Solvency

The paired-mint invariant, the convexity gap it leaves open, and the defenses sized against it, from lean books and keeper-posted fees to volatility decay, the posted buffer and the treasury backstop.

Continuum’s solvency rests on one structural rule, one known extraction path and a set of defenses sized against that path. This page takes them in that order.

The invariant: paired mint/redeem is solvency-neutral

Every user mint and redeem is paired. mint_paired deposits cUSDC and issues L and S worth exactly the deposit, less the fee, at the current NAV. redeem_paired burns the largest value-balanced pair inside the two amounts you offer (both above zero) and pays its NAV value. Because S_NAV = K·γ / L_NAV, one L plus one S is worth

f(P) = P + K·γ / P        (P = L_NAV, K = initial_l_price × initial_s_price)

A paired operation moves collateral and claims by the same amount at the moment it happens. After that the collateral stays put while the claims move with the price. f is convex, with its minimum at P = √(K·γ). At a fixed γ, a position of value v minted at price P_m is later worth (v/2)·(P/P_m + P_m/P), which is at least v, so its claim rises with any price move away from P_m. There is no user-facing single-sided mint; an unpaired mint would leave the vault holding a one-way bet.

The attack surface: the convexity gap

With no external venue to trade against, the only riskless extraction is the paired round trip: mint a pair, wait for the price to move, redeem. Its gross profit is that convexity gap.

Structurally, the protocol is short the pair’s convexity, which means short volatility. Two charges work against the round trip. Volatility decay marks the short leg down by the realized variance of the path, and the fee hurdle taxes every mint and redeem. The keeper posts fees from 10 to 100 bps (10 to 39 bps across the 13 live markets as of 13 Oct 2026), the program multiplies them by 1.5 in ProxyMode, and the round trip pays them twice, plus the worst-case markup.

The result splits by asset class. For a broad index trading near its anchor price, the gap over realistic horizons stays below the hurdle. For a high-growth single name on an NVDA-like path, a flat at-NAV venue alone can be drained at scale: the gap compounds with the trend, and volatility decay barely charges a smooth trend. That is why the defenses below exist, and why single-name listings need all of them.

The defenses

1. Depth-capped books

No instant venue exposes unlimited size at NAV. The bin books trade only while a market’s price is stale, and carry lean, demand-sized depth (about $500 of bids and at most $750 of asks per side while the market is open; off-hours, at least $500 a side, limited by a risk cap on that market’s share of the treasury) with real slippage across bins. Extraction per round trip is capped by what’s deployed, and what’s deployed is deliberately small. See CLP: lean by design.

Committed orders have no size cap of their own, but the exposure cap limits how far the market can go net long or short. They fill at a price set after the commitment, so they offer no stale quote to extract against, and they pay the keeper’s vol-scaled committed spread. They refuse to fill while the market is below 100% collateralized at the settle price. The cash a large fill needs comes from the treasury when it settles. The instant oracle swap, which filled at the last pushed price, was retired on 11 Oct 2026.

2. Vol-informed fees

The keeper posts each market’s mint and redeem fee from realized volatility:

fee_bps     = clamp(fee_mult × half_spread, 10, 100)      fee_mult = 1.0 on every market
charged_bps = fee_bps × risk-state multiplier             1.5× in ProxyMode

half_spread is the long book’s half-spread from the keeper’s spread engine, and the keeper posts the result as both the mint and the redeem fee. QQQ posts 18 bps and is charged 27 bps on devnet. Of every fee, 90% stays in the market’s collateral vault, raising the collateral ratio directly, and 10% is the dev tax. Higher vol means a bigger convexity gap and a proportionally higher hurdle.

3. Posted overcollateralization buffer

Each market has a buffer target, which the keeper posts on-chain with set_buffer_target. The target collateral ratio is 100% plus the buffer. The buffer is the smallest one that keeps the chance of the collateral ratio falling below 100% at or under 1% a year, assuming the treasury tops the market back up within 12 hours. No buffer is below 1%, the program’s minimum.

A job reruns that calculation once a day, after the US close: a jump-diffusion Monte Carlo of each market over the next year (100,000 paths, with market hours, overnight and weekend gaps and earnings) that starts from the market’s live state:

• Leg imbalance β = (L − S)/(L + S) by value. It grows as the price drifts from the market’s anchor, and it is what eats a buffer; the γ charge already covers the convexity.
• γ, the short leg’s volatility decay.
• The volatility regime: recent daily volatility against the long-run calibration. It can only raise a target, by up to 2×; a calm month never lowers one.

Every path runs twice: once with the book left alone, and once with the keeper’s imbalance control redeeming the CLP’s heavier leg whenever |β| leaves 0.05. A market whose live |β| is within 0.10 gets the second need, because the band is visibly holding. Past 0.10 it gets the first. With the band held, no market needs more than 0.63% (TSLA), so every buffer heads for the 1% minimum.

A target rises at once and falls at most 50 bps or 25% a day, whichever is larger. From 12 Oct 2026 the targets step down to 101% at that pace, which takes NVDA and TSLA about nine days. The keeper reads the job’s output every 30 minutes and posts a target only when it differs from the value on chain. If the output is missing or older than 48 hours, the keeper posts a fixed fallback table computed for a book at its anchor.

Market	Daily target, 12 Oct 2026	Need with the band held	Fixed fallback
QQQ	101.84%	100.17%	101.7%
SPY	101.05%	100.13%	101%
XAU	101.54%	100.14%	101.4%
XAG	105.97%	100.33%	105.9%
AAPL	103.33%	100.27%	102.9%
MSFT	103.69%	100.34%	103.3%
GOOGL	104.83%	100.43%	104.8%
AMZN	106.06%	100.48%	106.1%
NVDA	110.69%	100.49%	110%
TSLA	112.40%	100.63%	112%
EUR, GBP, JPY	101%	100.06% to 100.09%	101%

The program clamps any target to [100, 5000] bps over parity (101% to 150%).

These targets replaced a formula the keeper computed live from 40 minutes of realized volatility, B = δ²/2 + |q|·δ + margin, on 11 Oct 2026. A replay of the keeper’s own prices showed that formula swinging from 4% to 50% within the hour and falling to 2% after restarts.

On chain the target gates only how much excess a market can shed to others (withdraw_excess_to_clp and rebalance_collateral). Mints and redeems don’t depend on it. The keeper’s treasury backstop fills markets toward it.

4. Volatility decay (the γ-index)

The convexity the protocol is short lives entirely in the short leg: S_NAV = K/P is convex, and L_NAV = P is linear. γ is the live mechanism that charges for it. The keeper ratchets γ down by realized variance, which marks short claims down and raises the collateral ratio directly. At GAMMA_DECAY_COEF = 1.0 the charge is break-even against the short leg’s convexity on a choppy path.

S_NAV = (K / P) × γ          γ ratchets down by realized variance

It charges realized variance and ignores direction. A smooth directional run barely moves γ, so it doesn’t cover a single name trending away from its anchor. That case rests on lean depth, the committed spread, fees and asset selection. If collateral still falls short, the treasury backstop tops the market up, and pro-rata redemption is the last resort. γ is always on with no kill switch, only ratchets down, is floored at 0.5 per epoch, and never touches longs. See NAV → Volatility decay.

5. reanchor_gamma is not a spot re-anchor

reanchor_gamma renews γ’s budget. Only the market authority can call it, at least 14 days after the previous one. It folds γ into initial_s_price and resets γ to 1.0, so every claim is unchanged at every price. It collects and returns nothing; it lets decay keep charging once γ nears its floor. It does not move the curve’s minimum to the current price. A re-anchor to spot would revalue holders’ positions, and the program has no instruction for it.

6. Exposure cap

Paired tokens are solvency-neutral, but a trader who holds only one leg is a directional position, and the protocol is the other side of it. Traders’ net exposure E is what they hold long minus what they hold short, at NAV, excluding whatever the CLP itself holds:

E = (L supply − CLP-held L) · l_nav − (S supply − CLP-held S) · s_nav

CLP-held means the pool’s synth vault for that leg plus the CLP’s own token account for it. E above 0 means traders are net long and the treasury is net short. Paired mints split the deposit by value, so they never move E. Trades against the CLP or the bin books do. Redemptions do not: since 14 Oct 2026 redeem_paired and request_redemption burn or escrow only a value-balanced pair, so they move E by less than $1 and are not capped (the check stays in the code as a guard).

Each market’s Clp.oi_cap (in cUSDC atoms, 0 meaning uncapped) binds |E|. A change ΔE is allowed when E + ΔE stays inside [min(−cap, E), max(cap, E)]. Nobody can push E further past the cap than it already is, and a trade that shrinks E always passes, even after a price move has carried E past the cap with no trade. Because the cap is on the net, each short opens room for one more long. The room to buy longs is the cap plus the shorts traders already hold, less the longs.

The cap is sized so that a bad year across every market together takes at most half the treasury. The same nightly job that posts the buffer targets reruns the sizing:

1. It simulates one year of price paths for every live market at tonight’s volatility, on the same paths so correlation between markets is in.
2. For each market it takes R, the year’s rise, and the weight w = 1 / q99(R), where q99 is the 99th percentile. Every market gets an equal 1-in-100 budget.
3. A market’s share of the treasury is w × 0.5 / q99(Σ w·R), the 99th percentile of the weighted sum over all markets. A 1-in-100 year with every market’s longs filled to their caps then costs at most half the treasury.
4. The cap is that share times the live treasury balance.

A lower cap applies at once, and a higher one rises at most 25% a day. The job publishes the result as exposure_caps_atoms, and the keeper posts it to each market’s Clp.oi_cap (see Keeper). If any step fails, the previous caps stay. The caps therefore move with the treasury and with volatility, so read the live oi_cap from the chain rather than a figure in a document.

What a trader sees depends on the venue. A committed order fills up to the room left at its settle price and the rest comes back with the escrow, so a large buy can fill in part. With under $1 of room it is refunded whole. A bin-book fill that would pass the cap reverts. Redemptions are not capped, because they burn a balanced pair. Orders on the P2P order book are not affected. See Trade and Redeem.

How the collateral ratio refills

Five channels push the ratio up over time:

1. 90% of every mint and redeem fee stays in the vault, immediately.
2. Each volatility-decay step marks short claims down.
3. When the price moves back toward a position’s mint price, its claim falls and the vault over-collateralizes passively.
4. Collateral can be added directly. Anyone can call donate_to_vault, and the market authority can call fund_collateral. Neither grants a fee waiver or any other reward, and neither needs a fresh price. The CLP’s backstop_market moves cUSDC from the treasury into a market’s vault the same way. CLP trading profits reach a market’s collateral only through these. The keeper calls backstop_market when a market falls below 100% or stays short of its target (see Treasury backstop), and calls neither of the others. On 11 Oct 2026, fund_collateral brought 13 markets up to their 102% target; XAU was already above it.
5. Harvested collateral yield is added to total_collateral by harvest_collateral_yield.

On devnet, collateral yield is emulated. Every live market has yield_enabled = true as of 11 Oct 2026. Each hour the keeper mints the cUSDC that its mainnet lending plan would have earned on a market’s collateral and harvests it into that market, which raises its collateral ratio. Nothing is actually lent on devnet.

The treasury

The CLP’s global vault (5GSTKN4u5LfropcnQQoqFht48JMaF1SzZzBcgDNL5VKy) is the protocol treasury. It held about 22.13M cUSDC after the keeper’s returns of 11 Oct 2026: 5,534,820.82 from funding, plus idle CLP cash that the keeper returned to it. It grew to about 40M by 12 Oct, and the devnet keeper is now burning it down: it held 36.1M cUSDC on 13 Oct 2026.

Moving treasury cUSDC into a market is fast. backstop_market puts it straight into a market’s vault and credits total_collateral. It has no rate limit and works while withdrawals are frozen, because the cUSDC stays inside the protocol.

Taking cUSDC out of the protocol is slow. admin_withdraw pays only one named account. Its allowance refills at a rate the keeper keeps in proportion to the balance, so emptying the treasury takes 24 h however much it holds (see Keeper → Treasury withdrawal rate). Loosening any limit waits 24 h. A guardian key can freeze withdrawals and veto a pending loosening, but it can’t move funds. See clp → Treasury.

The CLP’s working cash comes from the treasury too. The keeper keeps each market’s CLP vault at what its books’ bid refills can spend before the next top-up, $1,250 per market, and returns the rest. Imbalance control’s pair mint is paid from the treasury in the same transaction. Committed orders draw what they need when they settle. See Keeper → Liquidity reallocator.

Treasury backstop

The keeper’s liquidity reallocator uses the treasury to top up a market’s collateral with backstop_market, which pays into the market’s collateral rather than its CLP vault. It reads the collateral ratio at the stored price:

• Below 100%, it fills at once, at least up to the market’s target. Committed orders refuse to fill below 100%, so this is what lets them resume.
• Short of target by more than one confidence band for 5 minutes, it fills to the target plus the band. This is the same destination rule the cross-market rebalancer uses, and the rebalancer moves other markets’ excess first.

The target the treasury fills to is the market’s posted target, capped at 130%. MSTR, closed on 12 Oct 2026, gets none. Fills are not returned automatically: a later surplus stays as a cushion, which the rebalancer can move between markets.

The keeper’s yield allocator counts the treasury as first-loss capital when it caps each lending venue. See Keeper → Yield allocator.

Lending venues and redemption timing

On mainnet the keeper lends each market’s collateral to USDC lending venues and keeps a liquid share in the vault for redemptions: the nightly job’s share of 1% to 10% of collateral, or 3% when that file is missing or over 48 hours old, sized to one short recall cycle of redemptions (Keeper → Yield allocator). Devnet has no lending venues, so nothing is lent there.

A redemption larger than the vault’s cash waits for a recall, and each venue limits how fast money comes back. The limits on 12 Oct 2026:

Venue	Free cash (utilisation)	Withdrawal limit, shared by every depositor
Kamino Main	$7.0M (94%)	$90M per 24 h window
Jupiter Lend	$44.4M (91%)	50% of supply at once, refilling over 6 h
Save	$5.1M (77%)	$10M per ~1.75 h across the pool

Free cash runs out before any of these limits does. Each venue’s admins can also pause withdrawals. MarginFi, which the keeper no longer lends to, paused all of them for about 79 hours from 1 April 2026, then wrote lenders down 1%.

The r58 study replayed these rules against 197 days of venue data, March to October 2026. With Jupiter Lend’s free cash at its current utilisation, a redemption of up to 10% of a market’s collateral was paid within one 5-minute keeper cycle on every day, even with every depositor withdrawing at once. Under a rougher path for Jupiter’s free cash, 1–2% of days missed the 5 minutes. A single holder redeeming 25–50% of a market could wait hours to days in a venue-wide run, or until a frozen venue reopens. Redemption sizes and pause odds are assumptions, because Continuum has no redemption history yet.

A redeem_paired the vault can’t pay reverts with InsufficientLiquidCollateral. The holder then queues the redemption with request_redemption. The keeper’s settler pays it in parts: from the vault’s cash, then from a recall inside the same transaction, and for what the venues can’t release in time from a treasury advance (advance_to_market, capped per market by max_advance_bps). The advance cash is not counted in total_collateral, and the keeper repays it from the market’s own next recall. A venue loss is charged to the outstanding advance first, because the treasury is first-loss capital. The owner can cancel the unpaid rest at any time. See Redeem.

Supporting structural protections

• Users can only mint in pairs. keeper_mint_single and keeper_redeem_single need market.keeper_authority, and redeem_single_for_vault accepts only the market’s CLP PDA. The keeper’s single-sided mint collects full NAV for the leg it mints.
• Price writes are bounded. update_risk_state_v2 rejects a move of more than 25% per push and a source publish time more than 300 s old, so a compromised keeper key can’t teleport NAV. On mainnet the keeper adds its own 10% envelope before pushing.
• A staleness gate stops pricing off a dead feed. Outside Normal, mint and redeem revert with TwapNotAvailable once the last push is more than 300 s old. See Risk states.
• Swap guards run on every oracle-priced fill. settle_swap checks price age, confidence, deviation and a 100% collateral floor. pool_swap trades only while the market’s price is stale, under a rolling notional cap where one is set.
• Each market keeps its own ledger and its own vault, and on 11 Oct 2026 every vault’s balance equaled its ledger. The same day’s upgrade removed the shared unified vault from the program. Every outflow is limited to the market’s own liquid share, total_collateral − deployed_to_yield, so one market can’t spend another’s backing. The rebalancer moves only collateral above the source’s posted target, and the program caps each move at that amount.
• Redemption goes pro rata in a shortfall. If a tail move pushes the collateral ratio below 100%, redeem pays nominal × min(1, CR). The vault can’t be overdrawn, and every remaining holder gets the same ratio, so there’s no first-mover advantage and no bank-run dynamic.

What this means for users

You can’t lose more than your collateral. A paired position is fully prepaid, with no margin and no liquidations. Redeeming needs both legs (each amount above zero) and a price push no more than 300 s old, so it depends on the keeper pushing prices. While the vault is fully collateralized you get NAV, less the fee and markup; in a shortfall you get the pro-rata share. A single leg exits through a committed order while the market is open, or through its bin book while its price is stale.

What this means for builders

A lone leg can’t be redeemed by itself. If you receive 100 QQQS in payment, you can sell it through a committed order while QQQ is open or on the QQQS book while it is closed, or redeem it together with some QQQL. The things to monitor are risk state (Stress blocks mint and redeem by default) and price freshness (mint and redeem freeze off-hours when pushes stop).

→ Risk states · Reading state