Underwriting vaults and collateralisation

Underwriters provide the USDC that pays cover. They deposit into the vault of one trigger tier and earn the premiums paid for cover in that tier. In return, they accept that a single halt can take most of their deposit.

All figures on this page are illustrative, and this is the intended design: the contracts are not deployed.

One vault per tier#

There are three vaults, one for each trigger tier: the 15 min tier, the 1 h tier and the 3 h tier. An underwriter chooses a tier and deposits USDC into its vault. A vault backs cover in its own tier only, and pays out only when that tier is triggered.

Choosing a tier is choosing a risk profile. Cover in the 15 min tier carries the highest illustrative rate, 12% of payout size per 30-day period, and is triggered by the most halts. Cover in the 3 h tier carries the lowest, 1%, and is triggered only by the longest halts.

What underwriters earn#

90% of every premium paid for cover in a tier is credited to that tier's vault and shared pro rata by its underwriters. The other 10% is the protocol fee; see Fees.

Premium income depends on how much cover is sold. A vault with no cover outstanding earns nothing. A vault at capacity earns the most it can, and is exposed to the largest loss.

The capacity rule#

For each tier:

cover outstanding ≤ vault assets + staked first-loss capital

Cover outstanding in a tier can never exceed its vault assets plus the first-loss capital staked for it. When a tier is at capacity, no more cover can be bought in it until capacity frees up, through new deposits, new stake or cover positions expiring.

Why every tier is fully collateralised#

Every cover position in a tier pays on the same event. A halt longer than the threshold triggers every active position in that tier at the same moment. There is no diversification across positions: if one pays, all pay. A tier that had sold more cover than it could pay at once would fall short exactly when it is needed.

Nested tiers apply the same logic across vaults. A halt longer than 3 h triggers all three tiers together, so no vault can count on another tier's assets. Each tier must be able to pay all of its cover by itself.

Utilisation#

Utilisation is cover outstanding divided by capacity, where capacity is vault assets plus staked first-loss capital. A tier at 100% utilisation is at capacity.

For a 15 min tier with 1,000,000 USDC of vault assets and 100,000 USDC of first-loss capital:

Higher utilisation means more premium income and a larger loss if the tier is triggered. In both rows, the first-loss capital absorbs the first 100,000 USDC of payouts.

Loss waterfall#

When a tier is triggered, its payouts are absorbed in this order:

1. First-loss capital. Staked $STALL absorbs payouts first, up to its full amount.
2. The tier's vault. The vault pays the remainder, pro rata across underwriters.

Underwriters lose only when payouts exceed the first-loss capital. How staked $STALL is valued against USDC payouts has not been finalised; see valuing staked $STALL.

Withdrawals and locked assets#

In the intended design, vault assets that back active cover remain locked until those cover positions expire. Only unencumbered assets, the part of the vault not needed to back cover outstanding, can be withdrawn. An underwriter in a vault at or near capacity may have to wait for cover positions to expire before withdrawing.

Withdrawals cannot be used to step aside during a halt. Nothing executes on Base while it is halted, and the assets backing cover are locked in any case.

Risk to underwriters#

• A single halt can take most of a deposit. In example D, underwriters in a 15 min vault at capacity lose 881,200 USDC net on 1,000,000 USDC deposited.
• Losses are correlated. Every position in a tier triggers at once, and a long halt triggers all three tiers together.
• Premiums are set in advance. Whether they compensate for the risk depends on how often halts exceed the threshold, and past incidents do not predict future ones.
• Capital is locked while it backs active cover.
• Smart contract and oracle risk. The contracts are not deployed and no audit has been published.

See Risks for the full list.