> ## Documentation Index > Fetch the complete documentation index at: https://inflexion.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Path A — the cvAMM > createSwapPathA: the pooled, signature-free, always-on underwriter. The on-chain load stack, the 99/1 premium split, and why the cvAMM is the floor of liquidity that removes cold-start. Path A is the **cvAMM** — a pooled, passive, always-quoting underwriter that lives entirely on-chain. An LP calls `createSwapPathA` and is priced and protected in a single transaction with **no market maker, no signed quote, no validity clock, and no relayer**. The counterparty is the dual-tranche [`ConvexityVault`](/protocol/vaults), which locks USDC collateral equal to [MaxIL](/concepts/maxil) and is paid the premium for taking the risk. This is **Pillar 2** of the [three pillars](/concepts/three-pillars): the cvAMM is the **floor of liquidity**. Because it always quotes a code-capped fair price with no MM present, there is no cold-start problem — an LP can always be priced and protected. Path B (the [MM rail](/protocol/path-b-mm)) is the ceiling of price; it can only ever undercut this floor, never replace it. No EIP-712 quote, no nonce, no `validUntil`, no off-chain engine. Pure on-chain call. The pool quotes for any in-range position in any enabled market — solves cold-start. The load stack is hard-clamped by [invariant I10](/security/invariants), then capped at MaxIL. The pool cannot overcharge. ## What `createSwapPathA` does `createSwapPathA` is one of three entry points into a single settlement core (the others are [`createSwap`](/protocol/path-b-mm) and [`createSwapRouted`](/protocol/routing)). It shares the same `view` read prologue (`_prepareSwap`) as the other two, prices the swap on the pool's own state, then locks, pays, and custodies in one Checks-Effects-Interactions sweep. Requires the cvAMM is wired (`convexityVault != 0`) and the market is both `active` and `cvammEnabled` — Path A markets must be explicitly opted in via `setCvammEnabled`. This is the on/off switch for the pool rail per market. `_prepareSwap` verifies `ownerOf(tokenId) == msg.sender`, derives the `marketId` from the live on-chain `token0/token1/fee`, reads `[Pa, Pb]` from the position ticks, pins `P0` to Chainlink **on-chain** (never caller-supplied), and enforces the convexity gate `Pa ≤ P0 ≤ Pb` else `PositionOutOfRange`. It computes `MaxIL`, snapshots the entry amounts `(a0, a1)`, and the position value `V0`. The liquidity `L` is captured here (`g.liquidity`) and stored at execution — settlement uses the **stored** `L`, never a re-read ([I6](/security/invariants)). `_fairPremium` converts geometry to ratios `a = Pa/P0`, `b = Pb/P0`, **pokes the [VolOracle](/protocol/oracles)** to refresh `σ_ref` (permissionless, no-op if too soon), and reads `FairValueOracle.fairPremium(...)` → `(FairPremium, fairRateWad, sigmaRefWad)`. This is the [exact closed-form Φ-sum](/math/fair-value-phi-sum) — the production Stylus pricer, never reimplemented off-chain. `_pricePathA` applies the I10-clamped [load stack](/math/load-stack) on top of `FairPremium`, then caps the charged premium at MaxIL. Like all three entry points, Path A enforces `MIN_POSITION_V0 = $100` and `MIN_PREMIUM = $1` (block dust swaps that grief capacity and close the integer-division free-coverage edge), plus a final `maxPremium` LP slippage guard. `_executePathA` performs all state changes and external calls. See the next section. ## Execution: `_executePathA` This is the only place Path-A state mutates. It follows strict Checks-Effects-Interactions ([CEI](/security/cei-reentrancy)): 1. **Lock collateral.** `convexityVault.lockCollateral(marketId, maxIL)` — the pool checks that `free ≥ maxIL` (`InsufficientFree`) **and** that the senior tranche stays protected, `totalLocked + maxIL ≤ juniorAssets` (`SeniorProtectionBreached`). Collateral locked is **exactly MaxIL** (FULL mode). 2. **Allocate the swap id.** `nextSwapId++`. 3. **Write the record.** `SwapRecord{ mm: address(convexityVault), collateral: maxIL, liquidity: g.liquidity (stored once — I6), ... }`. The counterparty field is named `mm` and is set to the vault address; `settle` later infers the rail from `s.mm == address(convexityVault)`. 4. **Pull the premium** in USDC from the LP. 5. **Take the NFT** into the [`ILVault`](/protocol/vaults) for custody. 6. **Split the premium** (next section). There is **no keeper, no signed quote, no validity clock, no relayer** anywhere in this path. Everything is synchronous and on-chain. ## The on-chain load stack Path A computes its load **on-chain** from the pool's own state (Path B carries a single `loadBps` instead). The premium is `FairPremium` scaled up by a load that is the sum of three components, then hard-clamped: $$ \text{premium}_A \;=\; \left\lceil\, \text{FairPremium}\cdot\bigl(1 + \text{totalLoad}\bigr) \,\right\rceil, \qquad \text{totalLoad} \;=\; \min\!\bigl(\underbrace{\text{baseLoad} + \text{util\_skew} + \text{disp\_skew}}_{\text{raw load}},\ \text{maxLoad}\bigr) $$ The outer `min(..., maxLoad)` is the [I10 clamp](/security/invariants) (`CvammPricing.totalLoadWad`); the round-up is F-#8 (`CvammPricing.premiumFromLoad`). All quantities are WAD-scaled — `1e18 = 1.0 = 100% load`, `1 bps = 1e14 WAD`. The structural premium over fair value, keyed by the `σ_ref` regime (calm / normal / stressed bands) — `CvammPricing.baseLoadWad`. It is motivated by the lone-writer CVaR gap (\~91–100% of MaxIL for a single writer) that diversification collapses (\~78.7% per-contract as N→100). **That gap is the pool's reason to exist.** Flat below a knee, convex above, capped — `CvammPricing.utilSkewWad`. It rises as the pool nears full commitment, pricing marginal capacity **up before over-commitment**. This wires directly into the [run defense](/protocol/vaults): the same locked/free accounting that prices capacity also blocks a withdrawal run. The honest single-pair concentration analogue: many positions bunched at one range edge all hit MaxIL together. Convex, capped — `CvammPricing.dispSkewWad`. The Herfindahl `h` is computed **O(1)** from an incremental `Σ lockedByMarket²` accumulator (`ConvexityVault.concentrationWad`) — no loop over positions. **No primitive is hardcoded.** The `baseLoad` regimes, both skew curves (knee / slope / power / cap), and `maxLoadBps` are read from the calibrated risk-parameter set (cvAMM block) via `LoadParams` (set by the owner through `InflexionCore.setLoadParams`). `fairRate` itself has **no** calibrated coefficients — it is the exact closed form. Hardcoding any load / skew / σ primitive is the exact failure the external audit flagged. ### The I10 cap is by construction **Limit → Why → Mitigation: can the pool overcharge?** * **Limit (apparent):** a pooled algorithmic underwriter that quotes itself could, in principle, mark the price arbitrarily high. * **Why it cannot here:** the raw load is `baseLoad + util_skew + disp_skew`, but the charged load is `min(raw, maxLoad)`. The clamp is a deterministic arithmetic operation in the pricing (READ) phase, strictly **upstream of `settle`** — not a policy or a trust assumption. * **Mitigation (in code):** `premium ≤ FairPremium · (1 + maxLoad)` ([I10](/security/invariants)), and both paths additionally cap the charged premium at MaxIL — *never charge more than the maximum possible payout*. I10 is orthogonal to the [no-bad-debt](/concepts/no-bad-debt) invariant I1: it never touches `settle`, the MaxIL formula, or the payout cap. ## The premium split — 99% to the pool, 1% to the treasury When the premium lands, `_executePathA` splits it: | Cut | Share | Destination | | - | - | - | | `poolCut` | **99%** | accrued into the `ConvexityVault` via `accruePremium` | | `treasuryCut` | **1%** | transferred to the protocol treasury | The 99% pool cut is then split **across tranches** inside the vault by `accruePremium`: $$ \text{toSenior} = \text{poolCut}\cdot\frac{\text{seniorPremiumShareBps}}{10^4}, \qquad \text{toJunior} = \text{poolCut} - \text{toSenior} $$ So the senior tranche behaves like a low-yield "convexity savings account" and the junior tranche is the high-APY vol-seller. `seniorPremiumShareBps` is immutable, sourced from the calibrated risk-parameter set. This tranche split is **unique to Path A** — Path B's split is a flat 99% to the MM / 1% to the treasury, with no tranche allocation. The premium split is **not** part of the settlement guarantee. Neither the tranche split nor the `totalLocked ≤ juniorAssets` senior-protection constraint affects I10 or [`settle`](/protocol/lifecycle) semantics. The premium is the underwriter's reward; the [no-bad-debt clause](/concepts/no-bad-debt) concerns only the LP's payout, paid from locked collateral. ## Signature-free, always available — the floor of liquidity Path A is the answer to three cold-start failure modes that kill quote-driven markets: A pure MM market has **no price until an MM shows up**. The cvAMM always quotes a code-capped fair price for any in-range position in any enabled market. A monopolist early MM could mark prices up. The pool's price is **clamped in code** by I10 — it cannot exceed `FairPremium · (1 + maxLoad)`. Path A needs **no off-chain engine**. The engine [cannot censor Path A at all](/security/trust-model) because Path A does not use it — there is nothing to censor. The dual-tranche design gives depositors a choice: a senior "savings account" or a junior vol-seller. See [tranches](/concepts/tranches). This is what "floor of liquidity" means precisely: **an LP can always get a code-capped fair quote on Path A**, regardless of whether any MM is online, whether the off-chain quote book is live, or whether the [subgraph](/integrate/subgraph) is deployed. The MM rail is a *price-improvement layer* on top of this floor — through [`createSwapRouted`](/protocol/routing), an MM wins only by **strictly beating** the pool, and a bad MM quote silently falls back to Path A without ever reverting. ## Proven live The 2026-06-05 redeploy ran a real create→settle on Path A against a 300s market: * **Path A (swap #1):** V0 **\$270,531.28**, MaxIL **\$1,669.24**, premium **\$9.70 (0.58% of MaxIL)**, realized IL **\$148.64**, payout **\$148.64** — locked and settled entirely from the `ConvexityVault`. The LP received the payout; the pool kept `collateral − payout` (the residual MaxIL) as profit on top of the premium. In the same lifecycle, `createSwapRouted` (swap #2) compared `premiumA_cvamm $13.80` against an MM's `premiumB_mm $8.93` and routed to the MM — the pool is the floor and the MM the ceiling. See [routing](/protocol/routing) for that path. ## The two separate claims The settlement core enforces the LP-facing guarantee identically regardless of rail. On Path A the counterparty is the pool rather than a single MM, but the guarantee is the same: **LPs are always paid with no bad debt in FULL mode — qualified: capped payoff + solvent USDC + oracle/settlement liveness.** The no-bad-debt guarantee is **exact only** under the full clause: * **FULL collateralization** — the underwriter has posted exactly `MaxIL` per swap, locked for the life of the position. * **Capped payoff** — the payout is `min(realized_IL, MaxIL)`. The cap is load-bearing: it is what makes `payout ≤ collateral` hold by construction. * **Solvent USDC** — the collateral numeraire (`dUSDC`) holds its peg and remains redeemable. * **Oracle / settlement liveness** — the price oracle stays live and `settle()` runs within the protocol's settlement window. * **No rehypothecation breach** — locked collateral stays instantly liquid; it is never routed to utilization-gated venues. Stated without these qualifiers, the guarantee is **not** correct. And the capital-at-risk disclosure applies to the pool's depositors — both tranches: **Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.** Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is **at risk**: * **Junior tranche — first-loss.** Junior depositors absorb underwriting losses first and buffer the senior tranche. * **Senior tranche — protected from underwriting loss, exposed to the systemic tail.** The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted. No-bad-debt is a guarantee to the **LP being paid** (see the FULL-mode payout clause), **not** a guarantee that depositor or MM capital is preserved. **Structures ship from day one; the full DYNAMICS (pool-vs-MM spread as a forward-vol signal) mature with multiple competing MMs and volume. The dataset begins at the single redeploy; the off-chain telemetry halves begin at the first interaction logged.** What Inflexion offers today is the **architecture and the first public view** into the microstructure of the DeFi LP volatility-risk premium — not yet a mature dataset: * **Structures are present day-one.** All five non-circular behavioral signals are defined and queryable from launch. * **Dynamics mature with volume.** The richer signal — the pool-vs-MM spread read as a forward-vol indicator — only sharpens once multiple market makers compete and real flow accumulates. * **The dataset begins at the single redeploy**, and the off-chain telemetry halves begin at the first interaction logged. History is served live from the subgraph via the API; if a backing (subgraph URL / RPC / telemetry) is absent, surfaces degrade to a typed `pending` state — never an error. **Network:** Arbitrum Sepolia · **chainId** `421614` · **deploy block** `274081134` (subgraph startBlock) · **deployed** 2026-06-05 ## Core protocol | Contract | Address | Role | | - | - | - | | InflexionCore | `0xC19865cF8403F59B8Eca835833aFEe3Aa8DA4848` | Main entry point — quotes, createSwap, settlement | | ILVault | `0x9f7615Aca943832977CEf3ac1862fD48B87b7664` | Holds LP premiums and protocol IL accounting | | UnderwriterVault | `0x4Fb459F3393D206c2b7faD7f0fC9C35a78348D64` | Market-maker (Path B) collateral deposits | | ConvexityVault | `0xDE2fFeBA2E6A18f3A53D43EC0fCCD299158eC30d` | Pooled cvAMM (Path A) underwriter collateral | | Treasury | `0x96455C9b00D530BD0629b71B674298440328b1Dd` | Protocol fee recipient (also deployer) | ## Stylus & libraries | Contract | Address | Role | | - | - | - | | FairValueOracle (Stylus) | `0x98a6aa75108b70fc0794bc3b87efe0ae99d5d52c` | Rust/WASM fair-premium pricing (set-once init to live VolOracle) | | ILMath | `0x7e90362bc6Df9cb5faA13952e07853ab16c77bd2` | Core impermanent-loss math | | TickMath (library) | `0xbf02bbc82e0fb1a4b9828bb90fc9dd9e97578965` | Tick ↔ sqrtPrice conversions (delegatecall) | | CvammPricing (library) | `0x4a053d29a55a64172140f9ebbc27c321c0ba2b53` | Path-A pool pricing components (delegatecall) | | SwapMath (library) | `0xf7be9745b6768d06a18c386c6db5c8cb065ba314` | Swap math helpers (delegatecall) | | QuoteVerification (library) | `0x74819eed322f3e1a2dc10bb0d3cae50078d90807` | EIP-712 quote signature verification (delegatecall) | ## Oracles | Contract | Address | Role | | - | - | - | | OracleManager | `0x2c18147B6ec75dcb330d9A48B6B96a4d1a8b529b` | Chainlink feed router, staleness & sequencer checks | | VolOracle | `0xfdEafBB381192FC5337499d041eaead04d565Ed9` | Realized-volatility reference (sigma\_ref) | ## Uniswap | Contract | Address | Role | | - | - | - | | UniswapV3Factory | `0x248AB79Bbb9bC29bB72f7Cd42F17e054Fc40188e` | v3 pool factory | | NonfungiblePositionManager | `0x6b2937Bde17889EDCf8fbD8dE31C3C2a70Bc4d65` | LP position NFTs | | SwapRouter02 | `0x101F443B4d1b059569D643917553c771E1b9663E` | Swap routing | | QuoterV2 | `0x2779a0CC1c3e0E44D2542EC3e79e3864Ae93Ef0B` | Off-chain swap quoting | ## Chainlink feeds | Contract | Address | Role | | - | - | - | | ETH / USD | `0xd30e2101a97dcbAeBCBC04F14C3f624E67A35165` | Price feed (8 dec, \~120s heartbeat) | | BTC / USD | `0x56a43EB56Da12C0dc1D972ACb089c06a5dEF8e69` | Price feed (8 dec, \~120s heartbeat) | | ARB / USD | `0xD1092a65338d049DB68D7Be6bD89d17a0929945e` | Price feed (8 dec, 86400s heartbeat) | | USDC / USD | `0x0153002d20B96532C639313c2d54c3dA09109309` | Price feed (8 dec, 86400s heartbeat) | ## Demo tokens / pool / LP | Contract | Address | Role | | - | - | - | | WETH9 | `0x980B62Da83eFf3D4576C647993b0c1D7faf17c73` | Canonical Arbitrum Sepolia WETH (18 dec) | | USDC (Circle) | `0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d` | Circle native testnet USDC (6 dec) | | dWETH (demo) | `0xA8C07E1B245B346c5D1910c5055Efe67bF9E7D1D` | Mock WETH, oracle-priced via Chainlink ETH/USD (18 dec) | | dUSDC (demo) | `0xB89630Dc6e020ae2A84aE72b7d9EEDBDfb2C544d` | Mock USDC numeraire (6 dec) | | Demo pool (dWETH/dUSDC, fee 500) | `0xfE1Eb4D5796a350B13852F822B3E6a9fDbb858a5` | Seeded v3 pool, tokenId 3218 \~\$100k unprotected LP | ## Lifecycle swaps | Contract | Address | Role | | - | - | - | | Market maker (demo signer) | `0xe632B215120dD43A719458487bA3e03638fec953` | Path-B underwriter; deposited 5,000 dUSDC, own collateral paid settlement | Live create→settle lifecycle (2026-06-05, short 300s fee-500 market `0xb8bbd684f213d5833886ade7b531a6949d85522249881a2b5d46a5cc76e439c2`): * **Path A (cvAMM convexity)** — swapId 1, LP tokenId 3220 · V0 \$270,531.28 · MaxIL \$1,669.24 · premium \$9.70 (0.58% of MaxIL) · settled payout \$148.64 from ConvexityVault. * **Path B (MM routing)** — swapId 2, LP tokenId 3221 · MM beat cvAMM (\$8.93 vs \$13.80) · MaxIL \$3,215.65 · MM collateral locked \$3,215.65 · settled payout \$245.66 from MM collateral. ## Where to go next Dual-tranche accounting, the senior-protection invariant, run defense, and premium accrual. baseLoad, util\_skew, disp\_skew, and the I10 clamp — the full math. Firm EIP-712 signed quotes, no last-look — the ceiling of price. `createSwapRouted`: the cheaper of `{pool, MM}`, with non-reverting fallback to Path A. Why MaxIL is both the load-bearing cap and the fungible collateral unit. Create → active → settle, from `registerMarket` to NFT return. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.