Mechanism

Pricing object.

p is a bounded martingale on [0,1] with a single scheduled jump at a known date. As a martingale it has no drift to trade:

E[p_T | F_t] = p_t

Because it is bounded, its instantaneous variance scales with p(1−p) — maximal at 0.5 and vanishing at 0 and 1. Between events p sits nearly still; at the readout it converges to one of the two certainties {0,1}. The realized variance is therefore essentially (Δp)², delivered at one instant — not ∫σ²dt accumulated over a path.

A catalyst market has no external re-anchoring price: resolution terminates the market rather than grading it. The reference price must be manufactured inside the mechanism — which is what Layer 1 does.

Layer 1 — anchor.

The anchor is a liquidity-sensitive LMSR (Hanson-class). Its cost function and marginal price are:

C(q) = b · ln(e^q_Y/b + e^q_N/b),   b = α(q_Y + q_N)
price_Yes = e^q_Y/b / (e^q_Y/b + e^q_N/b)

The maker is counterparty of last resort at every price: a quote always exists, with no matched counterparty required.

Worst-case maker loss

The worst-case maker loss is a closed-form on-chain view. For the deployed symmetric seed it is 6.9315 USDC — Halmos-proved to 2⁹⁶ shares and exercised under a 262,144-sequence stateful fuzz that includes a 380M-share adversarial drive; deployed and verified on Base Sepolia. The naive textbook b₀·ln2 bound understates the worst case by roughly 23× for asymmetric seeds, so the exact closed form is used instead.

Depth, not price

A subsidy buys depth — a larger, more expensive-to-move book — but it cannot set a price level. A deliberately skewed 180/20 seed rests at 0.50000 under balanced flow; only informed, directional flow moves p.

Vol machinery.

A delta-hedged option collects ½·ΓS²σ²dt (gamma rent) — a bet on realized variance — and the 1/K²-weighted strip is the log contract, the variance swap, and the VIX. Carr–Lee extends this to functions of variance via the Hull–White conditioning trick. All of it rests on three assumptions:

1. a continuous path, no jumps;
2. unbounded, roughly lognormal support;
3. returns independent of the volatility level.

p violates all three by definition: it is defined by its jump (there is no path to hedge through); it lives on [0,1] (lognormal support fails and implied vol collapses at the boundaries); and its variance is tied to its level through p(1−p) (which negates independence).

Therefore there is no log contract, no variance swap, and no Black–Scholes on p. The tractable object is the expected squared belief revision, E[(Δp)²]. A strike continuum is degenerate: the terminal distribution is the two points {0,1}, so every interior strike is a linear combination of them. A single magnitude contract prices everything a ladder would.

Layer 2 — conservation.

In a zero-sum book at binary settlement with symmetric leverage L, the winner's return multiple is 1/p — equal to the spot multiple. Since leverage cancels identically, a fully-collateralized perpetual on a binary is functionally equivalent to a spot token.

Corollary: settlement leverage cannot be manufactured in a zero-sum book, only underwritten. The over-collateralizing party is the underwriting fund F, and the funding rate is the premium the crowded side pays each interval to the warehouse holding the unhedgeable jump.

Solvency invariant

The fund covers each side's full winnings independently:

max(Σ_longs q_i(1−p_i), Σ_shorts q_j·p_j) + interimReserve ≤ F

The cross-side-coverage alternative — netting one side's winners against the other's — was falsified by stateful fuzz. Note that L is absent from the invariant: leverage sets a trader's margin but buys no open-interest capacity. Per-side capacity is 2F regardless of L; leverage is bought only by F's capital.

Funding control

Funding is a clamped control with a characterized stability boundary and two characterized failure modes: over-gain becomes a bounded limit cycle; one-sided demand beyond a saturation threshold decouples the mark from the anchor — and one-sided flow is the base case at a catalyst. On-chain funding has been verified at −0.26%.

Instrument ordering

We plan on launching a dated future first since its funding tether and solvency invariant are arguably robust. The future is near-redundant with spot (linear in p). The straddle/variance contract is the second intended instrument: it delivers convexity in the size of the move and is trivially safer since a bounded payout is fully collateralizable, so it needs no fund and no auto-deleveraging.

Auto-deleveraging is base-case. On a guaranteed terminal jump each loser's leveraged margin covers only 1/L of its loss, so an undersized fund haircuts winners in ordinary operation. The protocol guarantees zero protocol loss only.

Liquidity.

Price discovery is fundamentally different from liquidity. With continuous price discovery, a quote always exists. Functional liquidity implies a counterparty always exists to absorb size. They are different problems. Natural two-sided flow does not exist for a binary; liquidity is a professional risk warehouse, paid and capitalized to quote a book it cannot hedge.

The warehouse's break-even has two terms: an adverse-selection cost (the mean loss to informed flow, priced per-market from the measured informed share X) and a jump-risk premium (the unhedgeable variance, sized to E[(Δp)²]).

Diversification

Per-market risk contribution diversifies as

σ·√(ρ + (1−ρ)/N)  →  σ√ρ

converging to the correlation floor σ√ρ as the book grows. Three constraints bind that ideal:

1. informed flow concentrates where edge is most attainable, raising effective ρ in markets where diversification should help – forcing position caps and per-market spread pricing;
2. hedgeability gradient – names with listed options allow the LP to lay off part of their exposure, so the venue would open in hedgeable-correlate names, and optionless names are marked as "thin but priced";
3. role sequencing – cold starts are achieved via subsidized LMSRs plus pooled vault LPs, transitioning to designated market-makers as markets grow in volume.

In a mainnet reproduction, per-maker adverse selection is bimodal — 40 of 108 makers negative at 30 minutes, with monotone erosion over the horizon — yet aggregate maker P&L was net positive (+$18.8k) and the bled cohort lost only −$799, about 4% of gross maker profit. Aggregate economics are venue-, flow-, and sizing-dependent.

Security.

Because money buys depth and not price, security is regime-conditional. In a thin anchor no leverage above 1 is safe at any informed share. In a liquid anchor security is flat in leverage out to very high L. The leverage cap is therefore meaningful only inside the liquid regime the subsidy exists to maintain — security and subsidy economics are one argument, not two.

The corollary is blunt: the anchor is exactly as good as the informed share trading it. The prohibited-participant screen — insiders and holders of material non-public information — is a mechanism-security requirement, not a compliance overlay.

Pilot unknowns.

The pilot measures three properties of participation, not of the mechanism:

X — informed share

Secures the anchor; a listing bar measured per-market over repeated readouts. The estimator is "confidently wrong on size, not blind" under confounding — a live X is a floor, not a point.

κ — demand elasticity

Stabilizes the funding control and retunes its parameters.

D — demand depth

Demand depth at a usable spread. It decides whether the warehouse is a business.