Glossary (exhaustive)

Every Inflexion term with its why — product framing, the IL math, MaxIL, pricing and the load stack, the three pillars, the two paths, vaults and tranches, the SignedQuote, settlement, all ten invariants, the two forks, the five data-moat signals, the theory anchors, and the qualified no-bad-debt clause — each cross-linked to its deep page.

This is the exhaustive glossary: every term, every struct field, every invariant, every constant — each with the why it exists and a link to its deep page. It is grouped by concept rather than strictly alphabetical, because almost every term only makes sense in the company of its neighbours.

If you just want the dozen symbols you need before the math (P, MaxIL, fairRate, the tranches), read Concepts at a glance first — it is the fast on-ramp. This page is the reference you come back to.

The groups, in order:

Product framing

The two values & IL math

MaxIL

Pricing & σ_ref

The load stack

The three pillars

Paths & routing

Vaults & tranches

The SignedQuote

Settlement

The ten invariants

The two forks

The data moat

Theory anchors

The qualified clause

---

Product framing

Inflexion · the protocol

A collateralized bilateral derivatives market on Arbitrum One (live on Arbitrum Sepolia, chainId 421614) that lets Uniswap v3 LPs pay a fixed upfront premium to transfer the in-range impermanent-loss risk of a specific position to an underwriter, who posts collateral and is paid for taking the risk. At expiry the protocol pays the LP their realized IL, capped at MaxIL, trustlessly, from the underwriter’s collateral.

In-range convexity hedge · what this is — NOT 'IL insurance'

The product’s true name. Entry requires $P_a \le P_0 \le P_b$ (an out-of-range position is rejected at creation), the payout is $\min(\text{realized\_IL},\,\text{MaxIL})$, and the cap is load-bearing for the no-bad-debt guarantee. Calling it “IL insurance” is both a demand risk (sophisticated LPs discount the truncated tail) and a reputational/regulatory one — every LP surface must show the payoff diagram so the cap never surprises an LP. Full treatment: in-range convexity hedge.

FULL mode · collateral model — the launch mode

Fully collateralized: posted collateral $=$ MaxIL. This is the launch mode and the one carrying the no-bad-debt guarantee. See collateral models.

PARTIAL mode · collateral model — roadmap

A future leverage dial where collateral $<$ MaxIL. Every PARTIAL parameter (floor curve, fee curve, liquidation buffer, circuit-breaker thresholds, exposure caps, first-loss size) must come from the calibrated risk-parameter set — hardcoding any of them is the exact failure the audit flagged. Not live.

European / FULL lifecycle · settlement timing

Settlement happens only at expiry — no early exercise, no mark-to-market margin calls. See the lifecycle.

---

The two values and the IL math

P · price of token0 in token1

The price of the volatile asset in the numéraire — e.g. ETH in USDC. Everything downstream is a function of how P moves.

P0 (entry price) · oracle price at createSwap

The oracle price at createSwap — not the LP’s original mint price. The hedge covers IL accruing from creation onward; any IL borne before that stays the LP’s (entry-snapshot semantics).

P_T (settlement price) · oracle price at expiry T

The price at expiry T, pinned to the Chainlink round active at T to kill settle-timing games. realized_IL is measured at P_T. See price pinning.

Pa, Pb · range bounds (price)

The position’s lower (Pa) and upper (Pb) range bounds. Entry requires $P_a \le P_0 \le P_b$ — an out-of-range position reverts PositionOutOfRange. This is what makes the risk a clean in-range convexity exposure.

L (liquidity) · Uniswap v3 liquidity of the position

Read once at creation and STORED in the SwapRecord; settlement uses the stored L, never re-read from the NFT — so an external increaseLiquidity cannot inflate the payout (invariant I6).

V_hold(T) · value if the LP had just held the entry tokens

$V_{\text{hold}} = \text{amount0}_{\text{entry}}\cdot P_T + \text{amount1}_{\text{entry}}$ — affine (a straight line) in P_T.

V_lp(T) · value of the LP position at P_T

Three regimes: in-range (mixed), below Pa (all token0), above Pb (all token1). Strictly concave in range — and that concavity sitting under the straight V_hold line is exactly what makes IL convex (and therefore priceable like an option).

The loss being hedged is the gap between them:

$$\text{realized\_IL} \;=\; \max\!\big(0,\; V_{\text{hold}}(T) - V_{\text{lp}}(T)\big)$$

realized_IL · the loss being hedged

Always computed as V_hold > V_lp ? V_hold − V_lp : 0 — never an unchecked subtraction, so it can never go negative (invariant I3). The swap covers IL accruing from creation onward; any IL borne before covering stays the LP’s (entry-snapshot semantics). Full derivation: the IL formula.

V0 · position value in the numéraire at entry

The position’s value in token1 at entry, and the capacity unit: Path B capacity (maxNotionalV0) is denominated in V0, not collateral. A dust floor MIN_POSITION_V0 rejects tiny positions.

---

MaxIL — the cap and the unit of risk

This is the single most important term in the protocol — see the MaxIL concept page and its derivation for the full treatment.

MaxIL · max in-range IL of this specific position

$\text{MaxIL} = \max\big(\text{IL}(P_a),\, \text{IL}(P_b)\big)$ — the largest in-range IL the position can suffer. It is pure geometry (computable from Pa, Pb, L, P0), frozen at creation, identical across all three durations, and L-independent in the fair-rate sense. This is what makes positions fungible to an underwriter within a market.

MaxIL wears two hats, both load-bearing:

The load-bearing cap

$\text{covered\_payoff} = \min(\text{realized\_IL},\,\text{MaxIL})$, and $\text{collateral}_{\text{FULL}} = \text{MaxIL} \ge \text{payout}$ by construction — so FULL cannot produce bad debt on any price path. Structural and oracle-independent.

The normalization unit

Pricing as a % of MaxIL makes the underwriter’s return-on-collateral range-width-independent, removing adverse selection against wide ranges and unlocking full depth. The key pricing innovation.

MaxIL is a normalization unit, NOT a risk metric · careful distinction

Two positions with identical MaxIL can carry very different risk (distance-to-edge, delta). Both the pool and MMs price the specific geometry, so MaxIL alone never sets the price.

Why the cap is correct, not a defect · design rationale

Beyond the range the LP is fully rotated into one asset; loss past that point is directional (foregone spot upside), not the impermanent loss being hedged. Capping is what keeps the product fully collateralized and trustless.

MM quote is PER-MARKET, never per-NFT · consequence of fungibility

Because MaxIL makes positions fungible within a market, an MM quotes a load + a MaxIL-ratio band + capacity for a whole market, not a single NFT — the SignedQuote carries no tokenId.

Reference magnitudes for a geometric-symmetric range:

Range	MaxIL as % of V0
±5%	≈ 1.27%
±10%	≈ 2.56%
±20%	≈ 5.23%
±50%	≈ 13.76%

---

Pricing: FairValue, fairRate, FairPremium, σ_ref

The full pricing stack lives at pricing stack and fair value; the closed form is on the Φ-sum page.

fairRate · fraction of MaxIL the claim is worth

$\text{fairRate} = \mathbb{E}_{Q}[\min(\text{IL},\,\text{MaxIL})] \,/\, \text{MaxIL}$ — the fraction of MaxIL the claim is worth under the risk-neutral measure. An S-curve in $\sigma^2 T$ (≈0 calm/short, →1 violent/long). It carries all the vol/time dependence; MaxIL carries none. Exact closed form, no fitted coefficients: the v3 payoff is piecewise (constant / linear-in-P / √P arms split by the two cap-crossing prices), each arm integrated against the GBM density of P_T is a normal-CDF interval moment, so the value is a finite Φ-sum (≈6–10 terms). L-independent — depends only on $a = P_a/P_0$, $b = P_b/P_0$, $\sigma_{\text{ref}}$, T.

FairPremium · fair value of the claim

$\text{FairPremium} = \text{fairRate}\cdot\text{MaxIL}$ — published on-chain by the Stylus FairValueOracle.fairPremium(token, a, b, duration, maxIL), which reads σ_ref via STATICCALL to the VolOracle.

The Φ-sum is NEVER reimplemented off-chain · hard rule

A hard rule: the SDK reads the on-chain FairPremium and never approximates it. The only off-chain duplication permitted is the load math — never fairRate.

σ_ref (reference volatility) · the only stochastic input to fairRate

$\sigma_{\text{ref}} = \max(\sigma_{\text{short}},\, \sigma_{\text{long}},\, \text{floor})$ — a poke-based, time-aware EWMA of Chainlink-tick log-returns over two horizons plus a hard floor, annualised over a 365-day year. Never raw realized σ. Deep page: σ_ref.

Why max(...) and never raw realized σ — the mandatory caveat

Realized vol understates risk right before a regime change — a stale-σ jump is exactly where the book bleeds. The conservative max cannot fall below the slower estimate or the floor, so it never collapses to a deceptively calm number just before a jump. This caveat is mandatory.

Why poke-based

Chainlink rounds are irregular and reading deep history per quote is gas-prohibitive; a permissionless poke keeps an O(1) EWMA. dt is clamped to [minSampleInterval, maxSampleInterval], and poke is a no-op that emits no event when dt < minSampleInterval.

sigmaComponents.binding — which input binds σ_ref

0 = short EWMA, 1 = long EWMA, 2 = floor. This is distinct from the load regime (calm/normal/stressed). At the fresh deploy σ_ref sits at the 0.5e18 floor (fairRate ≈ 0.847 at floor vol).

Scope — what σ_ref is load-bearing for

σ_ref (and the FairValueOracle) is solvency-load-bearing for the I10 cap and depositor solvency — a wrong σ mis-prices the load and compresses NAV. It is NOT load-bearing for the FULL no-bad-debt invariant I1, which is structural and oracle-independent.

---

The load stack

The cvAMM’s charge over fair value. The full curves live at the load stack and pricing stack.

$$\text{premium} = \text{FairPremium}\cdot\big(1 + \text{baseLoad} + \text{util\_skew} + \text{dispersion\_skew}\big)$$ $$\text{hard-capped at}\quad \text{FairPremium}\cdot(1 + \text{maxLoad}) \quad\text{(invariant I10)}$$

load / totalLoad · the multiplier over FairPremium

$\text{totalLoadWad} = \min(\text{baseLoad} + \text{util\_skew} + \text{dispersion\_skew},\ \text{maxLoad})$ — the I10 clamp.

baseLoad · the structural volatility-risk premium

The structural premium over fair value, banded by σ_ref regime (calm/normal/stressed). Motivated by the lone-writer CVaR gap: a single position’s CVaR95 sits at ~91–100% of MaxIL, so an uncharged writer is badly underpriced; diversification collapses the gap (~100% → 78.7% as N:1 → 100). The pool charges baseLoad — that gap is its reason to exist.

util_skew · utilization skew

$\text{util\_skew}$ rises with $\text{locked}/(\text{locked} + \text{free})$ as the pool nears full commitment — flat below a knee, convex above, capped. Wires into the withdrawal-delay / locked-free run defense.

dispersion_skew · concentration skew

Rises as outstanding coverage clusters in one width / moneyness / duration corner (the honest single-pair analogue of concentration risk — many bunched positions all hit MaxIL together in one move). A well-dispersed book is charged less.

Regime (calm / normal / stressed) · the load regime

The load regime, derived from σ_ref vs the loadParams bands. Distinct from sigmaComponents.binding.

maxLoad / maxLoadBps · the I10 ceiling

The I10 ceiling — the same value as a rate (maxLoad) or in basis points (maxLoadBps) on-chain.

Path-B premium · MM quote premium formula

$\text{premium}_B = \lceil \text{FairPremium}\cdot(1 + \text{loadBps}/10^4)\rceil$, capped at MaxIL, requiring $\text{loadBps} \le \text{maxLoadBps}$ (I10 on Path B). Premiums round UP.

All load / skew / σ primitives come from the calibrated risk-parameter set (the cvAMM block); none is hardcoded.

• Why this matters: hardcoding any PARTIAL or load primitive is the exact failure the external audit flagged — calibrated constants drift away from the regime they were fit to, and a stale constant mis-prices risk.
• The mitigation: the cvAMM load block is read from the Monte-Carlo-produced parameter set, and fairRate itself has no calibrated coefficients at all — it is a pure closed form.

---

The three pillars

The architecture, in full at the three pillars.

1. On-chain published FairValue (Pillar 1)

   The exact closed-form Φ-sum, never reimplemented off-chain; the Stylus FairValueOracle is production. The single shared price both rails build on. See fair value.

2. The cvAMM pool (Pillar 2 — Path A)

   ConvexityVault, a dual-tranche ERC-4626 pooled passive underwriter that quotes algorithmically on-chain off FairPremium with inventory skews — always-on, signature-free, I10-capped. The floor of liquidity. See Path A.

3. MM competition (Pillar 3 — Path B)

   Sophisticated MMs compete via firm EIP-712 signed quotes below the pool, no last-look. The ceiling of price. Two load-bearing reasons: hedged MMs export short-gamma risk out of the system (a closed pool just circulates ETH short-gamma against itself); forward-vol MMs correct the pool’s backward-looking σ_ref bias. See Path B.

---

Paths and routing

The routing model, in full at routing and two rails.

Path A (cvAMM, default, signature-free) · createSwapPathA

Reads FairPremium + pool inventory, applies the I10 load stack, locks ConvexityVault collateral, and splits the premium across tranches. No keeper, no signed quote, no validity clock, no relayer.

Path B (MM signed quotes) · createSwap

An MM posts collateral + signs a quote below the pool; the LP can take it. Carries the full signed-quote rail (validUntil, priceBandBps, bitmap nonces, the Fork-2 band defense, I9). The premium is derived on-chain from FairPremium as $\text{FairPremium}\cdot(1 + \text{loadBps})$; on Path B the premium goes entirely to the MM (no tranche split).

createSwapRouted · the cheaper-of router

Routes the LP to the cheaper of {pool, valid MM quote}, both priced off the same on-chain FairPremium (a single VolOracle poke). The MM wins only if it strictly beats the pool; a tie resolves to Path A. An absent / expired / stale / over-band / over-load / zero-price MM quote falls back to the pool — never reverts. Only the executed rail mutates nonce / capacity / lock (so I7 holds).

---

Vaults and tranches

The vault model, in full at vaults and tranches.

ConvexityVault · the Path-A pooled underwriter

One vault per pair, backing all 9 markets with fungible USDC and quoting a separate price into each market — one insurer’s treasury backing 9 product lines. Dual-tranche (senior/junior) from launch.

UnderwriterVault · per-MM Path-B collateral

Per-MM collateral home: deposited / locked / available = deposited − locked. lockCollateral runs at match (never in the quote payload); releaseAndDistribute runs at settle.

Senior tranche · Tranche enum value 0

Base yield plus a small premium slice (seniorPremiumShareBps), structurally protected from underwriting loss while junior buffers — a “convexity savings account.” Protected, not risk-free.

Junior tranche · Tranche enum value 1

Captures most of the load for a high APY, but is first-loss and unhedged — it bears the entire underwriting tail. A “pure vol-selling tranche.”

Structural senior protection · totalLocked ≤ juniorAssets

Enforced at every lockCollateral. Since every payout $\le$ its MaxIL $=$ its locked amount, $\sum \text{payouts} \le \text{totalLocked} \le \text{juniorAssets}$ — so junior absorbs all underwriting loss before senior is touched.

sf = 0.60 (P1.13) · target tranche ratio, NOT a hard cap

The target senior fraction for UX/incentives — not a structural cap. Senior $P(\text{loss}) = 0$ is the calibration result (it holds while utilization $u \le 1 - sf$), not a structural guarantee.

Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.

Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is at risk:

• Junior tranche — first-loss. Junior depositors absorb underwriting losses first and buffer the senior tranche.
• Senior tranche — protected from underwriting loss, exposed to the systemic tail. The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted.

No-bad-debt is a guarantee to the LP being paid (see the FULL-mode payout clause), not a guarantee that depositor or MM capital is preserved.

Two guarantees, NEVER merged · the central distinction

(A) LPs are always paid (no bad debt in FULL — structural, code-enforced I1); (B) depositors can lose principal. Both true; neither implies the other. See no-bad-debt.

Real P1.13 single-asset numbers · bare pool, u = 0.40

3y CAGR 122% median / 50% p10 / 247% p90; P(losing month) 26.5%; 1-in-100 month −20.1%; worst month −26.8%. Senior (sf = 0.60): P(loss) = 0 / worst 0%; junior worst −67%.

Idle-only yield (hard rule) · rehypothecation constraint

Locked collateral must stay instantly liquid — never routed to utilization-gated venues (Aave / Compound). Only idle/free capital may go to instantly-redeemable wrappers (sDAI / tokenized T-bills), with a hard cap and a nude-USDC buffer. See immutability & custody.

---

The SignedQuote (Path B, EIP-712)

The full signing flow lives at quote signing.

The SignedQuote struct fields:

Field	Type	What it carries
mm	address	the market maker / signer
marketId	bytes32	the market (per-market, never per-NFT)
loadBps	uint	the MM’s load over FairPremium
minMaxILRatioBps / maxMaxILRatioBps	uint	optional convenience filter on the MaxIL ratio
quotePrice	uint	the oracle price at signing — the band anchor
priceBandBps	uint	the Fork-2 band: auto-void if live oracle drifts beyond it
model	CollateralModel	FULL at launch
partialRatioBps	uint	0 in FULL
maxNotionalV0	uint	capacity, denominated in V0
validUntil	uint	latency clock (see below)
quoteId	bytes32	capacity / replay key
nonce	uint	Permit2-style bitmap

SIGNED_QUOTE_TYPEHASH · EIP-712 type hash

The keccak of the full type string with loadBps in struct order. Verification is OZ SignatureChecker.isValidSignatureNow, which supports EIP-1271 contract signers (e.g. a vault as signer).

validUntil · latency control, default now + 8s, band [5s, 15s]

Protocol-enforced to [5s, 15s]. A latency control (not risk-capital), bounding how long a bearer signed quote survives in observer hands.

priceBandBps + quotePrice (Fork-2 band) · oracle-anchored auto-void

The quote auto-voids on-chain if the live oracle drifts beyond priceBandBps from quotePrice. Firm quotes, NO last-look — all protection is deterministic on-chain.

Bitmap nonce (Permit2-style, word<<8 | bit) · selective cancel

Selective cancel of one quote, never cancel-all; batchable.

quoteId / consumedNotional · capacity authority

createSwap requires $\text{consumedNotional}[\text{quoteId}] + V_0 \le \text{maxNotionalV0}$, then increments atomically (replay / double-spend defense). On-chain authoritative; the off-chain engine is advisory only.

---

Settlement and the SwapRecord

In full at the lifecycle and price pinning.

Status enum · SwapRecord lifecycle

0 = UNINITIALIZED, 1 = ACTIVE, 2 = SETTLED.

settle · callable by anyone at expiry

Callable by anyone once block.timestamp ≥ expiry. Strict CEI: status flips to SETTLED first, then interactions — see CEI & reentrancy.

OracleManager settle path (getSettlementPrice) · price pinning

The settlement price is pinned to the Chainlink round active at expiry T (kills settle-timing games), gated by sequencer health + staleness + a lone-spike sanity check; the Uniswap TWAP is advisory-only (emitted, never reverts).

Settlement constants:

Constant	Value	Role
GRACE_PERIOD	3,600 s	settle grace after the window
MAX_STALENESS	90,000 s	max feed staleness (works on testnet ~120s and mainnet 86,400s feeds)
LONE_SPIKE_BPS	500 (5%)	lone-spike sanity threshold
LIVENESS_WINDOW	86,400 s (24h)	settlement-liveness backstop (Fork 1 / I8)
TWAP_WINDOW	1,800 s	advisory Uniswap TWAP window
MAX_DEVIATION_BPS	200 (2%)	advisory TWAP-vs-Chainlink deviation

---

The ten invariants

The never-break list, in full at the invariants.

#	Name	Statement
I1	No bad debt (FULL)	payout ≤ collateral == MaxIL. Qualified clause: capped payoff + locked collateral + solvent USDC + oracle/settlement liveness + no rehypothecation breach.
I2	Cap correctness	payout == min(realized_IL, MaxIL).
I3	Non-negativity / no underflow	realized_IL = V_hold > V_lp ? V_hold − V_lp : 0 — never an unchecked subtraction.
I4	LP never profits	V_lp ≥ V_hold ⟹ payout == 0. A hedge, not a lottery.
I5	Vault solvency	locked ≤ deposited per MM (and for the pool); Σ locked fully backed.
I6	Liquidity immutability	settlement uses L stored at creation, never re-read; increaseLiquidity cannot inflate payout.
I7	Capacity authority	consumedNotional[quoteId] ≤ maxNotionalV0; a cancelled bitmap-nonce bit cannot fill.
I8	Settlement liveness (Fork 1)	settle() always succeeds within expiry + LIVENESS_WINDOW + MAX_STALENESS + GRACE_PERIOD.
I9	Band enforcement (Fork 2)	createSwap reverts iff absBps(P_live, quote.quotePrice) > quote.priceBandBps (Path B only).
I10	Price cap (launch)	premium ≤ FairPremium · (1 + maxLoadBps) on both paths — by construction, upstream of settle. Does not touch settle / MaxIL / I1–I9.

---

The two forks

The two audit-resolved deadlock/pickoff classes, in full at the forks.

Fork 1 — oracle settlement deadlock · resolved (Option B)

The v3.1 hard-TWAP gate could permanently lock funds. Replaced by Chainlink round-at-T pinning + a lone-spike check + advisory-only TWAP + a 24h liveness backstop, so settle can never deadlock (I8).

Fork 2 — no-last-look quote pickoff · resolved (Option B, Path B only)

A bearer signed quote could be picked off after an oracle gap. Resolved by the oracle-anchored price band (auto-void if drift > priceBandBps) + short validUntil + on-chain selective nonce invalidation — all deterministic, NOT last-look (I9).

---

The data moat (five behavioral signals)

The first public view into the microstructure of the DeFi LP volatility-risk premium — non-circular, actor-driven. In full at the five signals and circular vs behavioral.

Signal 1 — Realized clearing LOAD over a transparent σ_ref · non-circular (the structural baseline)

Bucketed by width × distance-to-edge × duration (cap-bound fills excluded). Pool load = mechanical baseline (SwapPriced.totalLoadWad); MM load (QuoteFilled.loadBps) = the behavioral signal. The circular “invert fairRate for an implied-vol surface” claim is DROPPED — charged/MaxIL = $\text{fairRate}(\sigma_{\text{ref}})\cdot(1+\text{load})$ only recovers our own σ_ref + dealer load. See circular vs behavioral.

Signal 2 — Pool-vs-MM load spread + MM win-rate · behavioral (a forward-vol read)

The MM prices implied/forward vol; the pool prices backward-looking σ_ref. The spread between them is the forward-vol read. Dynamic with ≥3 MMs.

Signal 3 — Term structure of convexity · behavioral (the MM slope)

The MM loadBps slope across 7/30/90d per range. The Path-A load is duration-independent/mechanical, so the slope is the MM signal.

Signal 4 — Moneyness / demand skew · behavioral (realized + latent)

The realized on-chain half plus the latent/unfilled half via off-chain engine telemetry (DEMAND_LOG). See telemetry.

Signal 5 — Net convexity / gamma supply · behavioral (the active-set aggregate)

Off-chain Greeks summed over the active set (the GreeksEngine over the subgraph). See greeks & hedge.

Honest framing of the moat (mandatory).

• The limit: the clearing load is contaminated — it bundles liquidity, smart-contract risk, capital-lock, and inventory-skew premia — and the dynamic/latent halves are thin until MM and flow volume grow; the on-chain half (signals 1/2/3/5) begins only at the single subgraph redeploy.
• Why: these are real-world microstructure quantities that mature with participation, not synthetic data we can backfill.
• The mitigation / path-forward: the value is in the architecture of the moat. The structures exist day-one; you trade the SPREAD, not the level (the spread cancels the shared contamination); and the latent halves accrue with volume.

Structures ship from day one; the full DYNAMICS (pool-vs-MM spread as a forward-vol signal) mature with multiple competing MMs and volume. The dataset begins at the single redeploy; the off-chain telemetry halves begin at the first interaction logged.

What Inflexion offers today is the architecture and the first public view into the microstructure of the DeFi LP volatility-risk premium — not yet a mature dataset:

• Structures are present day-one. All five non-circular behavioral signals are defined and queryable from launch.
• Dynamics mature with volume. The richer signal — the pool-vs-MM spread read as a forward-vol indicator — only sharpens once multiple market makers compete and real flow accumulates.
• The dataset begins at the single redeploy, and the off-chain telemetry halves begin at the first interaction logged. History is served live from the subgraph via the API; if a backing (subgraph URL / RPC / telemetry) is absent, surfaces degrade to a typed pending state — never an error.

---

Theory anchors

Cite, do not re-derive — the on-chain pricer is the exact Φ-sum, not these. In full at theory anchors.

Lipton, Lucic & Sepp (2025) · static replication anchor

An IL-protection claim is statically replicable by a strip of vanilla options ⇒ model-light fair value + a concrete hedge.

Milionis, Moallemi & Roughgarden (2022) — LVR · cost-of-gamma anchor

The AMM’s adverse-selection cost has a closed form proportional to instantaneous variance (= the theta of the replicating short-option position) ⇒ a closed-form anchor for the cost of short-gamma exposure.

These are theory anchors for why the claim is priceable and hedgeable — not the on-chain pricer. The exact Φ-sum is.

---

The qualified no-bad-debt clause

Never state no-bad-debt unqualified. The full clause:

No-bad-debt is exact only under: FULL collateralization + capped payoff + solvent USDC + oracle/settlement liveness + no rehypothecation breach.

LPs are always paid with no bad debt in FULL mode — qualified: capped payoff + solvent USDC + oracle/settlement liveness.

The no-bad-debt guarantee is exact only under the full clause:

• FULL collateralization — the underwriter has posted exactly MaxIL per swap, locked for the life of the position.
• Capped payoff — the payout is min(realized_IL, MaxIL). The cap is load-bearing: it is what makes payout ≤ collateral hold by construction.
• Solvent USDC — the collateral numeraire (dUSDC) holds its peg and remains redeemable.
• Oracle / settlement liveness — the price oracle stays live and settle() runs within the protocol’s settlement window.
• No rehypothecation breach — locked collateral stays instantly liquid; it is never routed to utilization-gated venues.

Stated without these qualifiers, the guarantee is not correct.

A σ_ref / vol-oracle fault can cost depositors money (bad pricing — junior first, then senior in the tail) but can never create LP bad debt in FULL: I1 is structural and oracle-independent. This is exactly why the two guarantees are never merged.

---

Where to go next

Concepts at a glance

The fast on-ramp — the dozen symbols you need before the math.

The deployments registry

Live Arbitrum Sepolia addresses, the single source of truth.

The ten invariants

The never-break list, each with its statement and rationale.

The math overview

The IL formula, the Φ-sum, the load stack — with worked numbers.