Three mechanisms compose. Each one is independently sufficient to survive an ordinary bad day; together they are what lets the venue quote volatility at all.
1 · Quadratic skew fee
borrowRate_dominant = baseFee × ( (OI_dominant + depth) / (OI_counter + depth) )²- baseFee
- 0.18% per 8h; the owner may set it up to 1%
- depth
- 100,000 USDG, so a thin book is not charged as a crowded one
The crowded side pays for the privilege, and the payment scales faster than the imbalance; the thin side pays nothing. Past 80/20 the book is flagged as skewed.
2 · Escrowed 8× payout cap
maxProfit = 8 × initialMarginWorst-case liability is reserved at execution. Because the ceiling is known when the order settles, the vault never carries an obligation it has not already funded.
3 · 20% single-block dampener
P_settlement = α · P_new + (1 − α) · P_last, α = 0.05A distrusted push moves settlement 5% of the way toward it and never more than 20% within one block band — on Robinhood Chain one L1 block, about twelve seconds. Walking settlement a long way takes a false price pushed block after block, while the index's own sources keep saying otherwise.
Tested against
| Scenario | Injected | What holds |
|---|---|---|
| Black-swan push | A sixfold print; ten +19% pushes in one block | Settlement moves 20% at most per block |
| Total directional skew | Every position on one side | The pool still covers every escrow |
| Stale feed | No push for longer than maxAge, 120 s | Nothing opens, closes or liquidates against it |
| Cascade | A +500% move, then fifteen profitable closes | Solvent at every step; every escrow released |
| Random sequences | 256 runs of 500 calls: deposits, withdrawals, opens, closes, liquidations, price walks, time | Pool ≥ escrow; tokens = ledger; deposits = free + locked; open interest = open positions |
test_dampener_clampsBlackSwanToTwentyPercent test_audit_keeperCannotWalkThroughTheBandInOneBlock test_vault_solventUnderFullyOneSidedBook test_audit_nothingSettlesAgainstAStaleOracle test_vault_solventAfterBlackSwanCascade invariant_poolCoversEscrow invariant_tokensMatchTheLedger invariant_depositsAreFreePlusLocked invariant_openInterestMatchesPositions
A stale feed freezes a market rather than pricing off it, and free balances stay withdrawable throughout, since a withdrawal needs no price. The owner can pause withdrawals if feeds desynchronise, for three days at most and not twice back to back.