Nothing to liquidate

An entire generation of on-chain volatility products died the same way, and with one exception it was not a coding error. We designed around it by giving something up, and the thing we gave up is the interesting part.

What happened to everyone who tried this

Selling volatility on chain was one of the defining product ideas of 2021. Ribbon, Friktion and Dopex all launched vaults on the same premise: depositors put in capital, the vault writes options against it, premiums come back as yield. Simple to explain, simple to deposit into.

By 2026 the category is gone in the form it launched in. Friktion wound down. Dopex sunset its vaults and relaunched as Stryke. Lyra became Derive and moved to an order book, which is itself an admission — the pooled model was the part that did not work. Ribbon became Aevo, and in December 2025 its legacy vaults were exploited for $2.7 million after an oracle upgrade, roughly a third of what was left; Aevo stopped them and decommissioned them within days. The organic flow all of them were built to serve never arrived at the size required.

The post-mortems converge on one sentence: volatility was sold into thin, cyclical demand until premiums stopped covering the risk being written.

The same failure, four times

None of that was bad timing. The structure did it, and the structure is worth naming precisely, because it is easy to rebuild by accident.

In every one of those designs, a pool of passive capital stood on one side of a trade it could not hedge. Depositors were told they were earning yield. What they were actually doing was underwriting volatility — taking a position that pays a small premium most of the time and loses a large amount occasionally, without any of the machinery a desk would use to manage it.

LPs in a volatility vault are short an option they never priced, cannot hedge and are not staffed to monitor. The premium is visible daily. The risk arrives once.

The AMM variants had it worse. Lyra and its peers had to quote a price for volatility continuously, which means being wrong continuously in one direction or the other. When quotes were stale or mispriced, traders took the difference and LPs paid it. The protocol needed to be a market maker without a market maker's hedging, inventory management or willingness to stop quoting.

The Aevo exploit is the apparent exception, and it is worth being exact about. That one really was a coding failure — an oracle upgrade that mismatched decimal precision and left prices writable. But it landed on vaults that had already stopped attracting the flow they were built for, and the answer was to decommission them, not repair them. The bug decided the date. It did not decide the outcome.

The rest were not bugs at all. Every one of those protocols could have had flawless code and arrived at the same place.

Squeeth, and what a continuous position costs

Opyn tried something different with Squeeth, and it deserves better than being filed with the failures. It was a power perpetual — exposure to the square of ETH's price, which makes it a clean way to be long volatility without options, expiries or strikes. It ran for roughly a thousand days, carried over a billion dollars of exposure, and closed on 4 November 2024 with every position settled at zero fees and no price impact. The team called it a retirement, and on the numbers that is fair — the mechanism worked as designed throughout.

But a power perp has no expiry, and something has to make holding it cost what it is worth. That something is a continuous funding rate — and the funding on squared exposure is, economically, the expected variance. Holding the position means paying that, every day, indefinitely.

Nothing was implemented badly there. That is what the instrument is: a perpetual claim on variance costs the variance to hold. For a hedger it means the hedge bleeds every day the thing being hedged fails to happen.

Bounded on both sides

The trade we settle is a variance swap: one side receives realized variance, the other receives the strike, and the difference changes hands at expiry. It is the oldest instrument in this space, traded by banks since the late nineties, and one of its properties matters far more on chain than it ever did off it.

With a cap on the payout, both sides have a maximum loss that is known when the trade opens:

long  can lose at most   notional × K              (realized variance of zero)
short can lose at most   notional × (cap − 1) × K  (realized above the cap)

together                 notional × cap × K

Which is exactly the largest payout the contract can ever owe. So both sides deposit their worst case up front, and the pot equals the maximum obligation by construction.

Payouts sum to deposits by construction: the short side is paid the remainder of a pot whose size never changes. There is nothing here to monitor.

Everything that stops being necessary

Full collateralisation is usually treated as a concession. What it does in practice is delete most of a protocol.

No liquidator. Nothing can become undercollateralised, so nobody has to be paid to notice. Lending markets have been taken down repeatedly by liquidations that stopped clearing when gas spiked. There is no version of that failure here.

No latency requirement on the price source. It is read once, after expiry. Being slow costs nothing, because nothing has to react to it. That matters more than it first sounds: it lets the oracle be a time-weighted average, which is expensive to manipulate, where a fast feed is cheap.

Nobody passive. Every position is matched against someone who chose that side of that series and posted their own worst case to take it. No pool stands in the middle being wrong on everyone's behalf, because there is no pool.

What it costs

Capital efficiency, and it is not a small amount. A trade with a 20% volatility strike and a 2.5× cap locks 100 USDC per 1 000 of variance notional, split 40 to the long and 60 to the short. A margined design would ask for a fraction of that.

There is one relief valve, and it comes from the same property that makes variance easy to compute: variance is additive. Holding both sides of the same series is holding nothing, whatever the market does — so the contract lets anyone holding both legs collapse them and take the full collateral back at any point while the series is live, with no price and no oracle involved.

That is what makes market making possible at all. A dealer can quote both directions and recycle the same capital. Without it they would freeze double the collateral against positions that cancel.

Proving the identity actually holds

An identity that holds in the design and not in the code is worth nothing, and this is the one property everything else rests on. So it is checked four ways.

A symbolic solver proves that deposits sum to the pot for every parameter combination the contract permits: strike up to 1000% annualised, caps from 1.05× to 10×, any notional it will accept. Not a sample of them. All of them.

Underneath that sits fuzzing — five hundred runs per property on every commit, fifty thousand in CI, against random strikes, caps, notionals and realized variances — and two invariant suites that assert after every step of every generated sequence that every claim every holder could make is covered. That last check is computed account by account, because minting rounds down per account and an aggregate would be off by up to one unit per holder.

And then against the real thing. A series opened on one Base block and settled on another, six real hours later, reading the live pool: realized variance 0.0593, annualised 24% against a 20% strike, long paid 592.99 USDC and short 407.01, summing to exactly the 1 000 that went in.

The two holes it found

The invariants were not decorative. They caught two ways the pot could come up short, both invisible to every hand-written test and both only reachable at 512 runs and depth 128.

The first was a rounding failure that lost a whole unit. Matching is pro rata, and the fill ratio was stored as a fixed-point factor — but 3 × floor(1e18/3) is less than 1e18, so a subscriber of three units against a matched one received zero positions and a full refund, while their counterparty kept a fully matched position. At realized variance above the cap, that counterparty was owed 100 USDC against a pot holding 40.

The second was subtler. Distribution divided by the live matched figure, which falls as positions are netted — so a subscriber minting after somebody else had netted was measured against a smaller denominator and refunded collateral that was still backing a live position.

Both were failures of the identity, not of the maths. Deposits and payouts diverged by a path nobody would have thought to write a test for.

Where this stops being enough

Bounded losses make the contract solvent against any realized variance. They do not protect the settled number itself, which is a separate problem with its own price.

We measured it by carrying out the attack against a fork of the real pool. Pushing a million dollars through and reversing it in the same block moves the settled figure by nothing — two seconds of excursion inside a fifteen-minute average is nothing. Holding that dislocation for five minutes multiplies the settled variance by 15.7×, and pays for itself against a long position above roughly $1.5M.

Treat that $1.5M as a floor. On a fork the price stays where it is put, for free; on the live chain, holding a six percent dislocation on the deepest ETH pool on Base for five minutes means absorbing every arbitrage trade aimed at it from every other venue quoting ETH. The real bill is far larger, and unmeasured — which is why the defence is sized against the floor.

So there is a second bound, and it is a ratio rather than an amount: a series may not write more notional than moving its source one percent would cost. On the pool we target that is a little over a quarter of a million dollars, and it moves as the pool's liquidity does.

Full collateralisation removes counterparty risk. It does not remove the risk that the number everyone agreed to settle against was bought.

Squeeth shutdown details from Opyn's own announcement; Ribbon vault exploit figures as reported at the time of Aevo's decommissioning. Settlement, attack and invariant figures are reproducible from the repository.