Skip to main content
The fastest way to mis-sell Inflexion — to an LP or a depositor — is to reach for a familiar analogy that does not fit. This page draws the perimeter precisely. Each distinction is framed the same way: what we are not → why that thing exists → what we do instead. A naked “we’re not X” is useless; the value is in the mechanism that replaces it. It also fixes the one framing error that does real damage: collapsing the two guarantees Inflexion makes into one. Claim A — LPs are always paid in FULL mode — and Claim B — depositor and MM capital is not guaranteed — are separate claims. They are both true; neither implies the other; merging them is a defect.
Inflexion is an in-range convexity hedge: a European, fixed-maturity, in-range claim that pays min⁡(realized IL, MaxIL)\min(\text{realized IL},\ \text{MaxIL}) from pre-locked collateral. Entry requires Pa≤P0≤PbP_a \le P_0 \le P_b — out-of-range positions are rejected at creation. For the positive definition, start at the three pillars and MaxIL.

​
The two claims, kept separate

This is the load-bearing distinction on the whole page, so it comes first.

Claim A — LPs are always paid

In FULL mode, an LP’s covered position pays out with no bad debt — qualified by the full clause (capped payoff + solvent USDC + oracle/settlement liveness + no rehypothecation breach). This is structural and code-enforced by invariant I1.

Claim B — depositor capital is at risk

The cvAMM is a volatility seller. Depositor and MM capital is not guaranteed for either tranche — junior is first-loss, senior is protected from underwriting loss only, never from the systemic tail.
Never merge Claim A and Claim B. “No bad debt” is a guarantee to the LP being paid — it says nothing about whether the underwriter’s capital survives. A wrong σref\sigma_{\text{ref}} can cost depositors money (bad pricing → NAV compression → junior absorbs first, senior in the tail) but can never create LP bad debt in FULL, because collateral == MaxIL ≥\ge payout by construction, regardless of what σ\sigma was. These are two guarantees, not one.
The disclosures below are the canonical wording for each claim. Use them verbatim wherever the claims appear.
LPs are always paid with no bad debt in FULL mode — qualified: capped payoff + solvent USDC + oracle/settlement liveness.The no-bad-debt guarantee is exact only under the full clause:
  • FULL collateralization — the underwriter has posted exactly MaxIL per swap, locked for the life of the position.
  • Capped payoff — the payout is min(realized_IL, MaxIL). The cap is load-bearing: it is what makes payout ≤ collateral hold by construction.
  • Solvent USDC — the collateral numeraire (dUSDC) holds its peg and remains redeemable.
  • Oracle / settlement liveness — the price oracle stays live and settle() runs within the protocol’s settlement window.
  • No rehypothecation breach — locked collateral stays instantly liquid; it is never routed to utilization-gated venues.
Stated without these qualifiers, the guarantee is not correct.
Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is at risk:
  • Junior tranche — first-loss. Junior depositors absorb underwriting losses first and buffer the senior tranche.
  • Senior tranche — protected from underwriting loss, exposed to the systemic tail. The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted.
No-bad-debt is a guarantee to the LP being paid (see the FULL-mode payout clause), not a guarantee that depositor or MM capital is preserved.

​
Not Bancor — the single most important “not”

This is the comparison most people reach for, and it is the one that most badly misrepresents the design.
1

Limit — Bancor's IL protection was the canonical failure

Bancor v2.1 offered “impermanent-loss protection,” and it is the reference point everyone has in mind when they hear “hedge IL on-chain.” Inflexion is not that, and the difference is mechanical, not cosmetic.
2

Why it failed — protection funded by token inflation

Bancor covered losses by minting new BNT — token inflation as the funding source. Inflation-funded coverage is a death-spiral mechanism: in the exact stress scenario where many positions need to be paid, the protocol prints into a falling token, diluting holders and accelerating the decline. It is not a collateralized hedge; it is a promise backed by the protocol’s own equity.
3

What we do instead — pre-locked USDC, mints nothing

The cvAMM pays claims in pre-locked USDC and mints nothing. Before a swap exists, the underwriter has already locked exactly MaxIL of USDC for the life of the position. In FULL the pool cannot become insolvent (collateral == MaxIL ≥\ge payout, I1) and cannot be run (withdrawal delay + locked/free accounting). There is no token to inflate and no equity to dilute.
Limit → Why → Mitigation, in one frame. The hard limit Bancor never had: the payout is capped at MaxIL. Why: beyond the range an LP is fully rotated into one asset, so further loss is directional (foregone spot upside), not the impermanent loss the LP set out to hedge — and unbounded payoff cannot be fully collateralized, so it cannot be trustless. Mitigation: the cap is precisely what lets the underwriter lock exactly MaxIL and makes no-bad-debt a construction rather than a hope. LPs who want beyond-range protection re-cover after re-ranging. The cap is the feature that fixes Bancor’s flaw.

​
Not GammaSwap, not Panoptic

Both are real, good products. Neither is what an Inflexion LP signs up for.
Limit. GammaSwap is perpetual volatility trading. Why it exists: there is genuine demand to be long or short gamma on a rolling basis, and a perpetual instrument serves traders who want to manage that exposure continuously. What we do instead: Inflexion is a European, fixed-maturity claim. The LP pays one premium up front, picks one of three durations, and does nothing until expiry — no funding to monitor, no position to roll, no margin to top up. Different instrument, different user, different cognitive load.
Limit. Panoptic is an on-chain options market built for sophisticated options traders. Why it exists: quants want full expressive control — strikes, structures, Greeks — and Panoptic gives them a venue to construct and manage those positions. What we do instead: our LP pays one number and the protocol computes everything else. The LP brings a position NFT, picks a duration, and pays the FairPremium — no strike selection, no structuring, no Greeks. Different audience entirely.Note the relationship is not adversarial: Panoptic (and Deribit) is exactly where a hedged market maker exports the short-gamma risk it takes on. Pillar 3 MMs use venues like Panoptic to make the whole system’s risk smaller. We compete with it for the LP’s attention; we depend on it for the MM’s hedge.

​
Not “insurance”

This is a labeling distinction with legal and demand-side teeth, so it gets its own treatment.
Limit → Why → Mitigation. Limit: do not call Inflexion “IL insurance.” Why this matters: “insurance” implies actuarial mutualization (a shared pool that pays claims out of pooled premiums against estimated frequencies) and carries regulatory ambiguity; sophisticated LPs also discount a product framed as insurance because they suspect the truncated tail. Mitigation / what it actually is: a collateralized derivative — a European claim, fully collateralized per-position at MaxIL, with no actuarial mutualization and no regulatory ambiguity. Every covered position has its own dedicated, pre-locked collateral; nothing is pooled across LPs to “average out” claims. The precise label, used everywhere, is in-range convexity hedge — never “insurance.”
There is a second reason the word is wrong. Insurance pays you back for a loss. Inflexion does not hedge the LP’s net P&L — it hedges gross in-range IL accruing from creation onward. The LP keeps Uniswap fee accrual during custody, and any IL borne before covering stays theirs. Total LP outcome is fees−IL+payout−premium\text{fees} - \text{IL} + \text{payout} - \text{premium}, which can be positive. That is correct, not a leak: invariant I4 (LP never profits from the swap) concerns the payout, which is 00 whenever IL is 00.

​
The differentiators table

Put side by side, the perimeter is sharp. Every row is a thing Inflexion does that the analogies do not.

​
Three more “nots” worth stating plainly

These come up in conversation and each deserves its honest framing.
Limit. A market-maker quote is per-market, not per-position — the SignedQuote carries no tokenId. Why: MaxIL is the unit of risk — pure geometry, frozen at creation, identical across durations — which makes positions fungible to an underwriter within a market. What we do instead: an MM signs a load plus a MaxIL-ratio band plus capacity, and the on-chain FairPremium is recomputed per position from its exact geometry at execution. One quote prices many positions; the MM never has to inspect individual NFTs. The old “LP knows the range, MM does not” adverse-selection story is void: v3 geometry is public on-chain, so both pool and MM read the exact position.
Limit. There is no “last look” — an MM cannot renege after seeing the order. Why this is a risk to manage: a firm quote that lives too long is a free option for the taker (a stale-quote pickoff). What we do instead: firmness is preserved and pickoff is closed with a short Good-Til-Date lifetime (≈5–15s) plus an oracle band that auto-voids the quote the instant the live price drifts beyond priceBandBps (Fork 2), not with last look. See Path B and routing.
Limit. Locked collateral is never routed to utilization-gated venues (Aave / Compound). Why: the no-bad-debt guarantee requires that the exact MaxIL backing a swap stays instantly liquid through settlement; a withdrawal queue at the moment of payout would break it. What we do instead: only idle/free USDC may earn yield, and only via instantly-redeemable wrappers (sDAI / tokenized T-bills). This is a hard project rule, not a tuning parameter — see the “no rehypothecation breach” qualifier in Claim A.

​
What is NOT yet mature (stated honestly)

The structures are live; the dynamics are what mature with MM competition and volume. None is left naked.
The on-chain moat dataset is live but young. Limit: every history / aggregate / time-series surface is live now — the subgraph is deployed and indexing on The Graph Studio (from the redeploy block), served via the hosted API — but real flow is minimal, so the dynamics (regimes, forward-vol distributions, dispersion) are still thin. Why: the regime and dispersion signals only sharpen with MM competition (≥3\ge 3 MMs) and volume; the off-chain telemetry halves are captured live and never touch the chain by design (invariant I7). Mitigation: the structures/queries ship day-one and are queryable now; the maturity comes with flow. If a backing (SUBGRAPH_URL / RPC / telemetry) were ever absent, history degrades to a typed pending state, never an error. See the data moat and status & caveats.
Structures ship from day one; the full DYNAMICS (pool-vs-MM spread as a forward-vol signal) mature with multiple competing MMs and volume. The dataset begins at the single redeploy; the off-chain telemetry halves begin at the first interaction logged.What Inflexion offers today is the architecture and the first public view into the microstructure of the DeFi LP volatility-risk premium — not yet a mature dataset:
  • Structures are present day-one. All five non-circular behavioral signals are defined and queryable from launch.
  • Dynamics mature with volume. The richer signal — the pool-vs-MM spread read as a forward-vol indicator — only sharpens once multiple market makers compete and real flow accumulates.
  • The dataset begins at the single redeploy, and the off-chain telemetry halves begin at the first interaction logged. History is served live from the subgraph via the API; if a backing (subgraph URL / RPC / telemetry) is absent, surfaces degrade to a typed pending state — never an error.
What is not uncertain: the protocol is live on Arbitrum Sepolia (chainId 421614) with a full create→settle lifecycle proven on both rails on the fresh 2026-06-05 stack — Path A paid from the ConvexityVault, Path B paid from a market maker’s own collateral. Network: Arbitrum Sepolia · chainId 421614 · deploy block 274081134 (subgraph startBlock) · deployed 2026-06-05

​
Core protocol

​
Stylus & libraries

​
Oracles

​
Uniswap

​
Demo tokens / pool / LP

​
Lifecycle swaps

Live create→settle lifecycle (2026-06-05, short 300s fee-500 market 0xb8bbd684f213d5833886ade7b531a6949d85522249881a2b5d46a5cc76e439c2):
  • Path A (cvAMM convexity) — swapId 1, LP tokenId 3220 · V0 $270,531.28 · MaxIL $1,669.24 · premium $9.70 (0.58% of MaxIL) · settled payout $148.64 from ConvexityVault.
  • Path B (MM routing) — swapId 2, LP tokenId 3221 · MM beat cvAMM ($8.93 vs $13.80) · MaxIL $3,215.65 · MM collateral locked $3,215.65 · settled payout $245.66 from MM collateral.

​
Common traps to avoid

A quick checklist of phrasings that quietly break the perimeter.
If you only remember one thing from this page: Claim A and Claim B are separate. “LPs are always paid” is not “depositors are safe.” Keep them apart and every other distinction on this page follows.

​
Where to go next

What it IS — the three pillars

The positive definition: on-chain FairValue, the cvAMM floor, MM competition.

MaxIL — cap and unit of risk

Why the cap is load-bearing and why it makes positions fungible.

No-bad-debt, stated correctly

Claim A in full, with the qualifying clause that makes it exact.

Tranches & depositor risk

Claim B in full: junior first-loss, senior systemic tail.