Risk and Coverage

Coverage limits what Swap may do with inventory; it does not guarantee recovery after every possible price move. This page describes the testnet mechanism. Market, issuer, reference, contract and withdrawal risks remain.

Coverage Rules

Before increasing a stock shortfall, the engine checks that physical stock plus the amount it could repurchase with ring-fenced proceeds and allocated junior capital covers its senior stock obligation at the stressed ask price.

mechanism Stock Coverage

Here C is coverage, I is stock held, Λ is the senior stock obligation and P_stress is the stressed ask. The stressed ask includes the market’s stress move and liquidation cost. A mirrored test covers the Senior USDG Vault against stock surpluses valued at stressed bids. Each unit of collateral can be allocated only once. Reward escrows, accrued protocol fees and unsettled hedges do not count as free collateral.

In ordinary operation, the rule prevents the engine selling stock it could not buy back under the configured stress scenario with the funds it holds. A more severe gap, transfer restriction or execution failure can still exceed that scenario.

Finite Depth and Reduction Only

Executable depth is the minimum permitted by the State Book, physical inventory, session allowance, allocated capital and the reference risk budget. When a limit binds, only the side that reduces exposure may remain quoted.

A risk window also bounds cumulative stressed-loss expansion. Reversing a trade does not refund this budget, and accepting a fresh print does not reset it. With no junior capital, inventory depth is not evaluated; funded crossing and permitted reduction paths are separate from ordinary two-sided inventory quoting.

Backstop and Engine Reserve

The Backstop is junior USDG supplied by participants at variable net asset value. Exit requests remain exposed until cash is reserved. Its notice and queue prevent a request from fixing a pre-gap value while leaving the loss to remaining holders.

The Engine Reserve consists of retained venue profit, permanently committed to the engine. It ranks alongside the Backstop, cannot be redeemed by its depositors and cannot be withdrawn to the protocol treasury.

The treasury receives a share of fees. No treasury contribution or NOTE support is assumed in coverage. See Providing Liquidity.

An Adverse Print

1. Accept the qualifying reference and mark carried exposure. Do not reject a valid price merely because it reveals a loss.
2. Recompute obligations, capital and coverage before admitting new risk.
3. If coverage is below the floor, stop risk increases and distributions, and use orderly exposure reduction.
4. Reconcile opening exposure and any queued obligations under their seniority before normal quoting resumes.

Unknown token terms, invalid data or a sequencer fault can independently require Safety. Freshness alone cannot override those gates. See Regimes and Sessions.

Loss Waterfall

The design applies current-period income first, then the Backstop and Engine Reserve pro rata. A separately pre-funded default fund would come next only if one were established; none is assumed here. Beyond those resources, a catastrophic gap can cause pro-rata impairment of the affected senior series.

Regular inventory cannot be assigned a closure loss. Unvested Continuous carry amounts are forfeited before senior impairment. These boundaries distinguish the instruments; they are not a guarantee of unconditional redemption.

Remaining Risks

Stock prices can gap beyond a stress setting. Stock Token and USDG issuers can restrict transfers. Reference and sequencer failures can delay trading; contract failures can cause loss. Using reviewed libraries does not constitute an audit of this composition.

Review the protocol’s Market, Oracle, Issuer, Smart Contract and Regulatory risk pages. Their note-specific mechanics do not replace the Swap rules on this page.