The cash vault

One public vault funds every draw on the desk, at every hour. Depositors put in USDG, hold internal shares, and earn the interest margin users pay, less the protocol skim.

Shares and vault value

A vault position is a share count in the vault's own ledger, not a token: shares have no transfer, no approve and no ERC-20 interface. Everything a depositor sees is a share count and a share price. With U the vault's cash, P the principal drawn across all margin accounts, A the accrued unrealised interest across every account, each at its own tier rate, k the skim rate and S the total shares:

A deposit mints shares at NAV, a claim burns them at NAV, and a draw converts U into P one for one, so none of those move the share price. Yield shows up as continuous NAV drift: the skim-net 80.00% of every second of accrued interest is marked into V as it accrues. That is why the daily charge does not move NAV either. Realisation only converts P and A into U at the value already marked, with the skim leaving through a balance that was never inside V. The first deposit bootstraps the ledger 1:1 and donates a small dead share balance to a burn address, which closes the classic first-depositor share attack.

When NAV overstates

With k at 20.00% the identity reads V = U + P + 0.80 × A, and it counts every open debit at par. P is the principal drawn across all accounts and A the interest they have accrued, and neither is discounted for the state of the account behind it. So when an account's collateral falls below what it owes, V goes on carrying that account's principal in full, and 80.00% of its accrued interest, as if both would be repaid, from that moment until the write-off lands. In that window the NAV on the screen is higher than the vault could pay out, by the part of that marked value the forced sale will not bring back and the insurance line will not cover. Nothing in the ledger marks the gap early.

What closes it is the write-off, and only the write-off. It runs inside the forced sale, at the end of the pass that exhausts the account's collateral, in a fixed order: the sale proceeds, penalty included, come into the vault first; the insurance line pays the residual into vault cash up to its balance; whatever is left comes off V, and so off NAV, at once and with no smoothing. A withdrawal claimed inside the window is paid at the overstated NAV, and the depositors still in the vault when the write-off lands bear the whole drop.

How long the window stays open is a question of how fast the engine can sell. An account whose collateral no longer covers its debit has negative equity, which is below the 75% hard floor, so it gets no grace: it is actionable on the next keeper sweep, and the sale and the write-off run together, so on the ordinary path the window is one sweep interval plus the sale itself: seconds, or minutes for a book large enough to need several passes. It stretches when a leg cannot be sold, because a residual cannot be written off while collateral is still held. A USDG print under the depeg floor pauses every forced sale for 1 hour, once per depeg: no later poke extends it, and the Risk Council can end it early. A guardian pause on an asset, a router halt or a forced-sale pause on its feed, lasts until it is lifted, and anyone may lift it once it has run 72 hours. The deviation guard skips an asset for as long as its Chainlink feed and the on-chain TWAP disagree beyond the class band, and an asset whose feed has gone stale with no TWAP behind it cannot be priced at all, so its account cannot even be called until the feed returns. Of those only the depeg pause is bounded, and per depeg rather than for all time: one window per depeg, and no new pause inside a window of the last one's end, so counted from any pause at most one window in two is paused, however long a depeg runs or however many follow. A lifted guardian pause can be set again, and the other two last as long as their condition does. If no keeper is running, anyone may raise the call and, 10 minutes after its deadline, execute the sale; for an account below the floor the deadline is the moment the call is raised. Until the write-off lands, NAV counts the account at par.

Deposit cap and utilisation

Deposits are capped so yield is not diluted by idle cash. The cap starts at the launch value of $5,000,000 and ratchets to 1.6x the outstanding book (P + A) whenever that is higher. Anyone may recompute it, the keeper does so every 6 hours by default, and it only moves up; governance can lower it but never below the launch cap.

On the other side, new draws are blocked once utilisation, (P + A) / V, would pass 90.00%, and blocked entirely while the withdrawal claim queue is worth more than the vault's cash. Existing positions are untouched by both gates; they only stop new buying power.

Withdrawals

Withdrawals run through a queue with a 2 days delay. Requesting locks your shares immediately; the payout is valued at the NAV on the day you claim, so you keep earning drift through the delay and you bear any NAV change during it. That is what makes the vault a real risk position rather than a fixed-rate note. When cash is short, claims are paid strictly in request order: a later claim cannot jump an earlier one that is still waiting, and claims clear one by one as sells and repayments refill the vault. Draws resume as soon as cash covers the remaining queue. A pending request can be cancelled at any time, which returns the shares; a new request joins the back of the queue.

The exit has a circuit breaker. During an incident a guardian can hold every claim, and the queue’s settlement with it, for up to 72 hours on top of the 2 days delay; requests, cancels and deposits keep working through it, and once the hold has run that long anyone may lift it. A guardian can pause again once a pause expires, so a hold can outlast one pause; only an admin lift through the timelock holds the guardian off that lever for a further expiry window, so a hold the admin has publicly overruled does not return.

Where the skim goes

The skim is 20.00% of gross interest, so depositors keep the other 80.00% of every second that accrues. The rate is movable only within 10.00% to 20.00%, and it stands at that ceiling today: governance can lower the skim, and can never raise it. Where the skim cash goes is decided at every settlement by the insurance line, a USDG balance held inside the vault contract but excluded from V, judged live against its target of 4.00% of V:

There is no band beneath the target and no slice of the skim that keeps topping a full line: the whole skim goes one way or the other, settlement by settlement. Because the target is a share of vault value, a deposit or a day of accrual can lift it over the line with no bad debt at all, and the next skim then goes to the line until it is back at target. The vault also carries a label for that history, shown on the protocol page and emitted on every change:

The label is re-judged on every settlement, bad debt cover, insurance seed and change to the skim rate or the target; it records what the line had done, and the routing itself never reads it. The ledger is identical whatever the label reads, depositors always earn the 80.00% share. Anyone may also seed the insurance line directly, which is how it reaches target ahead of the years the skim alone would take.

Bad debt and the waterfall

The insurance line exists for one purpose: absorbing bad debt before depositors do. When an account is written off after a forced sale, the loss lands in order: the forced sale penalty on the affected account (already vault income), then the insurance line, then vault NAV pro rata across depositors. There is no smoothing, the NAV drop is immediate, and until that write-off lands V carries the account at par, as set out above. The line's only outflow is bad debt; governance cannot withdraw it. No tranche, no token backstop: $CALL is never sold to cover vault losses.

What the vault cannot be protected from

The waterfall above assumes the collateral behind a debit can be sold. Two contracts the desk did not write decide whether it can, and each holds a power the desk cannot override. Every stock and ETF token is issued behind one registry the equity issuer controls from a bare key with no timelock: it can pause transfers, per token or for every token at once, which stops forced sales in that asset while prices keep moving, so a call can run past the point where selling covers the debit; it can burn collateral out of MarginAccounts custody, even while the token is paused, which leaves a debit that no sale can cover and no write-off can reach while the ledger still shows the position, so NAV carries that account at par with nothing to close the gap; and it can upgrade every token's code in one transaction, so every property verified at launch is a snapshot. USDG, the vault's only asset, can be paused by its issuer and can freeze an address, receiving as well as sending, from one hot key: a frozen CashVault takes no deposit, pays no claim and settles nothing until the issuer lifts it, and a frozen balance the issuer wipes is gone, so NAV carries that too. The desk watches those contracts for exactly these events and pages the operator as each lands, the Risk Council can block buys of an affected asset, delist it or raise its requirements to the ceiling, and the loss from any one name is bounded by the desk-wide exposure cap of 6 forced sale clips of its measured depth; none of that removes a burned position's value from the book or unfreezes a balance, and the vault's NAV carries the consequence.

Protocol revenue and the sweep

The protocol's side of the skim and the desk fee on a trade accrue in a separate balance, also outside V: the fee lands there whole on every trade, and the skim reaches it once the insurance line is at target, going to the line while the line is below. A permissionless sweepProtocolRevenue() transfers the whole balance to the foundation treasury and nowhere else: the destination is pinned write-once, there is no split on the way out and no callback into any other contract. None of it is allocated to $CALL. See $CALL and staking for what the token does instead, and Parameters for every live value on this page.