Documentation

System overview

ACE is an open credit market built as a set of Uniswap v4 poolswith the lending book implemented in the pool’s hook. Each market is an ordinary v4 pool: swaps route through it, LPs can exist alongside it, and the hook adds a term-credit facility on top of the same liquidity surface.

The system has no price oracle, no off-chain feeds, and no admin keys. Credit is priced by committed capital: lenders place bids that are binding commitments to buy the collateral asset at a stated price, and everything else — floors, liquidations, recoveries, rates — is derived from those commitments and from prices the market itself prints on-chain.

• No oracle — the market is the oracle; only persistent on-chain price moves settle anything.
• Permissionless — markets deploy with one call; no gatekeeper.
• Reversible — liquidation transfers a right, not the asset; recovery is possible within a window.
• Open execution — borrows execute against best committed bids the way swaps take the best price.
• Termed — every loan expires; rollovers reprice at the current rate.
• Either side first — lenders can commit before any borrower arrives, and vice versa.

Markets are isolated: each is its own pool with its own book. A failure in one market stays with the lenders who chose it. There is no shared pool, no protocol treasury backstop, and no cross-market contagion path.

Architecture

A market is fully described by its parameter tuple. Deployment is deterministic via CREATE2: the same tuple always resolves to the same address, so a given market can exist exactly once and its address can be computed off-chain before it exists.

Market parameters

All parameters are fixed at deployment. Changing any of them describes a different market at a different address — nothing is upgradable or governable after the fact.

The book

The book is a set of ticks: price levels carrying committed quote-side depth. A bid at price p is a binding commitment to buy the base asset at p — it is not a quote, and it cannot be faked, because the capital is escrowed in the market when the bid is placed.

• Placement — any address can commit at any tick strictly below the current mark.
• Priority — execution consumes ticks best-first; within a tick, pro-rata.
• Withdrawal — unborrowed depth withdraws freely; depth backing open loans is locked until those loans resolve.

Lending

A lender chooses a tick and an amount, and commits. From that moment the position earns whenever borrowers draw against the book, and it stands as the floor for everyone trading above it.

Return sources

• Origination — each draw pays a 1% origination fee to the depth it executes against.
• Skim flow — the collateral skim (Sec. 06) streams through to the lenders funding the position.
• Discounted acquisition — if title transfers, the lender receives the asset at the price they named — by construction a price they were willing to pay.

Lenders earn all the way down: a falling price unwinds borrower positions into the book rather than past it, so depth keeps collecting fees as it absorbs the move.

Curators

Capital can be committed directly, or through a curator— a vault that spreads idle quote across markets and ticks under a stated mandate. Curators are ordinary lenders from the protocol’s point of view; they hold no special rights.

Borrowing

Borrows execute the way swaps do: against the best available depth, best tick first. A borrower pledges base collateral, draws quote, and pays the origination fee. There is no rate negotiation — the book is the rate.

Self-repayment

On upward price moves, the hook skims the configured fraction of the appreciation from the pledged collateral and applies it against the debt. A position that rides a rising market amortizes itself; for yield-bearing collateral (RWAs, LSTs), the skim harvests the native coupon into repayment.

Rollovers

At maturity a loan can roll, but a rollover is a new loan at the current book’s rate — debt never drifts silently under stale terms. If the book has moved against the borrower, rolling is exactly as expensive as it should be.

The mark & persistence

The markis the protocol’s settlement reference: a price the pool itself has printed and sustained. It is recorded on-chain by the hook from the market’s own trading — no external feed, no keeper, no committee.

The defining rule: a single trade can never settle anything. Trades move spot; only spot that persistsbecomes a mark. A flash crash, an oracle-style wick, or one whale’s dump prints a price for a moment — and a moment is not enough. The pending window (Sec. 08) is the persistence check applied to any move that would transfer value.

Liquidation & recovery

When the mark falls to a funded tick, the loans drawn against that depth enter pending liquidation. Nothing is sold — there is no auction, no keeper race, no slippage cascade. The state machine is:

• Pending — the borrower’s right to the collateral is held, not sold. The position is frozen against the committed price.
• Recovery — if the mark recovers within the window, the right returns to the borrower and the loan continues unchanged.
• Title transfer — if the move persists, the lender receives the collateral at the price they committed to. No forced sale means no fire-sale externality for the rest of the market.

A healthy market therefore needs a dependable way for a lender to exit an acquired asset. There are two:

• Redeem at intrinsic value — Hold the asset and redeem it for what it is worth — RWAs, LSTs, veNFTs. No buyer has to show up.
• Sell into a deep market — Sell into existing depth — WETH, BTC, and other liquid assets. The exit is the market that was already there.

Settlement at term

Every loan is terminal: at maturity it resolves, without exception. The borrower has three outcomes, and all three are final:

Because terms are absolute, the book’s exposure has a known horizon: no position can outlive its market’s term, and lender capital is never locked indefinitely.

Security model

The classic lending-protocol attack is: dump the price, crash the oracle, buy the collateral back cheap. Here the attack decomposes:

• There is no oracle to crash. The only prices that matter are ones the attacker must trade into existence and sustain through the pending window — against the book’s committed capital.
• Dumping fills bids lenders already wanted. Selling into the floor is not an exploit; it is the product. The attacker sells at prices lenders pre-committed to pay.
• Even a successful push settles at committed prices. If a move holds, lenders receive the asset at the price they named — the outcome they signed up for, not a discount seized from them.

Invariants

• Committed capital is escrowed — depth in the book cannot be faked or withdrawn out from under an open loan.
• No transfer of value settles inside a single block or a single trade.
• Markets are isolated — no shared pool, no protocol treasury, no admin key, no upgrade path.
• Parameters are immutable per market; changing them means a new market at a new address.

Application surface

Because risk is priced by the market itself, credit reaches assets an oracle could never touch. A partial catalogue of what the primitive supports:

Glossary