Clearing V1

Insurance

Insurance is not a pool the core pays out of. The core treats it as just another trader. It is an external protocol that steps into force-closed shorts at the last moment, at the top of the auction, through its own account and its own capital, and it is funded by a governed cut of what the auctions leave behind.

The core knows almost nothing about it

The clearing core has no backstop logic and no insurance vault it pays from. Its only tie to insurance is a fee lever: a configurable cut of each auction's excess can be routed to the insurance protocol's address. Beyond sending that cut to an address, the core treats the insurance protocol as just another trader, it holds a Trader.sol account and acts through the same functions any writer does.

How it is funded

When an auction fills below its ceiling, the difference between the budget, the seized perp margin plus the bond, and the price it cleared at is excess. A governed lever splits that excess three ways: a cut to the DAO, a cut back to the force-closed writer, and a cut to the insurance pool, each a tunable percentage. Early on the insurance cut is weighted heavily to build the pool; once its reserves are stress-tested against the volume the core carries, the insurance cut eases back and more of the excess returns to the DAO or the writer. Insurance accrues from the very auctions it later has to backstop.

It bids like any trader, only at the top

Insurance does not passively cover a gap. It participates in the auction through its Trader.sol, driven by a keeper, and it only steps in at max budget, so ordinary fillers get first claim at every lower offer and insurance is the buyer of last resort. When it does step in, it takes the short on and is paid the full budget (the seized margin plus the bond) for doing so, which funds the position it now has to back.

Recollateralizing: perp or spread

Taking a force-closed short on can be done two ways:

• Perp-novation. Open a perp cover and back the short like any writer, locking a bond. The pool collects the premium but takes on the perp risk, and if that cover is itself liquidated, a fresh auction opens on it.
• Spread-novation. Instead of a perp, buy a capping long and lock only the width. An auction on a $2,000 call is taken by buying a $2,200 long and locking $200, no perp, defined risk. This lets a CLOB-based pool avoid directional exposure entirely.

The functions are permissionless and gated

None of this is insurance-specific in the core. The actions are ordinary functions anyone can call, each gated to check that the action is valid:

• buyPerp opens a perp only after reading core state and confirming an option actually needs a backstop, at a leverage the insurance admin sets.
• acceptAuction takes the offer once the perp is in place; the account takes the short and receives the margin and bond that fund it.
• closePerp reduces the cover only when no short obligation still relies on the part being closed, the same floor every writer's cover management respects.

The falling-knife problem, and why it is bounded

The real risk in perp-novation is longing a falling knife, an asset moving hard against the cover. The mitigant is in the smile: calibrate it so the bond plus margin, in the worst case, makes the max-budget offer at least as good as the going rate, and the option's own long holders will want to close the auction by buying the long before it ever reaches insurance. The same sharp move that would hurt an insurance perp is exactly when the market clears the auction first.

Related