wins. The creator's own position settles on the same verdict at the same moment.

When a Predict position from another player pays out above its stake, through a win or a profitable early close, the track's creator receives 15% of that position's profit fee. The royalty comes out of the fee, so the predictor pays nothing extra. A track that draws Predict volume pays its creator on top of their own position.

predictor's profit = 1,000 tRAIL
profit fee = 10% × 1,000 = 100
creator royalty = 15% × 100 = 15
vault revenue = 100 - 15 = 85

You can close a Predict position before the run ends at its current win chance less the 5% penalty, the same way a creator closes. See Closing a position.

The chart streams live prices for the market you pick. Your track appears on it as you shape it: the center line from the live price, a rail on each side and the end of the run. Open tracks play out on the same chart, so you watch the price move against your rails in real time.

All 16 markets sit in one list, grouped into crypto and tokenized stocks, each with its live price and 24-hour change. A stock outside its regular US session carries a flag. See Markets.

The ticket holds the three controls (gauge, grade and run), the two sides with their live multipliers, your deposit and a summary of the fee, stake and full payout. Both multipliers reprice as you change the shape or the price moves. You fund positions from your tRAIL balance; the quick start shows how to claim it.

Your open positions stay on the chart and in a list, where you can close any of them. Settled positions move to the History tab and to your public profile.

The account view shows your tRAIL balance, the faucet timer, your open positions and your settled history. Each settled position lists its payout, fees and the price that settled it, and an equity curve plots your running profit and loss.

Platform stats cover the whole venue: players, positions, open positions, average multiplier, 24-hour volume, tracks held and derailed, the most popular markets and the biggest wins. The vault panel shows capital against the 150,000,000 tRAIL seed, escrow, reserved payouts, revenue, royalties paid and seven days of hourly capital and volume.

The leaderboard ranks players by net score: settled payouts minus deposits, with fees counted, plus royalties earned as a creator. Filter by period (24 hours, 7 days, 30 days or all time), by market and by product (Tracks or Predict). When two scores tie, the player with more volume ranks higher.

You sign in with an EVM wallet on Robinhood Chain, through Privy or with a direct wallet signature. The sign-in message is free, sends no transaction and expires after 10 minutes. It carries a one-time nonce, so no one can replay a captured signature. Smart-contract wallets work too: Rails checks their signatures on Robinhood Chain.

Your session lasts 7 days in an HttpOnly cookie. Sign out any time to end it.

Rails has no email login, no password and no social sign-in. The identity data it keeps is your address, your optional display name, the wallet that referred you (if any) and your app preferences.

You can set an optional display name of 3 to 20 letters, digits, dots or underscores. It replaces your short address on the leaderboard, your profile and track pages. Each name belongs to one wallet at a time.

Every wallet has a public profile at /profile/<address>: rank, net score, open positions, settled history, an equity curve and top markets. Anyone can open yours, and you can open anyone's from the leaderboard or a track page. See Dashboard.

Share a track with its link, /track/<id>. Anyone who opens it sees the track live on the chart and can back or fade it after connecting a wallet. Share your record with your profile link, /profile/<address>.

A referral link carries your wallet address: any Rails link ending in ?ref=<your address>, which Copy invite link in the account menu builds for you. When a new wallet signs in through it for the first time, Rails records you as its referrer. Attribution happens once, at that first sign-in, and no wallet can refer itself.

The design ties usage to the token in a loop. The staking part of it arrives with mainnet.

more volume → more fee revenue → more rewards for stakers
more stake → deeper vault → larger payouts → more volume

Published fees fund the loop, with no inflationary emissions behind it. The vault's average edge is the 3% spread plus fees, as long as the model's probabilities match how prices move. The model is public, so you can judge that yourself. See Vault architecture and Utility.

$RAIL launches on Robinhood Chain. Tracks is the first product and Predict the second, and future products plug into the same vault, ledger and token. The draft supply and allocation are on Tokenomics.

When you open, the vault moves your stake into escrow and reserves stake × (M - 1) from its capital, the most your position can win beyond the stake. It accepts a new position while total reserved payouts stay within 60% of vault capital. If a new reserve would cross that line, the keeper refuses the open and asks you to size down or widen the rails.

reserve = stake × (M - 1)
open accepted if reserved + reserve ≤ 60% × capital

Every settlement balances to the micro-tRAIL. Capital pays gross - stake on a win and gains the stake on a loss, escrow releases the stake, and the fees land in revenue and royalties:

deposit + fromCapital = player + revenue + royalty
fromCapital = gross - stake
revenue = open fee + profit fee - royalty

deposit 1,000, open fee 10, stake 990, M = ×2.00
gross 1,980, profit 990, profit fee 99, royalty 14.85
player 1,881, revenue 94.15, fromCapital 990
1,000 + 990 = 1,881 + 94.15 + 14.85 = 1,990

The keeper writes these numbers into the public ledger for every settlement, so you can check the identity on any position.

The vault bears losses. Over a short window players can win more than they stake. The vault stays solvent through rules anyone can read: odds are the inverse of probability less the spread, every payout sits in reserve before its track starts, the ×50 ceiling caps any single position, and the 60% utilization cap bounds what the vault can owe at once.

The testnet vault started with 150,000,000 tRAIL. Its live capital, escrow, reserves, revenue and royalties are public at /api/stats. The setup works like the liquidity pool behind a perp venue: a counterparty whose size and limits follow public rules.

On the testnet, the vault books open fees and profit fees as revenue, and the keeper credits royalties to creators' balances at settlement.

The model treats the price over a run as a random walk with no trend of its own, with volatility set by range. Your track's center line leans at your grade, so the gap between the price and the center line drifts at minus the grade. The track holds while that gap stays within one gauge of the center line on either side. P is the chance a drifting random walk stays between two barriers for the whole run: a double-barrier survival probability with drift.

σ = range / √60 (volatility per √minute)
h = gauge × range (distance to each rail)
μ = -grade × range / 60 (drift of the gap, per minute)
T = run in minutes
P = Pr( |gap(t)| < h for all t ≤ T )

The keeper solves this with an eigenfunction series when the rails sit close relative to the move expected over the run, and with closed-form single-barrier formulas when they sit far apart. The switch comes where the track's full width reaches 6 × σ√T. The keeper then averages the result over a 25% lognormal uncertainty in volatility with 7-point Gauss-Hermite quadrature, so the odds account for the chance that range is off.

The pricing code is pure math shared by the server and the browser, so the ticket's preview and the keeper's quote run the same function. /api/model serves every parameter with a SHA-256 fingerprint, and each open records the model id rails-dbm-1 in the ledger.

An open is one database transaction: the keeper validates the shape, reads the live mid and range, prices your side, checks that the vault can reserve the payout, debits your deposit and writes the open to the ledger.

From there the keeper judges the track against public one-minute bars. It runs on the API's reads of tracks, positions, the feed, stats, the leaderboard and profiles, on every close and prediction, and from a cron entry point. Every run reaches the same verdict for the same bars, so it does not matter which request triggers it. One verdict settles every position on the track, and the proof goes into the ledger: the deciding bar for a derail, the last close for a hold.

The price layer is covered in Price feed and the record in Public ledger.

• The bind bar, the minute your entry falls in, counts by its close alone, checked against the rails at the end of that minute.
• Every later bar counts by its high and low, checked against the rails at the bar's midpoint (or at the end of the run, if that comes first). A high at or above the upper rail, or a low at or below the lower rail, is a touch.
• The final bar, the minute the run ends in, counts in full.
• Both rails in one bar: the rail crossed by the larger margin counts as the touch.
• A held track resolves once the final bar has closed, after a 5-second grace.
• Missing bars never create a derail. A minute with no trades has no bar, and nothing crossed.

On a derail, the settle price is the rail's level at the touch, and the ledger stores the deciding bar with its feed and interval. On a hold, the ledger stores the last close. Anyone can pull the same candles from the public feed and rerun the check.

No data, no verdict. If the feed returns no bars, the keeper leaves the track live and retries on its next pass, so a feed outage can delay a settlement without causing a derail.

The feed keeps about 3.4 days of one-minute bars. If a track still has no verdict 3.3 days after its bind, the keeper judges it on 15-minute bars under the same rules.

1. 1
   Export

   Call /api/ledger?after=0&limit=500, then pass the last seq you received as the next after. Rows come in ascending order, each with prevHash and hash.

2. 2
   Rebuild each entry

   Take ts, kind, address, ref and data as returned. Convert amount from tRAIL back to micro units (multiply by 1,000,000), since the hash commits to the integer amount.

3. 3
   Hash and compare

   Hash the canonical JSON with the previous hash and compare the result to hash. The first mismatch marks the first altered entry.

A chain that checks out proves the history is consistent with itself. To catch a rewrite of the whole chain, keep a head hash you trust or compare against an anchor on Robinhood Chain.

When an operator key is configured, the keeper anchors the ledger head on Robinhood Chain at most once every 15 minutes. Each anchor is a zero-value transaction from the operator address to itself, with calldata that reads RAILS:<seq>:<hash>. /api/ledger/verify lists the latest anchors, so you can match a head hash to a transaction on the explorer.

• Server trust today. Until the contracts deploy, you rely on the keeper to run the published rules. The ledger exposes a bad write after the fact and cannot block one.
• Price source. Outcomes follow Hyperliquid's public prices and one-minute bars. A wick on that venue counts as a touch.
• Model risk. Odds come from a volatility estimate. If prices move in ways the model does not expect, the vault can gain or lose more than the spread suggests.
• Vault drawdowns. The vault bears losses. Full reserves and the 60% utilization cap bound what it can owe, and a run of player wins can still draw it down.

1. 1
   Request a nonce

   POST /api/auth/nonce with { address }. The response holds a nonce and the sign-in message.

2. 2
   Sign

   Sign the message with the wallet key (personal_sign). Signing is free and sends no transaction.

3. 3
   Verify

   POST /api/auth/verify with { message, signature }. The response sets an HttpOnly session cookie that lasts 7 days. Send it with every write.

side is hold or derail. Positions carry a kind: lay for the creator's position, predict for a Predict position. A request that fails a guard returns a code that names it: requote when the multiplier fell below your minMultiplier, side_not_offered under the ×1.05 floor, vault_capacity when the vault cannot reserve the payout, on_rail while a track is derailing.

A quote for a flat ±1.5 track over one hour on BTC, trimmed for reading. Price and range change with the market; P and the multipliers depend on the shape alone.

GET /api/quote?market=BTC&gauge=1.5&grade=0&run=60

200 OK
{
  "market": "BTC",
  "price": 97250.5,
  "range": 540.2,
  "gauge": 1.5,
  "grade": 0,
  "run": 60,
  "pHold": 0.727739,
  "hold": { "p": 0.727739, "m": 1.33289, "offered": true },
  "derail": { "p": 0.272261, "m": 3.56276, "offered": true },
  "ts": 1789761600000
}

An agent can price shapes with /api/quote, open with POST /api/tracks and a minMultiplier guard, follow its track with /api/tracks/{id} and check every result against /api/model and the ledger. The engine documents the model, so an agent can recompute P on its own and compare it with the keeper's quote.