# buyout

> buyout.sh funds public releases of working software. A creator registers a working private tool, a release package and a USDC goal. Supporters contribute USDC into an on-chain escrow. If the creator publishes the committed package, it passes review and the challenge period ends without an upheld challenge, the release becomes public for everyone and the creator is paid. If it is not delivered and accepted, every contributor can take their USDC back.

Network: Solana mainnet, native USDC (6 decimals). Everything below is public and read-only; reading needs no wallet or account.

- Program: BuyFd6BFkrRDyNGPrreb98NBM88vQsF5UySsFECqsXRY
- USDC mint: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
- Program IDL (Anchor): https://buyout.sh/recovery/idl.json
- All amounts in the API are integer strings in atomic units: 1 USDC = 1000000.
- Default policy (from /api/v1/status, field config): 5% fee (fee_bps 500) taken only from a successful release, 7-day delivery, 3-day review, 72-hour challenge, 25 USDC challenge bond. Each campaign's own descriptor can set different terms and those are the ones that apply to it. Operator test campaigns use 15-minute windows and a 1 USDC bond.

## Read the public API

Base URL: https://buyout.sh/api/v1 (OpenAPI schema at /api/v1/openapi.json)

- GET /status: chain, program, USDC mint check, RPC slot and latency, indexer head slot and lag, public copies (with independence notes), worker, review roles, checked_at.
- GET /campaigns: every campaign with state, goal_atomic, raised_atomic, refunded_atomic, remaining_atomic, fee_bps, deadlines, descriptor, preview, operator_test, next_action. Filter with ?state= (comma-separated ui_state or chain state).
- GET /campaigns/{address}: one campaign, plus title history.
- GET /campaigns/{address}/evidence: release manifest, package hash, files, rights, build runs, review decisions, release submissions, challenges, public copies with checked_at.
- GET /campaigns/{address}/files/content?path={manifest path}: one file of a published release. The server hashes it against the manifest before returning it. Text up to 256 KiB (truncated flag beyond), binary files as metadata only.
- GET /public/{copy}/{sha256}: the whole published release archive (application/x-tar), content-addressed by its sha256.
- GET /campaigns/{address}/contribution-plan?amount_atomic={n}&wallet={address}: the accounts and checks a contribution would use. Planning only; it moves nothing.
- GET /campaigns/{address}/events: server-sent events for that campaign (resumable with Last-Event-ID or ?since=).
- GET /activity: every indexed program event, newest first, with label, wallet, amount, signature, slot and block time. ?campaign={address} keeps one campaign's events; ?limit= (up to 200) and ?before={next_cursor} page.
- GET /activity/events: server-sent events for every campaign; chain_event messages carry an item in the /activity row shape.
- GET /receipts/{signature}: a contribution, refund, payout claim, bond settlement or challenge bond by transaction signature.

Chain state names: Funding, AwaitingRelease, InReview, ChallengeWindow, Disputed, Released, Refunding. A Refunding campaign whose refunded_atomic equals raised_atomic has returned every contribution; it is a completed outcome, not money waiting.

## Read the chain yourself

The campaign address in the API is the campaign account on chain. Browsers can use the JSON-RPC proxy at https://buyout.sh/rpc (POST only), or any mainnet RPC:

    curl -s https://api.mainnet-beta.solana.com -H 'content-type: application/json' \
      -d '{"jsonrpc":"2.0","id":1,"method":"getAccountInfo","params":["5B4k5zSSHFXj6pkwDPNobfTVcoW9S48tL32eDtKKZ27a",{"encoding":"base64"}]}'

Decode the data with the Anchor IDL above. The escrowed USDC sits in a token account owned by a program-derived address; the program, not buyout's servers, decides when it can move.

## Pages

- https://buyout.sh/ : the exhibition and the index of every campaign
- https://buyout.sh/c/{address} : one campaign (preview, release, terms)
- https://buyout.sh/c/{address}/release : the public release reader (files, build, license, copies, challenge)
- https://buyout.sh/releases : released campaigns
- https://buyout.sh/how-funding-works : the funding, release and refund rules
- https://buyout.sh/license-scope : what the release license covers
- https://buyout.sh/review-authority : who reviews and what each role can and cannot do
- https://buyout.sh/status : live operational status
- https://buyout.sh/recovery/ : a standalone client that reads the escrow and builds refund transactions directly against the program, for when the buyout API is unavailable

## Limits worth knowing

- The two public copies of each release are on the same host as the API; /status says so (independent: false). They are not independent providers.
- The verifier and panel keys listed in /status are held by the server (review_roles.server_held). Appointed keys do not establish independent human review.
- Every campaign listed today is an operator test run with real USDC by the buyout operator; each one is marked operator_test: true.
- A passing build and acceptance test is not a security audit.