Quickstart — pick your door

Four ways into Inflexion: protect an LP position, earn in the cvAMM, underwrite as a market maker, or integrate the SDK, API, and subgraph. Each links into its full path.

Inflexion is a collateralized bilateral derivatives market on Arbitrum One — live on Arbitrum Sepolia (chainId 421614). A Uniswap v3 LP pays a fixed upfront premium to transfer the in-range impermanent-loss risk of a specific position to an underwriter, who posts collateral and is paid for taking the risk. At expiry the protocol pays the LP $\min(\text{realized\_IL},\ \text{MaxIL})$, trustlessly, from the underwriter’s collateral.

This is an in-range convexity hedge, not “IL insurance” — entry requires $P_a \le P_0 \le P_b$, and the cap is load-bearing for the no-bad-debt guarantee.

The app — like this guide — has three doors mapping to the three actors, plus a fourth for builders. Pick yours.

Pick your door

Protect an LP position

You hold a Uniswap v3 LP NFT and want to hedge its in-range IL. Pay one premium; get paid min(IL, MaxIL) at expiry from pre-locked collateral. LP / claim A.

Earn in the cvAMM

Deposit dUSDC into the pooled ConvexityVault and earn the volatility-risk premium. Pick a tranche — senior (low-variance) or junior (first-loss, high APY). Depositor / claim B.

Underwrite as a market maker

Post collateral, stream firm EIP-712 signed quotes per-market, and win flow only by undercutting the always-on pool. No last-look. MM / claim B.

Integrate

Build on the protocol: the SDK (LP / depositor / MM / data clients), the REST API, and the subgraph. Reads are graceful; addresses load from the on-chain address registry.

New to the terminology? The glossary primer defines MaxIL, fairRate, σ_ref, the two rails, and the load stack in one place. The three pillars page is the conceptual spine — read it before anything else.

Before you start — prerequisites

These apply to every door that writes to the chain (Protect, Earn, Underwrite). Read-only doors — the markets browser and the data moat — need no wallet at all. Full detail lives on App prerequisites.

1. Connect a wallet on Arbitrum Sepolia (chainId 421614)

   Every dApp page gates its write actions behind a ConnectGate — reads work immediately, writes need a connected wallet. The stack is RainbowKit + wagmi + viem.

2. Get demo tokens — dUSDC and dWETH

   You need dUSDC (the 6-decimal numéraire, for premiums and collateral) and dWETH (the 18-decimal demo volatile token). These are the protocol’s own demo mocks — a numéraire-correct pair where dWETH < dUSDC so token1 = dUSDC is the numéraire — distinct from Circle’s testnet USDC/WETH. Addresses are in the deployments registry — never hardcode them.

3. (To protect) hold an eligible, in-range v3 position

   To have a position to hedge, mint a Uniswap v3 NFT on the seeded dWETH/dUSDC pool (fee 500) that is currently in range ($P_a \le P_0 \le P_b$). The deploy seeded a ~$100k unprotected demo LP (tokenId 3218) used for previews and the illustrative /underwrite pricing. Out-of-range positions are rejected at creation.

Live deployment. Fresh full redeploy on 2026-06-05 (replaces the 2026-06-03 stack). All addresses load from the on-chain address registry via @inflexion/sdk — the app never hardcodes them. See the address table for the full registry.

Optional backends — degradation is honest if absent

Path B (the MM rail) and history surfaces lean on optional backends. If they’re not configured, the app does not crash — it falls back honestly to what RPC alone can serve.

Service	Env var	If unset
Path-B engine (MM quote relay)	NEXT_PUBLIC_ENGINE_URL	Path B unavailable → preview falls back to Path A only; premiumB undefined
Public REST API (history)	NEXT_PUBLIC_API_URL	DataClient history surfaces return { available: false } pending
RPC	NEXT_PUBLIC_RPC_URL	no RPC; all reads fail at the transport layer

The subgraph is deployed and indexing — history and aggregate surfaces are live.

The subgraph is deployed on The Graph Studio (slug inflexion-arb-sepolia), indexing on-chain history from the redeploy block 274081134 — including the lifecycle swaps. Everything historical or aggregate (per-market volume, NAV history, the time-series data-moat signals, precise MM fill attribution) is served live from the subgraph via the hosted REST API.

Live over RPC: premium preview, payoff, buy/settle (Path A), vault deposit/withdraw, market pricing, the current clearing-load surface, σ_ref, the book, and coarse fills. Live over the API + subgraph: per-market history, NAV history, and the time-series data-moat signals. If a backing (subgraph URL, RPC, or telemetry) is unset, the corresponding surface degrades to a typed pending state that names the exact API route it will be served from — never a fake number, never a thrown error. See status & caveats for the full ledger.

Door 1 — Protect an LP position

The shortest path from “I have an LP NFT” to “my in-range IL is hedged.” Full walkthrough: the Protect page guide.

1. Pick the market and your position

   Choose a fee tier (0.05% / 0.30% / 1.00%) and duration (7d / 30d / 90d) — 9 markets in all. Your eligible in-range positions list via lp.listEligiblePositions(owner, ...); each row shows its tokenId, an in-range badge, V0, MaxIL (the cap), and stored L.

2. Preview the premium and read the payoff-with-cap chart

   lp.previewPremium(tokenId, marketId) returns { maxIL, fairPremium, fairRateWad, sigmaRefWad, premiumA, premiumB?, best, path }. You see Path A · pool vs Path B · MM side by side, the on-chain Φ-sum fair premium as the floor, and σ_ref. The chart draws your payout min(IL, MaxIL) (teal) against true IL (dashed red), capped at the amber MaxIL line.

3. Buy — one click, auto-approve, routed

   lp.buyProtection({ tokenId, marketId, maxPremium, approve: true }) auto-approves the NFT to Core and dUSDC to InflexionCore, then sends createSwapRouted — which picks the cheaper of pool vs MM and never reverts on a bad MM quote (it falls back to the pool). A 1% slippage buffer caps the premium sent.

4. Settle at expiry

   Once the swap is expired, lp.settle(swapId) walks the Chainlink feed for the bracketing round and pays your realized IL — capped at MaxIL — from the underwriter’s collateral, returning the NFT to you.

Protect: preview then buy

import { InflexionSdk } from "@inflexion/sdk";

const sdk = new InflexionSdk({ chainId: 421614, /* publicClient, walletClient */ });

// 1. Preview — reads the on-chain FairPremium and routes pool vs MM.
const preview = await sdk.lp.previewPremium(3218n, marketId);
console.log(preview.best, preview.path); // cheaper premium, "A" | "B"

// 2. Buy — auto-approves NFT + dUSDC, then createSwapRouted (1% slippage).
const maxPremium = (preview.best * 101n) / 100n;
const res = await sdk.lp.buyProtection({
  tokenId: 3218n,
  marketId,
  maxPremium,
  approve: true,
});

Live lifecycle (ran on-chain, 2026-06-05): Path A swap #1 — V0 $270,531, MaxIL $1,669.24, premium $9.70 (0.58% of MaxIL), realized IL $148.64 paid in full from the ConvexityVault. Path B swap #2 — the MM beat the pool ($8.93 vs $13.80), locked $3,215.65 of its own collateral, and settled $245.66 from the UnderwriterVault. This is the floor/ceiling routing, demonstrated.

LPs are always paid with no bad debt in FULL mode — qualified: capped payoff + solvent USDC + oracle/settlement liveness.

The no-bad-debt guarantee is exact only under the full clause:

• FULL collateralization — the underwriter has posted exactly MaxIL per swap, locked for the life of the position.
• Capped payoff — the payout is min(realized_IL, MaxIL). The cap is load-bearing: it is what makes payout ≤ collateral hold by construction.
• Solvent USDC — the collateral numeraire (dUSDC) holds its peg and remains redeemable.
• Oracle / settlement liveness — the price oracle stays live and settle() runs within the protocol’s settlement window.
• No rehypothecation breach — locked collateral stays instantly liquid; it is never routed to utilization-gated venues.

Stated without these qualifiers, the guarantee is not correct.

Door 2 — Earn in the cvAMM

Supply underwriting capital to the pooled ConvexityVault and earn the volatility-risk premium. You choose your risk dose. Full walkthrough: the Earn page guide.

1. Read the disclosure — it's first, not a footnote

   The very first panel on /earn is “Capital is NOT guaranteed.” You are underwriting in-range IL: junior is first-loss; senior is protected from underwriting loss only (via the junior-first waterfall totalLocked ≤ juniorAssets), not from the systemic tail.

2. Pick a tranche

   Senior — a low-variance “convexity savings account,” structurally shielded from underwriting loss while junior buffers. Junior — a pure vol-selling tranche that captures most of the premium yield and absorbs losses first. See tranches.

3. Deposit

   depositor.deposit(tranche, raw, { autoApprove: true }) checks allowance, sends dUSDC approve(convexityVault, amount) — spender is the ConvexityVault, not Core (a common gotcha) — then deposit(tranche, amount).

4. Withdraw — request, cooldown, withdraw

   Withdrawals are two-step and cooldown-gated: requestWithdrawal(tranche, shares), then after the cooldown withdraw(tranche). A junior withdraw can revert JuniorBelowLocked if it would breach senior protection while collateral is locked.

Earn: deposit into the junior tranche

import { InflexionSdk, Tranche } from "@inflexion/sdk";

const sdk = new InflexionSdk({ chainId: 421614, /* publicClient, walletClient */ });

// Spender is the ConvexityVault — NOT InflexionCore.
await sdk.depositor.deposit(Tranche.Junior, 5_000_000_000n /* 5,000 dUSDC */, {
  autoApprove: true,
});

// Withdraw is two-step + cooldown-gated.
await sdk.depositor.requestWithdrawal(Tranche.Junior, shares);
// ...wait out getWithdrawalCooldown()...
await sdk.depositor.withdraw(Tranche.Junior);

Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.

Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is at risk:

• Junior tranche — first-loss. Junior depositors absorb underwriting losses first and buffer the senior tranche.
• Senior tranche — protected from underwriting loss, exposed to the systemic tail. The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted.

No-bad-debt is a guarantee to the LP being paid (see the FULL-mode payout clause), not a guarantee that depositor or MM capital is preserved.

Door 3 — Underwrite as a market maker

Compete with the pool by streaming firm signed quotes that win only by undercutting it. The MM rail is the ceiling of price; the pool is the floor of liquidity. Full walkthrough: the Underwrite page guide.

1. Post collateral to the UnderwriterVault

   A separate, direct on-chain flow: ERC-20 approve(UnderwriterVault, amount) then UnderwriterVault.deposit(amount). Locked == Σ MaxIL of your active fills; invariant I5 holds locked ≤ deposited. Collateral must stay instantly liquid — never route it to utilization-gated venues.

2. Build a PER-MARKET quote — there is no tokenId

   A quote is per-market, not per-position: it fills any in-range position in the market whose MaxIL/V0 ∈ [min, max] bps, up to capacity. Because MaxIL is the unit of risk, positions are fungible — the SignedQuote carries no tokenId. Set your load (bps over FairPremium), a price band (Fork 2), capacity (maxNotionalV0), and a validity window.

3. Stay under the pool and under the I10 cap

   Your loadBps must be strictly below the live pool load AND ≤ maxLoadBps (invariant I10). A guard banner blocks signing otherwise; the page re-reads both fresh right before you sign.

4. Sign (EIP-712) and publish

   The browser signs the 13-field SignedQuote struct via walletClient.signTypedData (domain { 'Inflexion', '1', 421614, core.inflexionCore }) — the field order must match InflexionCore.SIGNED_QUOTE_TYPEHASH exactly. It’s POSTed to the engine; if the engine URL is unset, the page renders the exact wire envelope instead. See quote signing.

Firm quotes, no last-look. There is no “last look” path in MM quoting — firm quotes plus an oracle band only. createSwapRouted routes the LP to the cheaper rail and only the executed rail mutates nonce, capacity, and lock. An absent or stale MM quote silently routes to the pool.

Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.

Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is at risk:

• Junior tranche — first-loss. Junior depositors absorb underwriting losses first and buffer the senior tranche.
• Senior tranche — protected from underwriting loss, exposed to the systemic tail. The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted.

No-bad-debt is a guarantee to the LP being paid (see the FULL-mode payout clause), not a guarantee that depositor or MM capital is preserved.

Door 4 — Integrate (SDK, API, subgraph)

Build LP, depositor, MM, or data surfaces on top of the protocol. Start at the SDK overview; for the data plane see the architecture.

SDK — @inflexion/sdk

Typed clients: lp, depositor, mm, data, plus Greeks/hedge and the cvAMM TS port. Addresses and units in addresses & units.

REST API

The public history plane, hosted at inflexion-backend.onrender.com. Endpoints serve per-market history, NAV, and the data-moat signals live from the subgraph.

Subgraph

The Graph indexes SwapPriced / QuoteFilled and the lifecycle events. See marketId parity so your off-chain ids match the chain exactly.

Engine & recipes

The off-chain matching relayer (engine), quote signing, and end-to-end recipes.

Construct the SDK (reads work with no wallet)

import { InflexionSdk } from "@inflexion/sdk";
import { createPublicClient, http } from "viem";
import { arbitrumSepolia } from "viem/chains";

const publicClient = createPublicClient({
  chain: arbitrumSepolia,
  transport: http(process.env.NEXT_PUBLIC_RPC_URL),
});

// Reads are graceful and never throw; addresses load from the registry.
const sdk = new InflexionSdk({ chainId: 421614, publicClient });

const surface = await sdk.data.getCurrentLoadSurface({ markets });

Reads degrade, never crash. Any read needing a reverting oracle, an absent rich event, or an unconfigured backing returns a typed { available: false } / { priceable: false } envelope and renders an honest pending state — never an error. For the full behavior see SDK degradation and guardrails.

Structures ship from day one; the full DYNAMICS (pool-vs-MM spread as a forward-vol signal) mature with multiple competing MMs and volume. The dataset begins at the single redeploy; the off-chain telemetry halves begin at the first interaction logged.

What Inflexion offers today is the architecture and the first public view into the microstructure of the DeFi LP volatility-risk premium — not yet a mature dataset:

• Structures are present day-one. All five non-circular behavioral signals are defined and queryable from launch.
• Dynamics mature with volume. The richer signal — the pool-vs-MM spread read as a forward-vol indicator — only sharpens once multiple market makers compete and real flow accumulates.
• The dataset begins at the single redeploy, and the off-chain telemetry halves begin at the first interaction logged. History is served live from the subgraph via the API; if a backing (subgraph URL / RPC / telemetry) is absent, surfaces degrade to a typed pending state — never an error.

Where to go next

The three pillars

On-chain FairValue, the cvAMM, and MM competition — the conceptual spine.

MaxIL

The cap and the unit of risk, in one concept.

The two rails

How Path A and Path B share one settlement core.

The math overview

IL, MaxIL, the Φ-sum, σ_ref, and the load stack.

Security & invariants

The nine never-break invariants, with proofs.

What this is NOT

Not Bancor, not insurance, not GammaSwap — and why.