Risk and safeguards

EVE moves one specific risk, the gap between the closing price and the opening price, from the seller's night to a set of safeguards. This page lists each safeguard, and then the risks that remain. Nothing is deployed and nothing has been audited: treat every mechanism here as a design, not a guarantee.

The safeguards#

i guard the gap.

1. The haircut#

What. Only 90% of the closing value is advanced. The remaining 10% is held back until the open.

Why. The pool pays at night and is repaid in the morning. The haircut is the distance the price can fall overnight before the pool is out of pocket. With a one-night fee, the haircut absorbs a drop of up to 9.77%.

Limit. Stocks do fall more than that overnight. Rarely, but they do.

2. Earnings nights#

What. When a company reports earnings between the close and the next open, the advance is reduced to 75%, or the ticker is blocked for the night. Current setting: reduce todo

Why. Earnings are the most common cause of a large overnight gap, and the date is known in advance. A 75% advance absorbs a drop of up to 24.81%.

Limit. It relies on an accurate earnings calendar. Source: not decided todo

3. Corporate actions#

What. A ticker is blocked while a corporate action is pending: a split, a special dividend, a merger, a ticker change.

Why. During corporate actions the Chainlink feed for the stock can freeze or jump for reasons that are not a change in value. There is no trustworthy price to size an advance on or to settle against.

Limit. Same dependency on a calendar of events.

4. Volume cap#

What. The total accepted per ticker each night is capped to 5% todo of DEX depth.

Why. Whatever the pool buys at night it must sell in the first 30 minutes of the session. If it holds more than the market can take, its own selling pushes the price down. The cap keeps the pool small relative to the liquidity it sells into.

Limit. Depth measured at night is not depth at the open. Liquidity can vanish exactly when it is needed.

5. The reserve#

What. Part of every fee goes to a reserve. When a gap is larger than the haircut, the reserve pays the pool's shortfall.

Why. It puts a buffer between a bad night and depositors' capital.

Limit. The reserve is only as large as the fees collected so far. Early on it is small. A large enough gap, or several in one morning, can empty it. Target size: not decided todo

6. Fresh feed only#

What. Settlement uses only Chainlink rounds written after the opening bell and younger than 120 seconds todo. If there is no fresh price, there is no settlement yet.

Why. The overnight value of the feed is the previous close. Settling on it would defeat the whole design.

Limit. A settlement that waits is a seller who waits and a pool that still holds stock.

7. The lower of two prices#

What. The settlement price is the lower of the oracle average and the pool's realized TWAP.

Why. The pool never pays out against a price it could not actually sell at.

Limit. This protects depositors at the seller's expense when the two prices differ. See Settlement formula.

8. Sell-side only#

What. Version one only buys from sellers. There is no buy side, no borrowing and no leverage.

Why. Fewer moving parts, one direction of risk.

What happens in a crash#

Take a stock that opens about 15% below its close, on a normal 90% advance.

Step	How	Amount
Reference value at the close	5 × $700.00	$3,500.00
Advance paid at night (90%)	$3,500.00 × 90%	$3,150.00
Oracle average after the open	fresh Chainlink price, averaged	$595.00
Realized TWAP	what the pool got selling	$593.60
Settlement price	the lower of the two (TWAP), -15.20% vs the close	$593.60
Settled value	5 × $593.60	$2,968.00
Fee (1 night)	$2,968.00 × 0.25%, of which $0.00 can be collected	−$0.00
Advance already paid		−$3,150.00
Balance paid at the open	never below zero	$0.00
Total received by the seller	advance + balance	$3,150.00
Pool shortfall	advance − realized proceeds ($2,968.00)	$182.00
Covered by the reserve	reserve before: $25,000.00	$182.00

The order of loss is always the same:

1. The haircut absorbs the first 10% or so.
2. The reserve pays what the haircut did not cover.
3. Depositors lose only what the reserve cannot pay.

The seller keeps the advance throughout (recourse to the seller: none todo).

Remaining risks#

Stated plainly. None of these is removed by the safeguards above.

For sellers#

• You receive the opening price, whatever it is. EVE does not lock in tonight's price. If the stock opens lower, you receive less than the closing value. The advance is a floor on what you keep, not a guarantee of the closing price.
• The lower-of-two rule can cost you. When the pool's realized price is below the oracle average, you are paid the realized price.
• Settlement can be delayed. A halted stock, an unscheduled market closure or an oracle outage postpones the balance.
• You may not be able to sell. A ticker can be blocked, or tonight's cap can be full.
• Issuer risk. A tokenized stock is a claim issued by a company. EVE does not change or reduce the risks of the token itself.
• Smart-contract risk. A bug could lose funds. No contract has been written or audited yet.

For depositors#

• A gap larger than the haircut and the reserve. This is the central risk. If a stock gaps far enough, and the reserve is not large enough, the pool loses money and the share price falls.
• Correlated gaps. The four tickers are large US technology stocks. They tend to fall together. A bad Monday open can hit every position at once, with one reserve behind all of them.
• Execution risk. The pool must sell real size in 30 minutes. If liquidity is thin, it sells lower. The lower-of-two rule passes that to sellers only down to the advance; beyond it, it is the pool's loss.
• Oracle risk. A wrong, late or manipulated feed can misprice the advance or the settlement. Averaging and freshness checks reduce this; they do not remove it.
• Morpho risk. Idle USDC is supplied to Morpho. That adds its smart-contract risk, the risk of bad debt in the market used, and the risk that funds cannot be withdrawn in time for the night.
• USDC risk. USDC can lose its peg, and its issuer can freeze balances.
• Liquidity risk. Withdrawals are served at settlement. You cannot leave in the middle of a weekend.
• Smart-contract risk. As above.
• Control risk. Someone will be able to change parameters and upgrade contracts. Who, and with what delay: not decided todo

For everyone#

• Regulatory risk. Tokenized securities are regulated differently in every jurisdiction, and the rules are changing. Tokenized stocks are not available to US persons.
• Nothing is live or audited. Audits: not decided todo
• Parameters are placeholders. Every value tagged TODO in these docs can change before launch, and some of them change the risk materially.

Parameters at a glance#

See it happen#

The simulator has a one-click scenario for each of the two main safeguards: an earnings night, and a gap larger than the haircut. Both print every step on the ledger.