> ## Documentation Index
> Fetch the complete documentation index at: https://continuum-ec12e897.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Solvency

> The paired-neutrality invariant, the one attack that exists against it, and the layered defenses - depth caps, vol-scaled fees, dynamic buffer, volatility decay.

Continuum's solvency rests on one structural invariant, one known extraction path, and a stack of defenses sized against that path. This page tells the story in that order.

## The invariant: paired mint/redeem is solvency-neutral

Every user mint and redeem is **paired**: `mint_paired` deposits cUSDC and issues matched L+S; `redeem_paired` burns and pays out at NAV. Because `S_NAV = K / L_NAV`, the value of one pair is

```
f(P) = P + K / P        (P = L_NAV, K = initial_l × initial_s)
```

and the vault always holds `pairs × f(P)` by construction. A paired operation moves collateral and claims by exactly the same amount at any price - it cannot create or destroy solvency. There is no user-facing single-sided mint; an unpaired mint would create an unbacked claim against the vault.

## The attack surface: the convexity gap

With no external venue to trade against, the only riskless extraction is the **paired round-trip**: mint a pair, wait for the price to move, redeem. Its profit is the convexity gap of `f` - the pair you minted at one price is worth slightly more after any move, because `f` is convex with its minimum at `P = √K`.

Structurally, the protocol is **short the pair's convexity — i.e. short volatility** — and the premium it collects for that (fees + collateral yield) is what keeps it solvent. The break-even is roughly *realized σ \< √(2·yield)*: at \~5% collateral yield that's \~32% annualized vol. Broad indices (15-25% vol) sit inside that band; high-growth single names (40-80%) do not, which is exactly why the single-name listings need every defense below.

That profit has to clear the **fee hurdle**: 10 bps base fee each way plus trading spreads. The result splits by asset class:

* **Broad indices near their anchor** (QQQ, SPY): the convexity gap over realistic horizons never clears the hurdle. Effectively unbustable.
* **High-growth single names** (NVDA-like trajectories): a flat at-NAV venue alone *can* be drained at scale - the convexity gap compounds with trend. This is why the defenses below exist, and why single-name listings require them all.

## The defenses

### 1. Depth-capped books

The instant venues never expose unlimited size at NAV. The CLMM books carry lean, demand-sized depth (\~\$5k bids, ≤\$7.5k asks per side) with real slippage across bins - extraction per round-trip is capped by what's deployed, and what's deployed is deliberately small. See [CLP - lean by design](/concepts/clp#lean-by-design).

Committed orders are uncapped in size but fill at a price set *after* the commitment, so they offer no stale quote to extract against.

### 2. Vol-informed fees

The mint/redeem fee scales with realized volatility:

```
fee_bps = max(10, fee_mult × q90)      capped at 100 bps
```

where `q90` is the trailing 90th-percentile window move from the keeper's spread engine. 90% of every fee stays in the market's collateral vault (directly raising the collateral ratio); 10% is the dev tax. Higher vol → bigger convexity gap → proportionally higher hurdle.

### 3. Dynamic overcollateralization buffer

Each market targets a buffer sized to its actual risk, posted on-chain by the keeper via `set_buffer_target`:

```
B = δ²/2 + |q|·δ + margin
```

* `δ` = tail multiplier × worst-case σ, doubled during closed market periods.
* `q` = current inventory skew - a skewed book needs more cushion against a move.
* Floored at 102%, clamped on-chain to \[100, 5000] bps over parity so a bad write can't gut the target.

This replaces the old static 102% everywhere it was used - waiver consumption, the `withdraw_excess` floor, and the donate gap all read the dynamic target.

### 4. Volatility decay (the γ-index)

The convexity the protocol is short lives entirely in the short leg (`S_NAV = K/P` is convex; `L_NAV = P` is linear). The keeper can charge for it directly by ratcheting a decay scalar `γ` that marks `S_NAV` down:

```
S_NAV = (K / P) × γ              γ ratchets down by realized per-cycle variance
```

This **banks the choppiness-convexity the protocol bleeds as collateral surplus**. The r39 calibration shows the right decay (`Δγ/γ = σ²` per cycle) banks *exactly* the short-leg gamma on a choppy path. Crucially it charges **realized variance, not direction**: a smooth directional run barely moves γ (that payoff is in the untouchable long leg), so decay is the lever for the *variance* regime, while a directional single-name run still leans on the buffer, OI caps, and asset selection. Ratchet-down only, floored at γ = 0.5, off-chain gated by `CLMM_GAMMA_DECAY_ENABLED` (off until deployed). It is **not** a perp funding rate and **never touches longs**. See [NAV → Volatility decay](/concepts/nav#volatility-decay).

### 5. Re-anchoring (not built — settlement, not a trigger)

Periodic on-chain re-anchoring would reset `K` so the anchor tracks the asset, collapsing the accumulated convexity gap. The honest finding: a *value-neutral* rebase has provably no solvency benefit (the liability curve is the sum of holder payoffs, unchanged by a rebase), and a *beneficial* re-anchor would have to revalue holders — that's a deliberate settlement decision, not a mechanical keeper trigger. So it is **not** built as an automatic mechanism.

## How the collateral ratio refills

Four channels push CR up over time:

1. **Mint/redeem fees** - 90% of every fee stays in the vault, immediately.
2. **Harvested collateral yield** - deployed collateral earns lending yield; harvests land in the treasury vault and reach CR via `donate_to_vault`.
3. **Trading-spread profits** - the books buy below NAV and sell above it; profits accumulate in CLP custody and follow the same donate path.
4. **Convexity reversion** - when price reverts toward `√K`, `f(P)` falls and the existing vault passively over-collateralizes.

## Supporting structural protections

* **Paired-only user mint.** Single-sided issuance paths are CLP-PDA- or keeper-gated and net to zero across their cycles.
* **Bounded oracle writes.** `update_risk_state` rejects TWAP moves over 25% per call, so a compromised keeper key cannot teleport NAV; the keeper adds its own mainnet-side deviation envelope before pushing.
* **Staleness gates.** Mint and redeem self-freeze when the on-chain TWAP ages past 300 s (`MAX_TWAP_AGE_SECS`) - no operation prices off a dead oracle. See [Risk states](/concepts/risk-states).
* **Oracle-swap breakers.** The instant `clp_swap` venue checks staleness, confidence, deviation, a rolling notional window, and a collateral floor on every fill.
* **Cross-market isolation.** All markets share one unified vault, but each market's `total_collateral − deployed_to_yield` ledger is its own — every outflow is gated on that per-market liquid share, so one market can't spend another's backing. The rebalancer moves only excess above the source's dynamic buffer target (a scalar ledger move), floor enforced on-chain.
* **Pro-rata redemption.** If a tail move pushes CR below 100%, redeem pays `nominal × min(1, CR)` - the vault can never be overdrawn, and every remaining holder faces the same ratio, so there is no first-mover advantage and no bank-run dynamic.

## What this means for users

**You cannot lose more than your collateral.** A paired position is fully prepaid - no margin, no liquidations. Even if the protocol shut down tomorrow, L+S holders redeem against the existing vault: at full NAV while over-collateralized, pro-rata in the tail. If you hold only one leg, it is still redeemable on its own at NAV.

## What this means for builders

Long and short tokens carry a redemption guarantee - if you receive 100 QQQS in payment, you can redeem at NAV any time the TWAP is fresh. The operational things to monitor are **risk state** (mint blocks in `Stress`) and **TWAP freshness** (mint and redeem freeze off-hours when the underlying market is closed).

→ [Risk states](/concepts/risk-states) · [Reading state](/flows/read-state)