SVM program

One Anchor program covers the Solana side, mirroring the EVM escrow and solver split. Deposits pay into an escrow, a program-derived account with seed escrow, and stay there until they settle past the deep-reorg check, a wait the operator and the signer cluster enforce off chain rather than the program; refunds pay out of the same escrow with the program signing as its authority. The operator float lives in a plain treasury system account and its associated token accounts, and fulfillments are signed by the treasury key itself. Settled escrow funds move to the treasury through the release instructions, which route the referrer share of each released deposit into the voucher vault instead. The program gates refunds and releases only on the treasury signature: a refund can send any amount the escrow holds to any account, and a release can move any amount to the treasury and the voucher vault without checking settlement.

	Address
Program id	BLinKtWiWoLWqeFpBS3esiVjUxtM5h15VNmg8dzev6ee
Escrow (PDA, seed `escrow`)	45AE2z4b7bhaapKQLRDNMfx6P5gMkTZScmzhg2bEZex6
Event authority (PDA, seed `__event_authority`)	AQA7fJGmM7F8Qe5wZxCHTceabDAdNTc8me8CxLYWoY93
Treasury	H2BZ2RV4xmndaXyvjEucYte7KqMXYJ8NZVwBX3VwbbYK

Prefer the router_address (program id) and treasury returned on the quote and by GetChains over these constants.

Deposit instructions

pub fn deposit_token(ctx: Context<DepositToken>, quote_hash: [u8; 32], amount: u64) -> Result<()>;

deposit_token transfers SPL tokens from the depositor’s token account into the escrow’s associated token account and emits Deposit with the amount actually credited, so transfer-fee mints are accounted at the escrow, not assumed. There is no native SOL deposit: a SOL deposit goes through deposit_swap, which swaps it into the lock token.

pub fn deposit_swap(
    ctx: Context<DepositSwap>,
    quote_hash: [u8; 32],
    src_amount: u64,
    min_lock_amount: u64,
    swap_data: Vec<u8>,
) -> Result<()>;

Rejects the call with OwnerPassedToSwap (6005) when any account handed to the swap is the depositor. Otherwise invokes the aggregator program passed as swap_program with the caller-supplied accounts and data, signing as the swap authority (a PDA with seeds swap_authority, the depositor, and the quote hash) wherever that account appears. After the swap it transfers every lamport the swap authority still holds back to the depositor, then requires the escrow’s token account to have grown by at least min_lock_amount, emitting SwapDeposit with the credited amount. The swap authority holds only the input amount and the lamports the depositor gave it to pay the route’s rent; the depositor never signs the swap.

pub fn close_swap_account(ctx: Context<CloseSwapAccount>, quote_hash: [u8; 32]) -> Result<()>;

Closes a token account owned by the depositor’s swap authority for that quote, paying the rent to the depositor. The token program refuses to close an account with a balance, so a swap that leaves anything behind fails the transaction. buildSvmSwapDeposit in the SDK assembles this transaction from the GetSwapInstructions payload; see Swap instructions.

Operator instructions

Restricted to the treasury signer, listed for completeness.

pub fn fulfill_token(ctx: Context<FulfillToken>, quote_hash: [u8; 32], amount: u64, min_amount_out: u64, gas_drop: u64) -> Result<()>;

pub fn fulfill_native(ctx: Context<PayNative>, quote_hash: [u8; 32], amount: u64, min_amount_out: u64) -> Result<()>;

pub fn begin_swap(ctx: Context<BeginSwap>, quote_hash: [u8; 32]) -> Result<()>;

pub fn fulfill_swap_token(ctx: Context<FulfillSwapToken>, quote_hash: [u8; 32], amount_out: u64, min_amount_out: u64, gas_drop: u64) -> Result<()>;

pub fn fulfill_swap_native(ctx: Context<FulfillSwapNative>, quote_hash: [u8; 32], amount_out: u64, min_amount_out: u64) -> Result<()>;

pub fn refund_token(ctx: Context<RefundToken>, quote_hash: [u8; 32], amount: u64) -> Result<()>;

pub fn release_token(ctx: Context<ReleaseToken>, amount: u64, voucher_amount: u64) -> Result<()>;

fulfill_token pays amount to the recipient’s token account from the treasury and optionally transfers gas_drop lamports to the recipient, requiring the recipient to be credited at least min_amount_out; Fulfilled carries the amount actually credited. fulfill_native pays amount lamports and requires it to be at least min_amount_out. Destination swaps run in one transaction: begin_swap records the balance of the treasury token account that receives the swap output in a snapshot account (seeds swap_snapshot, quote hash, token account), the aggregator instructions run, and fulfill_swap_token or fulfill_swap_native measures the swap output against the snapshot. Each requires the payout to be at least min_amount_out, pays the lesser of the swap output and expected_amount_out, leaves any surplus in the treasury, closes the snapshot, and emits SwapFulfilled with both the delivered amount and the swap output. fulfill_swap_native reads the treasury’s wrapped SOL account, unwraps it by closing it, and pays the recipient in lamports. refund_token pays the escrow’s funds to whatever account the treasury signer names, with the program signing as the escrow authority; the operator names the quote’s refund address. release_token moves escrow funds to the treasury; the operator submits it only for settled deposits, once the released amount crosses a per-token threshold. It takes amount out of the escrow, pays voucher_amount of it into the voucher vault and the rest to the treasury, and fails with VoucherShareExceedsRelease when voucher_amount is larger than amount. The operator sets voucher_amount to the referrer share of the fulfilled deposits in the release, and the signer cluster recomputes it from each deposit’s quote before signing.

Voucher redemption

pub fn redeem_voucher(
    ctx: Context<RedeemVoucher>,
    id: [u8; 32],
    referrer: Pubkey,
    amount: u64,
    signature: [u8; 64],
) -> Result<()>;

Callable by anyone. The transaction must include an ed25519 verification instruction, before this one, over the voucher message (domain, chain, program id, id, mint, referrer, amount) signed by a registered voucher signer. A marker account derived from the id is initialized on redemption, so an id cannot be redeemed twice, and the amount is transferred to the referrer’s token account from the voucher vault: the token account of the program’s authority PDA, which the program signs for as owner. Releases fill it with the referrer share of each fulfilled deposit, and anyone can also fund it with a plain transfer. The treasury never signs a redemption, and the vault balance caps what vouchers can pay out. See Referral program.

Events

Event	Emitted by
`Deposit(quote_hash, mint, amount, from)`	`deposit_token`
`SwapDeposit(quote_hash, mint, amount, from, src_mint, src_amount)`	`deposit_swap`
`Fulfilled(quote_hash, mint, amount, recipient, gas_drop)`	`fulfill_token`, `fulfill_native`
`SwapFulfilled(quote_hash, mint, amount, recipient, gas_drop, swap_out)`	`fulfill_swap_token`, `fulfill_swap_native`
`Refunded(quote_hash, mint, amount, recipient)`	`refund_token`
`Released(mint, amount)`	`release_token`
`VoucherRedeemed(id, mint, referrer, amount)`	`redeem_voucher`

The indexer matches Deposit and SwapDeposit against stored quotes by quote_hash. Native amounts carry the default pubkey as mint. Events are emitted with Anchor’s emit_cpi!, not written to the transaction logs. The program calls itself with instruction data made of the 8-byte event tag e445a52e51cb9a1d, the event’s discriminator (sha256("event:<Name>")[0..8]), and its Borsh-encoded fields, and signs that call as the event authority (AQA7fJGmM7F8Qe5wZxCHTceabDAdNTc8me8CxLYWoY93, seed __event_authority). The program rejects the self-call unless the event authority signed it, and only the program can sign for that address, so no other program or transaction can forge an event. Read events from the inner instructions of successful transactions: those whose program is Blink and whose data starts with the event tag. Log truncation does not affect them. Every instruction listed in the table above takes two extra accounts after its own: the event authority and the Blink program, both read-only.

Errors

Error	Cause
`Unauthorized`	An operator instruction signed by a key other than the treasury.
`InvalidVoucherSignature`	No preceding ed25519 instruction matches a registered voucher signer.
`ShortCredit`	A refund credited the recipient’s token account less than the transferred amount.
`InsufficientOutput`	The swap credited the escrow below `min_lock_amount`, or a fulfill paid out below `min_amount_out`.
`OwnerPassedToSwap`	A `deposit_swap` handed the depositor’s account to the swap program.
`VoucherShareExceedsRelease`	A `release_token` asked to pay more into the voucher vault than it releases.

Reference

Blockchain

Deposit instructions

Operator instructions

Voucher redemption

Events

Errors

​Deposit instructions

​Operator instructions

​Voucher redemption

​Events

​Errors

Deposit instructions

Operator instructions

Voucher redemption

Events

Errors