The cash vault

One public vault funds every draw on the desk, at every hour. Depositors put in USDG, hold internal shares, and earn the interest margin users pay, less the protocol skim.

Shares and vault value

A vault position is a share count in the vault's own ledger, not a token: shares have no transfer, no approve and no ERC-20 interface. Everything a depositor sees is a share count and a share price. With U the vault's cash, P the principal drawn across all margin accounts, A the accrued unrealised interest at the gross rate, k the skim rate and S the total shares:

A deposit mints shares at NAV, a claim burns them at NAV, and a draw converts U into P one for one, so none of those move the share price. Yield shows up as continuous NAV drift: the skim-net 80.00% of every second of accrued interest is marked into V as it accrues. That is why the daily charge does not move NAV either. Realisation only converts P and A into U at the value already marked, with the skim leaving through a balance that was never inside V. The first deposit bootstraps the ledger 1:1 and donates a small dead share balance to a burn address, which closes the classic first-depositor share attack.

Deposit cap and utilisation

Deposits are capped so yield is not diluted by idle cash. The cap starts at the launch value of $5,000,000 and ratchets to 1.6x the outstanding book (P + A) whenever that is higher. Anyone may recompute it, the keeper does so daily, and it only moves up; governance can lower it but never below the launch cap.

On the other side, new draws are blocked once utilisation, (P + A) / V, would pass 90.00%, and blocked entirely while the withdrawal claim queue is worth more than the vault's cash. Existing positions are untouched by both gates; they only stop new buying power.

Withdrawals

Withdrawals run through a queue with a 2 days delay. Requesting locks your shares immediately; the payout is valued at the NAV on the day you claim, so you keep earning drift through the delay and you bear any NAV change during it. That is what makes the vault a real risk position rather than a fixed-rate note. When cash is short, claims are paid strictly in request order: a later claim cannot jump an earlier one that is still waiting, and claims clear one by one as sells and repayments refill the vault. Draws resume as soon as cash covers the remaining queue. A pending request can be cancelled at any time, which returns the shares; a new request joins the back of the queue.

The skim state machine

The skim is 20.00% of gross interest, so depositors keep the other 80.00% of every second that accrues. The rate is movable only within 10.00% to 20.00%, and it stands at that ceiling today: governance can lower the skim, and can never raise it. Where the skim cash goes depends on the state of the insurance line, a USDG balance held inside the vault contract but excluded from V, with a target of 4.00% of V:

The ledger is identical in every state, depositors always earn the 80.00% share. Only the destination of the skim cash changes. Anyone may also seed the insurance line directly, which is how it reaches target ahead of the years the skim alone would take.

Bad debt and the waterfall

The insurance line exists for one purpose: absorbing bad debt before depositors do. When an account is written off after a forced sale, the loss lands in order: the forced sale penalty on the affected account (already vault income), then the insurance line, then vault NAV pro rata across depositors. There is no smoothing, the NAV drop is immediate, and the line's only outflow is bad debt; governance cannot withdraw it. No tranche, no token backstop: $CALL is never sold to cover vault losses.

Protocol revenue and the sweep

The protocol's side of the skim accrues in a separate balance, also outside V. A permissionless sweepProtocolRevenue() transfers the whole balance to the foundation treasury and nowhere else: the destination is pinned write-once, there is no split on the way out and no callback into any other contract. Revenue funds the protocol and, before that, the insurance line that protects depositors; none of it is allocated to $CALL. See $CALL and staking for what the token does instead, and Parameters for every live value on this page.