Autonomous risk management

Each market prices its own risk: thin junior cover or scarce cash raises the borrow rate, and a thinner market lends less against the same collateral.

Updated Nov 9, 2026

No committee sets a market's risk terms. There is no credit spread to vote on and no listing review.

Each market reads risk from what its own users do: how much first-loss capital LPs commit, how much of its cash is lent out, how deep its curve is and where its price has been. It feeds those readings back into what borrowing costs and how much of it is allowed.

Governance sets the bands and bounds; the market finds the price inside them.

Two loops, one rate

The borrow rate answers two questions at once.

Is cash scarce? That is demand, read from utilization.

Is the debt well protected? That is risk, read from junior coverage: the first-loss capital LPs supply, against the debt it covers.

Each question has its own target band, and the rate keeps moving until both answers are acceptable.

Risk loop
  1. Junior capital
  2. Coverage
  3. Borrow rate
  4. Junior yield
  5. Junior capital
Demand loop
  1. Utilization
  2. Borrow rate
  3. Borrowing
  4. Utilization
Where they meet
  1. Utilization
  2. Coverage
  3. Borrow rate

When more cash is lent out than the utilization band allows (80% by default), the rate climbs; dearer credit slows new borrowing and rewards repayment, which brings utilization back. When junior capital covers too little of the debt (a coverage signal under 5% by default), the rate climbs as well; more interest raises what junior capital earns, which draws more of it in, or borrowers repay and the debt that needs cover shrinks.

The two loops are linked. The coverage signal is junior capital over the debt, discounted by the share of cash that is lent out, s=JD (1−u)s = \frac{J}{D}\,(1-u), so a market that is busy and thinly covered at once sees its signal fall twice over. Risk is priced inside the demand price rather than beside it.

The rate falls only when both loops are comfortable, so cheap credit is never bought with thin protection. Borrowing and rates has the rule and its map.

Junior capital is the signal

Tranching splits a market's LP capital into two claims on the same pool. The junior tranche takes funded losses first; senior takes losses only after all junior capital is gone. Both stay in the pool and keep earning swap fees and interest, so protection costs the market no idle capital.

How much capital chooses junior is a market decision, and it is the risk signal. If LPs think first-loss pay is too low, they stay senior, coverage falls and the rate starts to rise. If they think it is generous, junior fills up, coverage rises and borrowing gets cheaper.

Nobody sets a risk premium: LPs reveal it with their allocation.

The chicken game

Each LP would rather someone else took the first loss. But the junior tranche earns a fixed share of LP income, half by default, however much capital sits in it. When junior capital shrinks, the same income is split among fewer dollars, and each junior dollar earns more.

Yield a year by the junior tranche's share of capital
  • Junior
  • Senior
A market paying its LPs 10% a year on average, at the default 50% junior income share.

With a tenth of the capital junior, a junior dollar earns 50% a year here and a senior dollar about 5.6%. As junior capital drains, its yield climbs steeply, and the risk loop raises the borrow rate on top.

At some point the premium is high enough that capital returns. In a competitive market the last LP to choose is indifferent between the two tranches, after allowing for expected losses and the terms of leaving.

Those terms keep the game from ending in a stampede:

  • Leaving junior takes seven days' notice, plus up to three more as a larger share of junior capital queues to leave, so a rush waits longer than a single exit.
  • Capital in the queue stays junior. It keeps earning and keeps absorbing losses until it converts, so a request removes no protection.
  • Every exit request pays 50 bps of its jrLP to the market's permanent junior seed, which no one can withdraw.
  • A settings change waits the full junior notice plus a day, so junior capital can always leave before new rules apply.

Collateral is worth what the market can absorb

A loan is only as safe as the sale of its collateral. Collateral is valued by what selling it into the market would actually return, price impact included, on a deliberately pessimistic version of the curve:

  • Price. The lower of two moving averages. The symmetric one moves halfway only if a manipulator holds the price for a full half-life; the directional one snaps down on any fall and climbs back slowly.
  • Depth. The lower of the curve's observed depth and its moving average, the market's own liquidity oracle. Depth added to inflate a valuation counts only as the average catches up, while depth that leaves counts at once.
  • Shape. Only the full-range tail of the curve, never the concentrated depth that the next recentering can move.

A thin or newly drained market therefore lends less against the same collateral, with no parameter change. Once a loan is open its liquidation factor is stored, and health is marked at the symmetric average, so an LP withdrawal alone never makes an existing loan liquidatable. Pricing and oracles and Borrowing and rates have the formulas.

Limits that move with the market

LimitWhat it boundsMoves with
Collateral factorAt most 85%; borrowing stops at 95% of the liquidation limitThe pessimistic sale of the collateral
Daily borrow bucketNew public borrowing in an asset: 20% of conservative depth a day by default, at most 30%Smoothed depth
Market health floorBorrows that would take aggregate health below the floorAll open debt
CashLoans and withdrawals pay out only cash in the vaultUtilization
Leverage margins7%, 12% and 17% maintenance tiers by size against depth, plus crowding on the opening side; 20× is only a circuit breakerSide depth and crowding
Oracle guidanceA feed bends the curve only within its adjustment cap; a stale report stops price-sensitive actionsThe feed's own checks
Settings changesNo bundle executes while either side's utilization is at or above 80%Utilization

When a loss gets through

Recovery comes first. A keeper can atomically take a position's collateral for a fixed debt payment, and past a deeper emergency boundary the program can settle internally at smoothed prices and depth. If a sale still leaves debt unpaid, the loss burns junior capital first and reaches senior only after all junior capital is gone.

A loss that wipes out the junior tranche sets coverage to zero, so the rate doubles every half-life until junior capital returns or the debt is repaid. The market prices the missing protection itself. Liquidations and risk has the full waterfall.

What governance sets, and what it does not

A market's operator chooses the two bands, the rate's half-life, the junior income share (10–90%), the moving-average half-lives and the daily bucket, each inside fixed program limits and only after full notice. It never sets a market's risk premium, its collateral factors or who may borrow. Those come from the market's own depth and prices and from the capital its LPs commit.