Security model

The classic lending-protocol attack is: dump the price, crash the oracle, buy the collateral back cheap. Here the attack decomposes:

• There is no oracle to crash. The only prices that matter are ones the attacker must trade into existence and sustain through the pending window — against the book’s committed capital.
• Dumping fills bids lenders already wanted. Selling into the floor is not an exploit; it is the product. The attacker sells at prices lenders pre-committed to pay.
• Even a successful push settles at committed prices. If a move holds, lenders receive the asset at the price they named — the outcome they signed up for, not a discount seized from them.

Invariants

• Committed capital is escrowed — depth in the book cannot be faked or withdrawn out from under an open loan.
• No transfer of value settles inside a single block or a single trade.
• Markets are isolated — no shared pool, no protocol treasury, no admin key, no upgrade path.
• Parameters are immutable per market; changing them means a new market at a new address.