Skip to main content
Each market has two books - one per synth side - living entirely inside a Pool account (up to 16 inline bins, no per-bin rent). The keeper’s book manager keeps every book pinned to NAV with a shape derived from live volatility. Because the protocol is the sole LP and the keeper repositions before external arbitrage can profit, the reposition itself captures what an arber would otherwise take.

​
The reposition loop

Every 30s, per (market, side):
  1. Feed the vol state. One NAV sample per cycle goes into the spread engine - the same series the oracle pushes. At boot the state seeds from 60 days of Pyth Benchmarks history, so floors are warm from the first cycle even right after a deploy.
  2. Check the drift gate. The book only re-pins when |NAV - base| >= the per-market gate - QQQ/SPY/XAU 20bps, VXX 40bps. The gates were swept empirically: the optimum sits just below each market’s toxic-arbitrage line (first funded bin plus the paired-arb fee hurdle). Tighter gates burn transactions repositioning a book nobody can exploit; looser gates donate depth.
  3. Compute the shape. Half-spread = the model-free stack (realized-q90 ratchet, slow auto-floor, oracle confidence, static floor - see the keeper concept page). The inner round(half_spread / step) bins stay empty; remaining liquidity distributes geometrically outward. The protective skew then widens the trend-adverse side only - in an uptrend the asks move out (don’t sell cheap into a rally) while the bids never tighten below the symmetric shape. The short book mirrors automatically: its own price series is K / L, so its skew signal flips sign.
  4. Post it. set_pool_shape(base = NAV, asks, bids) - sums are validated against the pool’s vault balances on-chain.
During closed market hours the oracle withholds pushes, drift reads zero, and the book simply floats at its standing band - price discovery happens inside the posted bins, and the first fresh print re-anchors everything.

​
Inventory: refill, trim, bid cap

pool_swap fills only from pre-funded bins, so flow reshapes inventory and the keeper closes the loop each cycle - in both directions:
  • Refill (drained asks). One-directional buying converts ask synth into bid cUSDC. When a side’s ask value falls below half its bid value, the keeper sweeps surplus bids to the CLP vault, mints fresh L+S pairs from it (vault_mint_pairs - delta-neutral by construction), and funds both sides’ ask vaults in one pass. The reshape that follows is forced, so the new inventory enters the book immediately.
  • Trim (bloated asks). Ask depth beyond 1.5x the bid side’s value is fake exit capacity and standing arb bait - it sweeps back to CLP custody (pool_sweep_synth), where it provisions committed orders instead.
  • Bid cap. Standing bid cUSDC is deliberately lean (~$5k per side, CLMM_BID_TARGET_USD): idle bids forgo lending carry, and large sells don’t need them - they route through the committed venue, which the keeper provisions at settlement. Excess bids sweep to the CLP vault.
The result is a small, symmetric, self-healing book: deep enough for instant retail trades, too lean to be worth attacking, with effectively unlimited size served by the committed path.

​
Why the books are lean (the economics)

Backtests on five years of minute data settled the sizing policy: toxic loss scales linearly with deployed depth while organic revenue is capped by demand, so depth beyond demand is a pure subsidy to arbitrage. Deployed synth costs nothing to hold - the collateral backing it earns lending yield wherever the tokens sit - but deployed bid cUSDC forgoes that yield, which is why bids carry a hard cap and asks only a ratio. The instant book is a service priced at roughly breakeven; the protocol’s economics live in fees and collateral yield.