> ## Documentation Index
> Fetch the complete documentation index at: https://inflexion.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# What Inflexion is NOT
> The honest perimeter: not Bancor, not GammaSwap, not Panoptic, not 'insurance' — and why Claim A (LP no-bad-debt) and Claim B (depositor capital risk) are two separate claims that are never merged.
The fastest way to mis-sell Inflexion — to an LP or a depositor — is to reach for a familiar analogy that does not fit. This page draws the perimeter precisely. Each distinction is framed the same way: **what we are not → why that thing exists → what we do instead.** A naked "we're not X" is useless; the value is in the mechanism that replaces it.
It also fixes the one framing error that does real damage: collapsing the two guarantees Inflexion makes into one. **Claim A — LPs are always paid in FULL mode — and Claim B — depositor and MM capital is not guaranteed — are separate claims.** They are both true; neither implies the other; merging them is a defect.
Inflexion is an **in-range convexity hedge**: a European, fixed-maturity, in-range claim that pays $\min(\text{realized IL},\ \text{MaxIL})$ from pre-locked collateral. Entry requires $P_a \le P_0 \le P_b$ — out-of-range positions are rejected at creation. For the positive definition, start at [the three pillars](/concepts/three-pillars) and [MaxIL](/concepts/maxil).
## The two claims, kept separate
This is the load-bearing distinction on the whole page, so it comes first.
In FULL mode, an LP's covered position pays out with **no bad debt** — qualified by the full clause (capped payoff + solvent USDC + oracle/settlement liveness + no rehypothecation breach). This is structural and code-enforced by invariant [I1](/security/invariants).
The cvAMM is a **volatility seller**. Depositor and MM capital is **not guaranteed** for either tranche — junior is first-loss, senior is protected from underwriting loss only, never from the systemic tail.
**Never merge Claim A and Claim B.** "No bad debt" is a guarantee to the **LP being paid** — it says nothing about whether the underwriter's capital survives. A wrong $\sigma_{\text{ref}}$ can cost depositors money (bad pricing → NAV compression → junior absorbs first, senior in the tail) but can **never** create LP bad debt in FULL, because collateral $=$ MaxIL $\ge$ payout by construction, regardless of what $\sigma$ was. These are two guarantees, not one.
The disclosures below are the canonical wording for each claim. Use them verbatim wherever the claims appear.
**LPs are always paid with no bad debt in FULL mode — qualified: capped payoff + solvent USDC + oracle/settlement liveness.**
The no-bad-debt guarantee is **exact only** under the full clause:
* **FULL collateralization** — the underwriter has posted exactly `MaxIL` per swap, locked for the life of the position.
* **Capped payoff** — the payout is `min(realized_IL, MaxIL)`. The cap is load-bearing: it is what makes `payout ≤ collateral` hold by construction.
* **Solvent USDC** — the collateral numeraire (`dUSDC`) holds its peg and remains redeemable.
* **Oracle / settlement liveness** — the price oracle stays live and `settle()` runs within the protocol's settlement window.
* **No rehypothecation breach** — locked collateral stays instantly liquid; it is never routed to utilization-gated venues.
Stated without these qualifiers, the guarantee is **not** correct.
**Depositor capital is NOT guaranteed: the junior tranche is first-loss; the senior tranche is structurally protected from underwriting loss only, not systemic tail.**
Underwriting capital — whether supplied to the pooled cvAMM vault (Path A) or posted directly by a market maker (Path B) — is **at risk**:
* **Junior tranche — first-loss.** Junior depositors absorb underwriting losses first and buffer the senior tranche.
* **Senior tranche — protected from underwriting loss, exposed to the systemic tail.** The senior tranche is structurally shielded from ordinary underwriting loss while junior capital buffers, but it still takes the systemic tail once the junior buffer is exhausted.
No-bad-debt is a guarantee to the **LP being paid** (see the FULL-mode payout clause), **not** a guarantee that depositor or MM capital is preserved.
## Not Bancor — the single most important "not"
This is the comparison most people reach for, and it is the one that most badly misrepresents the design.
Bancor v2.1 offered "impermanent-loss protection," and it is the reference point everyone has in mind when they hear "hedge IL on-chain." Inflexion is **not** that, and the difference is mechanical, not cosmetic.
Bancor covered losses by **minting new BNT** — token inflation as the funding source. Inflation-funded coverage is a death-spiral mechanism: in the exact stress scenario where many positions need to be paid, the protocol prints into a falling token, diluting holders and accelerating the decline. It is not a collateralized hedge; it is a promise backed by the protocol's own equity.
The cvAMM pays claims in **pre-locked USDC and mints nothing**. Before a swap exists, the underwriter has already locked exactly `MaxIL` of USDC for the life of the position. In FULL the pool **cannot become insolvent** (collateral $=$ MaxIL $\ge$ payout, [I1](/security/invariants)) and **cannot be run** (withdrawal delay + locked/free accounting). There is no token to inflate and no equity to dilute.
**Limit → Why → Mitigation, in one frame.** The hard limit Bancor never had: the payout is **capped at MaxIL**. *Why:* beyond the range an LP is fully rotated into one asset, so further loss is *directional* (foregone spot upside), not the *impermanent* loss the LP set out to hedge — and unbounded payoff cannot be fully collateralized, so it cannot be trustless. *Mitigation:* the cap is precisely what lets the underwriter lock exactly `MaxIL` and makes [no-bad-debt](/concepts/no-bad-debt) a construction rather than a hope. LPs who want beyond-range protection [re-cover after re-ranging](/concepts/in-range-convexity-hedge). The cap is the feature that fixes Bancor's flaw.
## Not GammaSwap, not Panoptic
Both are real, good products. Neither is what an Inflexion LP signs up for.
**Limit.** GammaSwap is perpetual volatility trading. **Why it exists:** there is genuine demand to be long or short gamma on a rolling basis, and a perpetual instrument serves traders who want to manage that exposure continuously. **What we do instead:** Inflexion is a **European, fixed-maturity** claim. The LP pays one premium up front, picks one of three durations, and does nothing until expiry — no funding to monitor, no position to roll, no margin to top up. Different instrument, different user, different cognitive load.
**Limit.** Panoptic is an on-chain options market built for sophisticated options traders. **Why it exists:** quants want full expressive control — strikes, structures, Greeks — and Panoptic gives them a venue to construct and manage those positions. **What we do instead:** our LP **pays one number** and the protocol computes everything else. The LP brings a position NFT, picks a duration, and pays the [`FairPremium`](/concepts/fair-value) — no strike selection, no structuring, no Greeks. Different audience entirely.
Note the relationship is not adversarial: Panoptic (and Deribit) is exactly **where a hedged market maker exports the short-gamma risk it takes on**. Pillar 3 MMs use venues like Panoptic to make the whole system's risk *smaller*. We compete with it for the LP's attention; we depend on it for the MM's hedge.
## Not "insurance"
This is a labeling distinction with legal and demand-side teeth, so it gets its own treatment.
**Limit → Why → Mitigation.** *Limit:* do not call Inflexion "IL insurance." *Why this matters:* "insurance" implies actuarial mutualization (a shared pool that pays claims out of pooled premiums against estimated frequencies) and carries regulatory ambiguity; sophisticated LPs also discount a product framed as insurance because they suspect the truncated tail. *Mitigation / what it actually is:* a **collateralized derivative** — a European claim, fully collateralized per-position at `MaxIL`, with **no actuarial mutualization and no regulatory ambiguity**. Every covered position has its own dedicated, pre-locked collateral; nothing is pooled across LPs to "average out" claims. The precise label, used everywhere, is **in-range convexity hedge** — never "insurance."
There is a second reason the word is wrong. Insurance pays you back for a *loss*. Inflexion does not hedge the LP's net P\&L — it hedges **gross in-range IL accruing from creation onward**. The LP keeps Uniswap fee accrual during custody, and any IL borne before covering stays theirs. Total LP outcome is $\text{fees} - \text{IL} + \text{payout} - \text{premium}$, which can be positive. That is correct, not a leak: invariant [I4](/security/invariants) (LP never profits *from the swap*) concerns the payout, which is $0$ whenever IL is $0$.
## The differentiators table
Put side by side, the perimeter is sharp. Every row is a thing Inflexion does that the analogies do not.
| Inflexion is NOT… | …because that thing | …and instead Inflexion |
| - | - | - |
| **Bancor IL protection** | funds coverage by minting tokens (inflation death-spiral) | pays from **pre-locked USDC, mints nothing**; FULL pool cannot be insolvent ([I1](/security/invariants)) or run |
| **GammaSwap** | is perpetual vol trading needing active management | is a **European, fixed-maturity** claim — pay once, do nothing until expiry |
| **Panoptic** | is an options market for quants (strikes, structures, Greeks) | lets the LP **pay one number**; the protocol computes the rest |
| **"Insurance"** | implies actuarial mutualization + regulatory ambiguity | is a **collateralized derivative**, collateralized per-position at `MaxIL` |
| **Unbounded "IL coverage"** | cannot be fully collateralized → cannot be trustless | caps payout at **MaxIL**; the cap makes no-bad-debt a *construction* |
| **A net-P\&L hedge** | would have to claw back fees and pre-cover losses | hedges **gross in-range IL from creation onward**; LP keeps fees ([I4](/security/invariants)) |
| **A fitted / Monte-Carlo pricer** | a calibrated surface drifts and hides assumptions | publishes an **exact closed-form $\Phi$-sum** on-chain ([the Phi-sum](/math/fair-value-phi-sum)) |
| **A custodial market** | a matcher that holds funds can steal, forge, or force a stale quote | is **non-custodial**: Path A needs no matcher; Path B's matcher cannot steal/forge/force a quote |
| **A risk-free yield product** | depositor capital backing a vol seller is never risk-free | tells depositors plainly: **capital is NOT guaranteed** for either tranche |
| **A guarantee that depositors are safe** | conflating Claim A with Claim B | keeps **Claim A and Claim B separate** — LPs always paid; depositors at risk |
## Three more "nots" worth stating plainly
These come up in conversation and each deserves its honest framing.
**Limit.** A market-maker quote is **per-market**, not per-position — the `SignedQuote` carries no `tokenId`. **Why:** [MaxIL is the unit of risk](/concepts/maxil) — pure geometry, frozen at creation, identical across durations — which makes positions **fungible to an underwriter within a market**. **What we do instead:** an MM signs a load plus a MaxIL-ratio band plus capacity, and the on-chain [`FairPremium`](/concepts/fair-value) is recomputed per position from its exact geometry at execution. One quote prices many positions; the MM never has to inspect individual NFTs. The old "LP knows the range, MM does not" adverse-selection story is **void**: v3 geometry is public on-chain, so both pool and MM read the exact position.
**Limit.** There is no "last look" — an MM cannot renege after seeing the order. **Why this is a risk to manage:** a firm quote that lives too long is a free option for the taker (a stale-quote pickoff). **What we do instead:** firmness is preserved and pickoff is closed with a **short Good-Til-Date lifetime (≈5–15s) plus an oracle band** that auto-voids the quote the instant the live price drifts beyond `priceBandBps` ([Fork 2](/security/forks)), not with last look. See [Path B](/protocol/path-b-mm) and [routing](/protocol/routing).
**Limit.** Locked collateral is **never** routed to utilization-gated venues (Aave / Compound). **Why:** the no-bad-debt guarantee requires that the exact `MaxIL` backing a swap stays instantly liquid through settlement; a withdrawal queue at the moment of payout would break it. **What we do instead:** only **idle/free** USDC may earn yield, and only via instantly-redeemable wrappers (sDAI / tokenized T-bills). This is a hard project rule, not a tuning parameter — see the "no rehypothecation breach" qualifier in [Claim A](/concepts/no-bad-debt).
## What is NOT yet mature (stated honestly)
The structures are live; the *dynamics* are what mature with MM competition and volume. None is left naked.
**The on-chain moat dataset is live but young.** *Limit:* every history / aggregate / time-series surface is **live now** — the subgraph is deployed and indexing on The Graph Studio (from the redeploy block), served via the hosted API — but real flow is minimal, so the *dynamics* (regimes, forward-vol distributions, dispersion) are still thin. *Why:* the regime and dispersion signals only sharpen with MM competition ($\ge 3$ MMs) and volume; the off-chain telemetry halves are captured live and never touch the chain by design (invariant [I7](/security/invariants)). *Mitigation:* the **structures/queries ship day-one** and are queryable now; the **maturity comes with flow**. If a backing (`SUBGRAPH_URL` / RPC / telemetry) were ever absent, history degrades to a typed pending state, **never an error**. See [the data moat](/concepts/data-moat) and [status & caveats](/reference/status-caveats).
**Structures ship from day one; the full DYNAMICS (pool-vs-MM spread as a forward-vol signal) mature with multiple competing MMs and volume. The dataset begins at the single redeploy; the off-chain telemetry halves begin at the first interaction logged.**
What Inflexion offers today is the **architecture and the first public view** into the microstructure of the DeFi LP volatility-risk premium — not yet a mature dataset:
* **Structures are present day-one.** All five non-circular behavioral signals are defined and queryable from launch.
* **Dynamics mature with volume.** The richer signal — the pool-vs-MM spread read as a forward-vol indicator — only sharpens once multiple market makers compete and real flow accumulates.
* **The dataset begins at the single redeploy**, and the off-chain telemetry halves begin at the first interaction logged. History is served live from the subgraph via the API; if a backing (subgraph URL / RPC / telemetry) is absent, surfaces degrade to a typed `pending` state — never an error.
What is **not** uncertain: the protocol is live on Arbitrum Sepolia (chainId `421614`) with a full create→settle lifecycle proven on both rails on the fresh 2026-06-05 stack — Path A paid from the `ConvexityVault`, Path B paid from a market maker's own collateral.
**Network:** Arbitrum Sepolia · **chainId** `421614` · **deploy block** `274081134` (subgraph startBlock) · **deployed** 2026-06-05
## Core protocol
| Contract | Address | Role |
| - | - | - |
| InflexionCore | `0xC19865cF8403F59B8Eca835833aFEe3Aa8DA4848` | Main entry point — quotes, createSwap, settlement |
| ILVault | `0x9f7615Aca943832977CEf3ac1862fD48B87b7664` | Holds LP premiums and protocol IL accounting |
| UnderwriterVault | `0x4Fb459F3393D206c2b7faD7f0fC9C35a78348D64` | Market-maker (Path B) collateral deposits |
| ConvexityVault | `0xDE2fFeBA2E6A18f3A53D43EC0fCCD299158eC30d` | Pooled cvAMM (Path A) underwriter collateral |
| Treasury | `0x96455C9b00D530BD0629b71B674298440328b1Dd` | Protocol fee recipient (also deployer) |
## Stylus & libraries
| Contract | Address | Role |
| - | - | - |
| FairValueOracle (Stylus) | `0x98a6aa75108b70fc0794bc3b87efe0ae99d5d52c` | Rust/WASM fair-premium pricing (set-once init to live VolOracle) |
| ILMath | `0x7e90362bc6Df9cb5faA13952e07853ab16c77bd2` | Core impermanent-loss math |
| TickMath (library) | `0xbf02bbc82e0fb1a4b9828bb90fc9dd9e97578965` | Tick ↔ sqrtPrice conversions (delegatecall) |
| CvammPricing (library) | `0x4a053d29a55a64172140f9ebbc27c321c0ba2b53` | Path-A pool pricing components (delegatecall) |
| SwapMath (library) | `0xf7be9745b6768d06a18c386c6db5c8cb065ba314` | Swap math helpers (delegatecall) |
| QuoteVerification (library) | `0x74819eed322f3e1a2dc10bb0d3cae50078d90807` | EIP-712 quote signature verification (delegatecall) |
## Oracles
| Contract | Address | Role |
| - | - | - |
| OracleManager | `0x2c18147B6ec75dcb330d9A48B6B96a4d1a8b529b` | Chainlink feed router, staleness & sequencer checks |
| VolOracle | `0xfdEafBB381192FC5337499d041eaead04d565Ed9` | Realized-volatility reference (sigma\_ref) |
## Uniswap
| Contract | Address | Role |
| - | - | - |
| UniswapV3Factory | `0x248AB79Bbb9bC29bB72f7Cd42F17e054Fc40188e` | v3 pool factory |
| NonfungiblePositionManager | `0x6b2937Bde17889EDCf8fbD8dE31C3C2a70Bc4d65` | LP position NFTs |
| SwapRouter02 | `0x101F443B4d1b059569D643917553c771E1b9663E` | Swap routing |
| QuoterV2 | `0x2779a0CC1c3e0E44D2542EC3e79e3864Ae93Ef0B` | Off-chain swap quoting |
## Chainlink feeds
| Contract | Address | Role |
| - | - | - |
| ETH / USD | `0xd30e2101a97dcbAeBCBC04F14C3f624E67A35165` | Price feed (8 dec, \~120s heartbeat) |
| BTC / USD | `0x56a43EB56Da12C0dc1D972ACb089c06a5dEF8e69` | Price feed (8 dec, \~120s heartbeat) |
| ARB / USD | `0xD1092a65338d049DB68D7Be6bD89d17a0929945e` | Price feed (8 dec, 86400s heartbeat) |
| USDC / USD | `0x0153002d20B96532C639313c2d54c3dA09109309` | Price feed (8 dec, 86400s heartbeat) |
## Demo tokens / pool / LP
| Contract | Address | Role |
| - | - | - |
| WETH9 | `0x980B62Da83eFf3D4576C647993b0c1D7faf17c73` | Canonical Arbitrum Sepolia WETH (18 dec) |
| USDC (Circle) | `0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d` | Circle native testnet USDC (6 dec) |
| dWETH (demo) | `0xA8C07E1B245B346c5D1910c5055Efe67bF9E7D1D` | Mock WETH, oracle-priced via Chainlink ETH/USD (18 dec) |
| dUSDC (demo) | `0xB89630Dc6e020ae2A84aE72b7d9EEDBDfb2C544d` | Mock USDC numeraire (6 dec) |
| Demo pool (dWETH/dUSDC, fee 500) | `0xfE1Eb4D5796a350B13852F822B3E6a9fDbb858a5` | Seeded v3 pool, tokenId 3218 \~\$100k unprotected LP |
## Lifecycle swaps
| Contract | Address | Role |
| - | - | - |
| Market maker (demo signer) | `0xe632B215120dD43A719458487bA3e03638fec953` | Path-B underwriter; deposited 5,000 dUSDC, own collateral paid settlement |
Live create→settle lifecycle (2026-06-05, short 300s fee-500 market `0xb8bbd684f213d5833886ade7b531a6949d85522249881a2b5d46a5cc76e439c2`):
* **Path A (cvAMM convexity)** — swapId 1, LP tokenId 3220 · V0 \$270,531.28 · MaxIL \$1,669.24 · premium \$9.70 (0.58% of MaxIL) · settled payout \$148.64 from ConvexityVault.
* **Path B (MM routing)** — swapId 2, LP tokenId 3221 · MM beat cvAMM (\$8.93 vs \$13.80) · MaxIL \$3,215.65 · MM collateral locked \$3,215.65 · settled payout \$245.66 from MM collateral.
## Common traps to avoid
A quick checklist of phrasings that quietly break the perimeter.
| Trap (do NOT say) | Say instead |
| - | - |
| "IL insurance" | "in-range convexity hedge" |
| "bad debt is impossible" | "no bad debt **under** FULL + capped payoff + solvent USDC + oracle/settlement liveness + no rehypothecation breach" |
| "depositors can't lose money" | "capital is NOT guaranteed for **both** tranches" |
| "we cover your IL" | "we pay $\min(\text{realized IL}, \text{MaxIL})$ on **in-range** IL from creation onward" |
| "the cap is a limitation we'd like to remove" | "the cap is **load-bearing** — it is what makes the hedge fully collateralized and trustless" |
| "MaxIL measures how risky a position is" | "MaxIL is the **collateral / capital unit**, not a risk metric" |
| "we invert `fairRate` for an implied-vol surface" | "the moat is **five behavioral signals**; IV-inversion is circular and dropped" |
If you only remember one thing from this page: **Claim A and Claim B are separate.** "LPs are always paid" is not "depositors are safe." Keep them apart and every other distinction on this page follows.
## Where to go next
The positive definition: on-chain FairValue, the cvAMM floor, MM competition.
Why the cap is load-bearing and why it makes positions fungible.
Claim A in full, with the qualifying clause that makes it exact.
Claim B in full: junior first-loss, senior systemic tail.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.