Draw

The problem

Wealthy people rarely sell shares just because they need cash. They borrow against them. It's an ordinary product called securities-backed lending, but in practice it means a private bank, a high minimum, and days of waiting.

Most people don't have that option. So they sell.

Tokenization made selling faster. It didn't change the tradeoff: once you sell, you don't own it. And without access to traditional credit, there's usually no other way to turn something you own into cash without giving it up.

What Draw does

Draw is a payment button. The customer clicks it and sees:

Borrowing $40 against your NVDAx — you keep all 0.54 shares.

They confirm with a PIN. Behind that, Draw builds a single Solana transaction that deposits the collateral into Kamino, borrows USDC against it, and pays the merchant.

No credit check, no application, no bureau. The collateral backs the loan, and it works on a Sunday.

It doesn't have to go to a shop. You can draw to your own wallet, send it to any Solana address, and repay whenever you want the shares released.

How it works

Pay with Draw
  → quote     collateral, liquidation price, peg check
  → build     server assembles it, payee resolved from the origin
  → sign      Privy embedded wallet, in the browser
  → submit    fee payer co-signs, simulates, sends, notifies the merchant

16–17 instructions in one transaction: compute budget, first-time account setup, deposit, obligation refresh, borrow, transfer. Either all of it lands or none does. There's never a moment where the user owes money and the merchant hasn't been paid.

Draw is not a lending protocol. Kamino does that, and does it well. Draw turns a borrow into a checkout.

Verified on chain

Run against a fork of mainnet with real Kamino reserves, real xStocks mints, real oracles.

What	Signature
Deposit, borrow and pay, atomically	3zDc3Pnc…9AFPq — 17 ix, 1,036/1,232 bytes
Repayment releasing collateral	gkzJiTzE…nSMmB — $40.00 → $0.00
Drawing to the user's own wallet	4gD7K5EX…LxJdyM — 15 ix, 946 bytes

A wallet holding zero SOL can make its first payment. Draw's fee payer covers the fee and the rent, because Kamino charges rent to the user.

The merchant is told server to server with a signed webhook. The demo shop waits for its own server before confirming an order, never the browser.

Why Solana

Atomic. Deposit, borrow and payment settle together or not at all. 24/7. Tokenized equities trade when the stock market is shut. No approval step. Nobody underwrites the customer. The collateral decides.

Risk is a product decision

Kamino permits 55% loan-to-value on NVDAx and liquidates at 65%. Draw lends 35%.

Tokenized stocks trade around the clock; the market underneath them doesn't. A position opened on Saturday can gap at Monday's open with nobody able to react. That gap is the user's margin. 29 tests cover that one file, because it's where a rounding error becomes somebody's liquidation. Every money value is a Decimal, never a float.

And a second risk, using Pyth. Everything above assumes an NVDAx is an Nvidia share. It's a claim on one, and claims drift. The obvious check — comparing the token feed against the equity feed — fails exactly when it matters, because the equity feed freezes when the market shuts, which is the weekend, which is the risk. So Draw reads Crypto.NVDAX/NVDA.RR, Pyth's redemption rate: the token priced in the share, updated around the clock. Past 2% drift, Draw refuses to lend. Read from Pyth's on-chain account over the same RPC as everything else — no API key, no subscription.

Borrowed funds can't be redeposited. This is a spending product, not leverage.

Integration

<script src="https://js.draw.fi/v1"></script>
<button onclick="Draw.checkout({ amount: 4000 })">Pay with Draw</button>

That's the whole client integration. The merchant never touches wallets, collateral or liquidation.

And it isn't a cheaper way to process a sale they were already making. The customer wasn't going to liquidate part of their portfolio to buy a $40 chair. It's a sale that wasn't happening.

What's real, and what isn't

Real: the chain layer, the risk engine, the atomic transaction, the payment API, the embed, signed webhooks, address validation that rejects token accounts and program addresses, the peg guard, repayment.

Not finished: webhook retries are in-process and last about two seconds. The peg guard has only been tested against synthetic drift, because the live rate is healthy. Demos run on a mainnet fork, not mainnet - pointing at live mainnet is an environment variable, not a rewrite, but it hasn't been done.

The README also documents something easy to leave out: xStocks issuers keep freeze and permanent-delegate authority over collateral Draw holds. That's an inherited risk of the asset, documented rather than hidden.