ACE: An Open Credit Market

1 Introduction

To lend against an asset you need to know its price. Existing lending options require an oracle to know what an asset is worth. The oracle is a trusted party in a trustless network, and it is only as honest as the market underneath it. Deep markets have honest oracles, but everything else either has a dishonest feed or no feed at all.

Pool-based designs aggregate lenders into a shared pool and read collateral value from an external feed [1, 2]. Later work isolates markets and makes them immutable and permissionlessly created, leaving risk choices to lenders rather than to the protocol [3], and a separate line replaces variable rates with fixed-maturity claims traded at a discount [4, 7]. Every one of them still needs a price for the collateral, and every one of them gets it from a feed.

We run a production, self-repaying, revenue-based lending market on veNFT collateral tokens. There is no price feed for these assets. We can try to fit the data to price them accurately, but historically unpriced assets are hard to price correctly. The problem isn’t the data itself: we found that an asset is only as valuable as someone is willing to pay for it. Once a floor is proven, an asset can be drawn against.

ACE is a new DeFi primitive. Lenders create resting bids that borrowers borrow against. Every borrow is backed by a committed bid and kept honest by the market itself. The result is an extendable architecture that unlocks the next wave of decentralized finance.

2 Design properties

• The market is the oracle. Lender capital is the floor: committed capital can’t be faked. Individual trades can’t trigger liquidation, only persistent price changes measured by the hook’s swap record can. An inconsistent market is free money for arbitrageurs, who keep the market honest.
• Built on Uniswap’s liquidity network. Credit markets can be created permissionlessly the same way Uniswap pools are [5]. Each market pairs a lending ladder with an ordinary v4 pool: the pool trades as it always has, with its own liquidity providers, while a hook records the price history the lending side reads.
• Liquidations aren’t final. A liquidation doesn’t trigger a sale; it transfers the right to the asset. If the price dips and recovers within a predetermined window, the right to the asset returns to the borrower.
• Borrows execute like swaps. It’s an open market: borrowers execute on the best committed bids the way swaps execute on the best price. Lenders compete to fund the next loan.
• Every loan is terminal. Every loan expires within a single fixed term. Rollover reprices at today’s risk.
• No cold starts. Lenders can post bids before any borrower arrives, and an issuer can seed the ladder as the market is created, so it opens with a floor already standing. Capital can arrive ahead of demand, and demand can recruit capital.

3 Mechanism

Notation. Write $p_i$ for the price a lender committed to at tick $i$, ${\ell }_i$ for the principal currently lent from that tick, and $a_i$ for the part of a given loan funded there. A loan escrows $Q$ units of collateral against a debt $D$. The venue record shows $P(t)$ at time $t$, the present is $\tau$, and $W$is the market’s settlement window.

3.1 Creating a market

Anyone can create a lending market from a template; whether a market thrives is determined by the market itself. Creating one deploys a lending ladder alongside a Uniswap pool and a hook [5]. Prices are discretised onto the tick grid that pool already uses [6]. The pool is an ordinary v4 pool. It trades normally and takes liquidity from anyone. The hook observes it, writing a running record of the prices the pool held, and that record is what the lending side reads. Pool liquidity is not lending liquidity and backs no loans: only capital resting in the ladder does (Figure 2).

The creator chooses the pair, the settlement windows, which self-repay channel the market runs, and the opening ladder. They pick a template, never risk parameters. A value outside the template’s rails reverts the creation rather than misconfiguring the market. The hook’s address is mined and deployed deterministically, and every parameter is fixed at creation, so one set of settings yields exactly one market and nothing about it can be changed afterward.

A draw raises some ${\ell }_i$ and a repayment lowers them. Nothing else in the market touches $\ell$ at all, so deposits, withdrawals and trades leave $m$ exactly where it was. The rest of the design rests on that.

That last property is what replaces the oracle. There is no feed to crash, and a manufactured price move cannot reach the quantity that governs solvency. A resting bid is a real commitment: if the asset trades down to a lender’s price, that lender’s cash buys it, and they hold the asset at the price they named. Their terms came true, and the cash that bought it is no longer available to lend.

3.2 Lending

Lenders can place bids themselves or hand the job to a curator. A bid is a commitment to acquire the token at a specified price: capital rested in the ladder at the prices you would want the asset. Placing bids yourself, you earn only when your capital is lent out. Resting is not earning by default. Through a curator, you join a portfolio run to that curator’s risk and reward preferences.

3.3 Curators

Curators allocate on behalf of lenders who would rather not pick prices themselves. A curator runs a portfolio, chooses which markets it bids into and at what prices, and earns a fee on the assets under its management, set by the market and never levied by the protocol. Curator creation is permissionless and immutable. A curator can move capital between markets, but capital allocated to a market is a live bid for as long as it sits there: it backs the mark, and it has to be able to settle. Withdrawing it is how a curator stops quoting it.

3.4 Borrowing

When a borrower borrows against their collateral they pay an origination fee, charged once at the start and again at each rollover. Nothing accrues in between: the fee is an option premium rather than a rate, and the terms freeze at entry.

A loan’s trigger is arithmetic on its own debt and collateral. No feed enters it, and neither does the mark:

$K$ is fixed when the market is created. Because $T$ is proportional to $D$, every repayment lowers it: melting debt is what pulls the trigger away from the price, and nothing else does. A draw is admissible only while the trigger sits at or below the mark, scaled by a maturation factor $\rho$ that a market earns as it settles loans cleanly. Equivalently, borrowing power is bounded by

$\rho$ begins well below one and rises only as loans settle clean, so a new market lends far less against the same collateral than a seasoned one. Quoting $1/K$ on its own would describe a market that does not yet exist.

The loan is self-repaying. When the collateral earns, either through a rise in price that holds or through the yield the asset itself throws off, the market sells a slice of it and pays down the debt:

where $h$ is the loan’s high-water mark and $p$ the price that held over the window. Only the growth above $h$ is ever sold and principal is untouched, so as the debt falls the price at which the loan would settle falls with it. A loan under pressure is not skimmed at all.

Each loan is termed, so it must be terminated. A borrower can roll it at today’s risk, repay in full and take the collateral back, or walk away and let the lender take title. Repaying is always available, including while a loan is under pressure. Paying down debt is itself the cure.

3.5 Liquidations

A loan becomes settleable only once the recorded price has held below its trigger for the market’s full settlement window. Nothing is written while that window runs and there is no pending state to sit in: settleability is read off the price record and the loan’s own arithmetic. Until title moves, the borrower keeps every right they had (Figure 3):

The record is a lagging floor rather than a live quote, and if it does not span $W$ the predicate is false, so a degraded record settles nothing.

If the price recovers before the window elapses, the condition dissolves. There is no fee, no verb to call and nothing to undo. Repaying does the same thing with no price movement at all: the debt falls, and the trigger falls out from under the band that was forming.

Only after the window has run through can anyone call settlement, and that is the moment title moves. The lender receives the asset at the price they themselves committed to. There is no auction, no buyer, no discount and no spot price read at settlement. The collateral that moves is priced at each funding tick’s own committed price:

Neither $T$ nor the spot price appears anywhere in that sum, which is why the moment settlement happens cannot change what it costs. Because every loan is termed there is also a backstop at expiry that reads no price at all, so a funded campaign to hold a price up can defer settlement but never escape it.

Once the lender holds the asset they may keep it, redeem it where the asset redeems (LSTs, RWAs), or sell it on the open market.

3.6 Shortfall and bad debt

Settlement releases collateral against each of a loan’s claims at the price its funding tick committed to. If the escrowed collateral does not stretch that far, the difference is a shortfall.

The market’s junior cushion absorbs it first. Junior is first loss by construction, and the charge is bounded by the slice allocated to that market: a shortfall never reaches the junior backing a different market. A junior funder that itself funded the shorted loan bears that loss directly rather than being made whole out of the cushion it belongs to.

Only what junior cannot cover becomes public bad debt, and that reduces the claims of the senior lenders who funded the loan. Nothing is socialised past them. There is no shared reserve, no protocol backstop and no other market’s capital standing behind the position, so a market’s losses stay with the lenders who chose it. That is the price of markets anyone can open without asking permission, and it is the contagion shape the design refuses to take on.

3.7 Keepers

Nothing in ACE runs on a schedule, and the actions that keep a market current are open to anyone: settlement, rollover, repayment and the self-repay skim are all permissionless. A keeper is paid out of the proceeds of the action they perform, taking a share of what a skim realizes or a sliver of the collateral at settlement, so the reward scales with the position. There is no pool to run dry and no reward to claim.

3.8 Delegation

A borrower may authorise another address to open a loan on their behalf. Opening is the only verb the authorisation covers: the operator supplies the collateral and receives the payout, while the borrower holds title and carries the debt. An operator cannot repay, roll, settle, set a skim policy or touch any position the borrower already holds, so granting one is not granting custody. Designs that authorise an address for everything at once have to push that granularity into a wrapper contract above the protocol [7]; here it is a property of the protocol itself.

Authorisation can be granted directly or relayed with a signature, so a borrower can delegate without holding gas. A leveraged position is then expressible as one transaction rather than a sequence the borrower has to sit and watch.

3.9 Fees

Every fee attaches to the lending market. A borrower pays an origination fee when the loan opens and again at each rollover, charged on the principal, rising with utilisation, and deducted from the payout rather than added to the debt. Since it is taken up front and nothing accrues afterwards, it prices the option the market has written rather than the time the borrower holds it.

The self-repay skim splits what it realises: a bounty to the keeper who called it, a protocol slice, a share to the lenders whose capital funded the loan, and the remainder against the borrower’s own debt, with anything left over returning to the borrower. Settlement pays its caller a sliver of the collateral in kind. Both are proportional to the position, so neither can run dry and neither has to be funded in advance.

There is no fee on depositing, on withdrawing, on repaying, or on a loan that recovers before it settles. Charging for repayment would work against the one mechanism that pulls a trigger back down. Protocol revenue accrues to a single address fixed in the contract’s own bytecode and is delivered by a permissionless, time-gated sweep, so no deployer can redirect it and there is no claim function anywhere in the protocol.

4 Collateral suitability

If a loan defaults or is liquidated, a lender takes title of the asset, so a healthy market must have a reliable exit to keep the flywheel going. There are two exits: hold the asset and redeem at intrinsic value (RWAs, LSTs, veNFTs), or sell into a deep market (WETH, BTC, etc.). An illiquid asset with no intrinsic value offers lenders no exit of its own.

Every market rests on a junior cushion that takes the first loss, and capacity is a function of it. Without that cushion a market has no capacity at all, whatever its asset’s external depth happens to look like. Depth amplifies the cushion but never substitutes for it, and it is measured as a minimum over time, because depth that appears on demand can disappear the same way. This is also how an issuer opens a market for an asset nobody would otherwise price: post the cushion, and the floor under the asset becomes something a lender can underwrite. Loss stays inside the market that caused it, and one market’s junior never pays for another’s. Floored assets are the mechanism’s native domain.

5 Applications

Assets that could never be priced with an oracle can now be priced and loaned against, with risk adjusted by the market itself. This provides efficient lending markets on RWAs, NFTs, veNFTs, and more. It extends Uniswap’s range to provide leverage on any token, and it enables launchpads, bridging, multichain tokens, and prediction markets, with countless further markets waiting to be made.

Every ACE market is an ordinary Uniswap v4 pool: routable, aggregator-indexable, arbitrageable. Every credit market ACE opens is new volume and new depth on Uniswap’s network.

A few of the markets this admits:

• Launchpads. A bonding-curve launch graduates into its own credit market.
• Prediction markets. Multi-outcome floors, priced by the market at all times.
• NFT / veNFT. A floor loan plus a fractionalized remainder; the tenor is the scheduled exit.
• RWA. The skim harvests the real coupon; a permissioned-market variant is the securities path.
• Corridors. A bridge as a credit market: tenor-bounded messenger exposure.
• Options income. A resting bid is a cash-secured put.
• Vesting and locked tokens. A token locked for 90 more days has no price feed and never will, but lenders can bid what delivery at unlock is worth.
• Treasury desks. Borrow without dumping the token.
• Rent-a-floor. A holder pays to time-lock a bid under their asset: a guaranteed floor as a subscription, priced as a bought put.
• Public OTC. Transparent block trades for whales and treasuries, against the same floor of committed bids that settlement draws on.
• Buybacks. A treasury’s standing bid is a buyback order that earns lender yield until it fills; the buyback budget and the floor under the token become the same program.

6 Security analysis

The classic attack on lending is to dump the price, crash the oracle, liquidate everyone, and buy the collateral back cheap. That doesn’t work here because there is no oracle to crash. Dumping the price just fills lenders’ bids at prices they already wanted, and a loan only becomes settleable if the price stays down across the market’s entire settlement window. A single trade or a quick wick does nothing, and no single block can move the record more than one capped step. Even when settlement lands there is no discount to grab: the lender receives the asset at the price they committed to, and the caller earns a small bounty. Markets are isolated too, so if one fails the losses stay with the lenders who chose it. There is no shared loss pool, no mutualized backstop and no admin key.

7 Conclusion

ACE is lending without an external oracle: the market is its own price authority, and every credit market settles against an ordinary Uniswap pool. We built the primitive; what gets built on top is not ours to decide. Anyone can open a market, anyone can run a portfolio, anyone can build on top. We do not claim to know the full set of uses; the best uses of a primitive tend to be discovered rather than planned.

8 References

1. Aave. Aave Protocol Whitepaper V1.0, 2020.
2. Robert Leshner and Geoffrey Hayes. Compound: The Money Market Protocol, 2019.
3. Mathis Gontier Delaunay, Paul Frambot, Quentin Garchery and Matthieu Lesbre. Morpho Blue Whitepaper, 2023.
4. Dan Robinson and Allan Niemerg. The Yield Protocol: On-Chain Lending With Interest Rate Discovery, 2020.
5. Uniswap Labs. Uniswap v4 Core, 2023.
6. Hayden Adams, Noah Zinsmeister, Moody Salem, River Keefer and Dan Robinson. Uniswap v3 Core, 2021.
7. Bhargav Nagaraja Bhatt, Paul Frambot, Quentin Garchery, Mathis Gontier Delaunay, Adrien Husson, Paul-Adrien Nicole, Adrien Laversanne-Finot and Matthieu Lesbre. Morpho Midnight Whitepaper, 2026.