Concepts

How a send settles

Everything that happens inside the one transaction you sign.

Before the payment: the signed price

Pyth publishes prices off chain, signed by its Wormhole guardians. When you send, the app posts that signed update to Solana first, through Pyth's receiver program, which verifies every signature and stores the price in an account. Those are the first transactions your wallet approves.

The payment transaction

The payment itself is one transaction. In order:

1. Your input moves from your wallet into a transit account that belongs to this payment's receipt.
2. A market route through Jupiter swaps exactly that input into the output token and delivers it into the output currency's pool.
3. Ferry checks that the pool received at least the payment plus a 1 bp minimum fee.
4. The recipient's token account receives the exact quoted amount. If they don't have one yet, it's opened in the same transaction.
5. The transit account closes, its rent returns to you, and the receipt records the payment.

What Ferry checks

• The price account belongs to Pyth's receiver, is fully verified, carries the right feed, and is at most 30 seconds old.
• Each feed's confidence interval is within 100 bps.
• Recomputing your amount at that price gives exactly the quoted payment, and the quote hasn't expired.
• The route spends exactly your input, delivers enough, and touches no account it shouldn't.

If any check fails, the whole transaction is refused and nothing moves.

After the payment

The app closes the price accounts and returns their rent to your wallet. The receipt stays on chain as the record of the payment; Activity reads it back.