The Risk Profile

Risk is never removed. It's priced, bounded, and assigned.

Every mechanism on this site moves risk to whoever was paid to hold it — and names the price. This page is the full ledger: who bears what, which attacks die, and what honestly remains.

Who bears what

Four seats at the table

borrowersFirst loss on their own position: entry fees, deleverage slippage, premiums, and volatility drag in chop. In exchange: leverage that can't be wiped in one print (pending windows), self-repayment on the way up, and fixed, known terms. Risk = your equity; never more.
lendersThey are put writers: assigned only on moves that persist, at prices they (or the curated ladder) quoted, compensated by every fee flow. Bad debt from gaps socializes within their vault, on realization — never from a neighboring market. Exits are pro-rata above the utilization threshold, bounded by loan tenor.
sponsorsClass B/C seed sits junior — first-loss ahead of every outside lender, locked in factory code. The party with the informational advantage holds the tail. Their upside: the market lives and the seed retires.
the protocolModel risk. If realized losses exceed what the risk engine priced, that's our failure — published recalibration, standing conservative biases (vol floors, price-up-under-uncertainty, refuse-on-stale). Reputation is the collateral.
How these prices get set — the ladder, the mark, the fees — lives on the Pricing page.
The attack ledger

Everything we tried to break it with

AttackStatusWhy
Atomic wick (one-tx dump → liquidate → rebuy)DEADtrades can't move the LUP; fills settle at lender-committed prices; no liquidation discount exists to harvest
Sustained suppressionPRICEDreversible liquidation: settlements stay pending for window W and restore on recovery — attacker must hold price down for all of W with committed capital, or everything reverts
Stop-hunt cascadeDEAD*manufactured fills unwind on recovery — the attacker sold low and owns nothing durable. *Voluntary hard stops keep a bounded surface: stop-notional caps, registration fees, volume-weighted triggers
Oracle manipulationN/Athere is no price oracle. Health = deposits vs debt; persistence = the hook's own volume-weighted, truncation-capped record
Vol suppression (trade calm → cheap leverage → strike)PRICEDvol floors, max(short, long) windows, asymmetric decay, maturation tiers — engineered calm can't price a memecoin like ETH
Whale exit dumpCAPPEDextraction ≤ cash resting in the book, at quoted discounts; the floor buys the dip and re-cashes on recovery; zero liquidations either way
Issuer / creator rugSELF-RUGvested allocations (day-0 unlock: zero), factory-locked junior seed, capped self-borrow — every vector routes through the rugger's own capital first
Weekend / off-hours prints (RWA)DEADtrading-calendar gates triggers while the underlying is closed; the LUP never cared about prints anyway
Lender-side mark manipulationPRICEDquotes are capital-committed (a bad bucket buys its own junk first); ladder moves are rate-limited and banded; withdrawal that would hurt borrower health queues
The pattern:attacks that need a fake price die (there isn't one); attacks that need real capital become trades the system charges for.
The defense stack

Eight layers, one direction

1 · the markLender capital is the price (LUP). Only capital events move it.
2 · the recordThe v4 hook logs volume-weighted, truncation-capped observations every swap — persistence is provable, wicks enter as blips.
3 · bandsRisk trims in small early tranches sized to real depth — never one cliff.
4 · pendingForced settlements escrow first: restore on recovery, cure by top-up, settle only if the move holds.
5 · tenorEvery loan expires. Worst-case exposure and lender lockups are bounded by construction.
6 · isolationOne market's failure ends at its vault wall. The flywheel is severable.
7 · realizationBad debt writes down in the same transaction that exhausts collateral — the share price never lies, and queued exits serve after realizations settle.
8 · maturationCaps, tiers, and windows are earned with clean history and scale with locked depth — credit can't outrun exit liquidity.
Settlement without a sale

“We couldn’t liquidate — there was no liquidity.”
A sentence this design cannot produce.

Because liquidation here is a title transfer, not a trade. The word suggests selling collateral for cash — which needs liquidity. Ours never sells. Two people show why:

the pairAlice deposits $10k at the $0.80 tick — a commitment to own TOKEN at $0.80. Bob posts 25,000 TOKEN and borrows $10k. The $10k in Bob's wallet is Alice's $10k. Her bucket now holds a claim, not cash.
the runEvery lender with un-lent cash exits. Alice can't — there is nothing to withdraw; her dollars are in Bob's pocket. The loan is a closed pair: his escrowed collateral, her secured claim. A run can't touch either side.
the settlementBob defaults (or expires unable to repay). One ledger operation: 12,500 TOKEN — $10k at Alice's own quoted $0.80 — moves from Bob's escrow to Alice. Debt extinguished, remainder returned to Bob. Nothing was sold. No buyer was found. No liquidity was consumed. Alice's payment happened months ago, at origination.
the analogyA mortgage foreclosure: the bank doesn't need a liquid housing market to take the house — repossession is a title transfer. Whether and when to sell is the bank's later choice and risk. Alice committed to owning TOKEN at $0.80; now she does — the put-writer deal she was paid fees for.
Pool liquidity is only needed to turn things into cash — and enforcement never turns anything into cash.Collateral goes back to the counterparty whose money already left with the borrower, at that counterparty's pre-quoted price. The settlement party is recruited at origination — and can't leave.
The USDC experience

You always hold or receive USDC

Token delivery is the mechanism— it doesn't have to be the experience. Two doors keep passive dollars in dollars, without ever making the one promise that can't be kept.

curated vaultThe passive door is USDC-in, USDC-out. When a settlement converts a bucket, the vault receives the tokens and its keeper routes them straight through the executor — Dutch-decayed, floor-protected, permissionless fillers competing for the sale. The depositor never sees a token; a conversion shows up as a small NAV move, not a strange asset in their wallet.
cash-preference flagDirect-tick lenders set a per-deposit toggle: on finalization, auto-sell my tokens. The sale fires inside the settlement flow and the lender receives USDC proceeds — economically identical to receiving tokens and selling one block later, just automated through the same sale primitive everything else here uses.
the honest arithmeticA lender quoted at $0.80 who converts and auto-sells nets roughly the 80 cents they chose — their own price, minus a small haircut — and the fees earned the whole time are the compensation for exactly that residual. The downside is a priced, chosen haircut at a price you quoted.
the promise we refuse"USDC back at par, always" requires selling collateral for at least par during a crash — the liquidity-dependent guarantee that becomes frozen queues and socialized bad debt everywhere it's made. We guarantee the asset (USDC in your wallet) and the price you set — never par through a crash. Ours is the only version that's true anywhere.
Said plainly: you always hold or receive USDC; your downside is a priced, chosen haircut at a price you quoted — never a frozen queue, never a socialized surprise.
What honestly remains

The residuals we carry, priced

gap riskA move faster than the bands can trim leaves bad debt. It socializes on realization within that vault — and the entry fee was the put premium lenders charged for exactly this.
model riskSystematically underpriced vol bleeds the pool to adverse selection. Defenses are biases, not proofs: floors, price-up-under-uncertainty, published recalibration when exceeded.
chop dragBorrowers in sideways-volatile markets pay skims and premiums in both directions. That's the product's honest cost — "you pay for volatility instead of funding" — tuned by hysteresis, never zero.
keeper livenessSkims, tranches, and realizations need callers. Bounties make it permissionless competition rather than one backend — but a market nobody watches settles slowly.
executor εThe oracle-floor tolerance is fully extractable by callers — the explicit, budgeted price of permissionless execution. Batch caps keep it small.
RWA tailsIssuer/custodian jump-to-default can't be priced from vol history: credit tiers, junior sponsor tranches, isolation — mitigations, not immunity. NAV feeds are a disclosed trusted party.
regulationLeverage on fresh tokens and margin on securities are the two spiciest surfaces. Maturation gates the first; the permissioned lane is the entry ticket for the second.
the runWhat if every lender leaves? Withdrawals are never frozen — the free ~20% drains first (caps gate borrowing and rollovers, never exits), then the queue goes pro-rata (no first-mover advantage — the asymmetry that fuels runs doesn't exist), then the tenor clock drains the book: every loan repays or force-closes within N days, with the executor selling collateral externally and forced settlements delivering in-kind at lenders' own quoted ticks. Total exit: slow, orderly, bounded by N — possibly partly in-kind. That's the disclosed deal, and the market-owned floor can't run at all. Borrowers stay liquidatable throughout: the capital backing a loan can't exit before the loan resolves, and forced settlement is claim-to-collateral conversion — it needs no cash, no buyer, no depth. The settlement counterparty exists by construction.
Read this list to lenders, not past them. Every yield number on the next page exists because someone on this list is being paid to hold one of these.
Illustrative mechanism walkthrough — not audited economics, not an offer. Attack analysis summarized from the design review; Monte-Carlo validation of parameters is scheduled pre-build.