Solvency

The paired-neutrality invariant, the one attack that exists against it, and the layered defenses - depth caps, vol-scaled fees, dynamic buffer, volatility decay.

Continuum’s solvency rests on one structural invariant, one known extraction path, and a stack of defenses sized against that path. This page tells the story in that order.

The invariant: paired mint/redeem is solvency-neutral

Every user mint and redeem is paired: mint_paired deposits cUSDC and issues matched L+S; redeem_paired burns and pays out at NAV. Because S_NAV = K / L_NAV, the value of one pair is

f(P) = P + K / P        (P = L_NAV, K = initial_l × initial_s)

and the vault always holds pairs × f(P) by construction. A paired operation moves collateral and claims by exactly the same amount at any price - it cannot create or destroy solvency. There is no user-facing single-sided mint; an unpaired mint would create an unbacked claim against the vault.

The attack surface: the convexity gap

With no external venue to trade against, the only riskless extraction is the paired round-trip: mint a pair, wait for the price to move, redeem. Its profit is the convexity gap of f - the pair you minted at one price is worth slightly more after any move, because f is convex with its minimum at P = √K.

Structurally, the protocol is short the pair’s convexity — i.e. short volatility — and the premium it collects for that (fees + collateral yield) is what keeps it solvent. The break-even is roughly realized σ < √(2·yield): at ~5% collateral yield that’s ~32% annualized vol. Broad indices (15-25% vol) sit inside that band; high-growth single names (40-80%) do not, which is exactly why the single-name listings need every defense below.

That profit has to clear the fee hurdle: 10 bps base fee each way plus trading spreads. The result splits by asset class:

• Broad indices near their anchor (QQQ, SPY): the convexity gap over realistic horizons never clears the hurdle. Effectively unbustable.
• High-growth single names (NVDA-like trajectories): a flat at-NAV venue alone can be drained at scale - the convexity gap compounds with trend. This is why the defenses below exist, and why single-name listings require them all.

The defenses

1. Depth-capped books

The instant venues never expose unlimited size at NAV. The CLMM books carry lean, demand-sized depth (~$5k bids, ≤$7.5k asks per side) with real slippage across bins - extraction per round-trip is capped by what’s deployed, and what’s deployed is deliberately small. See CLP - lean by design.

Committed orders are uncapped in size but fill at a price set after the commitment, so they offer no stale quote to extract against.

2. Vol-informed fees

The mint/redeem fee scales with realized volatility:

fee_bps = max(10, fee_mult × q90)      capped at 100 bps

where q90 is the trailing 90th-percentile window move from the keeper’s spread engine. 90% of every fee stays in the market’s collateral vault (directly raising the collateral ratio); 10% is the dev tax. Higher vol → bigger convexity gap → proportionally higher hurdle.

3. Dynamic overcollateralization buffer

Each market targets a buffer sized to its actual risk, posted on-chain by the keeper via set_buffer_target:

B = δ²/2 + |q|·δ + margin

• δ = tail multiplier × worst-case σ, doubled during closed market periods.
• q = current inventory skew - a skewed book needs more cushion against a move.
• Floored at 102%, clamped on-chain to [100, 5000] bps over parity so a bad write can’t gut the target.

This replaces the old static 102% everywhere it was used - waiver consumption, the withdraw_excess floor, and the donate gap all read the dynamic target.

4. Volatility decay (the γ-index)

The convexity the protocol is short lives entirely in the short leg (S_NAV = K/P is convex; L_NAV = P is linear). The keeper can charge for it directly by ratcheting a decay scalar γ that marks S_NAV down:

S_NAV = (K / P) × γ              γ ratchets down by realized per-cycle variance

This banks the choppiness-convexity the protocol bleeds as collateral surplus. The r39 calibration shows the right decay (Δγ/γ = σ² per cycle) banks exactly the short-leg gamma on a choppy path. Crucially it charges realized variance, not direction: a smooth directional run barely moves γ (that payoff is in the untouchable long leg), so decay is the lever for the variance regime, while a directional single-name run still leans on the buffer, OI caps, and asset selection. Ratchet-down only, floored at γ = 0.5, off-chain gated by CLMM_GAMMA_DECAY_ENABLED (off until deployed). It is not a perp funding rate and never touches longs. See NAV → Volatility decay.

5. Re-anchoring (not built — settlement, not a trigger)

Periodic on-chain re-anchoring would reset K so the anchor tracks the asset, collapsing the accumulated convexity gap. The honest finding: a value-neutral rebase has provably no solvency benefit (the liability curve is the sum of holder payoffs, unchanged by a rebase), and a beneficial re-anchor would have to revalue holders — that’s a deliberate settlement decision, not a mechanical keeper trigger. So it is not built as an automatic mechanism.

How the collateral ratio refills

Four channels push CR up over time:

1. Mint/redeem fees - 90% of every fee stays in the vault, immediately.
2. Harvested collateral yield - deployed collateral earns lending yield; harvests land in the treasury vault and reach CR via donate_to_vault.
3. Trading-spread profits - the books buy below NAV and sell above it; profits accumulate in CLP custody and follow the same donate path.
4. Convexity reversion - when price reverts toward √K, f(P) falls and the existing vault passively over-collateralizes.

Supporting structural protections

• Paired-only user mint. Single-sided issuance paths are CLP-PDA- or keeper-gated and net to zero across their cycles.
• Bounded oracle writes. update_risk_state rejects TWAP moves over 25% per call, so a compromised keeper key cannot teleport NAV; the keeper adds its own mainnet-side deviation envelope before pushing.
• Staleness gates. Mint and redeem self-freeze when the on-chain TWAP ages past 300 s (MAX_TWAP_AGE_SECS) - no operation prices off a dead oracle. See Risk states.
• Oracle-swap breakers. The instant clp_swap venue checks staleness, confidence, deviation, a rolling notional window, and a collateral floor on every fill.
• Cross-market isolation. All markets share one unified vault, but each market’s total_collateral − deployed_to_yield ledger is its own — every outflow is gated on that per-market liquid share, so one market can’t spend another’s backing. The rebalancer moves only excess above the source’s dynamic buffer target (a scalar ledger move), floor enforced on-chain.
• Pro-rata redemption. If a tail move pushes CR below 100%, redeem pays nominal × min(1, CR) - the vault can never be overdrawn, and every remaining holder faces the same ratio, so there is no first-mover advantage and no bank-run dynamic.

What this means for users

You cannot lose more than your collateral. A paired position is fully prepaid - no margin, no liquidations. Even if the protocol shut down tomorrow, L+S holders redeem against the existing vault: at full NAV while over-collateralized, pro-rata in the tail. If you hold only one leg, it is still redeemable on its own at NAV.

What this means for builders

Long and short tokens carry a redemption guarantee - if you receive 100 QQQS in payment, you can redeem at NAV any time the TWAP is fresh. The operational things to monitor are risk state (mint blocks in Stress) and TWAP freshness (mint and redeem freeze off-hours when the underlying market is closed).

→ Risk states · Reading state