The equity vaults
Twenty vaults that create the stock-against-fyUSD market the protocol was missing, what they buy in depth, and the honest size of what that is.
Spec v0.9.1, reviewed 2026-09-08
There is no venue anywhere that trades a Robinhood stock token directly against fyUSD. Without one, a liquidator who seizes collateral has no atomic way back to fyUSD, and the wrapper selling its inventory has to route through USDG. The vaults create that venue: one Uniswap v4 pool per branch, held by one contract, funded by whoever wants to and paid in staked FBR.
No risk parameter reads a vault. The exit depth measurement reads the pool, like any other pool, because that liquidity is real.
Rule R-19.15, decisions D146 to D155
The pool, and the gate on it
The pool key is the branch's stock token against fyUSD, a fee of 0.5%, tick spacing 50, and one hook. Two assertions tie the range to the recentring rule at deployment: the upper bound sits at least ten points above the recentring trigger, and the lower bound at least twenty-five points below it, so a vault can never be recentred into its own edge. The vault holds its positions directly at the pool manager rather than through a position NFT, so the position key is computable at deployment and one immutable contract faces the manager.
LPGate carries a single permission: before liquidity is added. It reverts unless the caller is one of the twenty vaults. It cannot touch a swap, cannot touch a withdrawal, and cannot modify an amount, which is why it still qualifies as a price source.
The consequence is stated plainly: all of the pool's fees belong to the protocol, no third party can front-run a swap with just-in-time liquidity, and the pool dies with the vault. Anybody may open an ungated stock/fyUSD pool alongside it at any time.
Rule R-19.15.7, Rule R-3.20.3
Two positions, and no swap ever
The vault holds a two-sided position A centred on c, and at most one single-asset position B on one side of it.
| Tier | Range below | Range above | fyUSD at the centre | Depth per 1%, of the vault | fyUSD left at −20% |
|---|---|---|---|---|---|
| 1 | 40% | 25% | 68.1% | 1.51% | 53% |
| 2 | 55% | 35% | 70.3% | 1.07% | 68% |
| 3 | 65% | 45% | 70.7% | 0.87% | 74% |
A stock/fyUSD vault is about seventy per cent fyUSD by construction. That fyUSD is a standing bid: it buys the stock as the stock falls, which is exactly what a liquidation needs on the other side.
These ranges are measured, and frozen
The simulation ran: five years of history, twenty names, every stress window. Over all of it a vault was never left without liquidity at the current price, and it still held 26% of its fyUSD at the worst episode. The ranges are wider than the ones first drafted, and what the width costs is depth at the centre: 19 to 30% less than the narrower set would have given. On SPY that is 7 to 15 thousand dollars per 1% in the first year rather than 10 to 20. The trade was made deliberately and it is now fixed at deployment like every other constant.
Recentring is permissionless and happens only when the branch is at full price quality, the reference price has moved at least 15% from the centre, at least 24 hours have passed since the last one, and the vault's own pool sits within 1% of the composite. The vault withdraws both positions, sets the new centre to the reference price, redeposits the largest matched pair into the new two-sided range, and puts the leftover into the single-sided one. That leftover is stock or fyUSD, never both.
A vault never swaps
No vault emits a swap on any pool, ever. It never buys, never sells, and never reads the tick of its own pool for a decision; it reads only the branch's reference price. A liquidity provider cannot trigger a recentring by pushing their own pool.
Rule R-19.15.1, invariant 60
After an upward recentring the leftover is fyUSD sitting below the new price: a wall of bids exactly where a liquidation would sell. After a fall it is stock sitting above: the vault sells back on the rebound what it bought on the way down.
Shares, in kind, with no price
A deposit pairs what it can against the ratio the vault currently holds and returns the excess of whichever asset was oversupplied. There is no tolerance to hit and no RatioMismatch to fail on. Shares are minted as a fraction of the holdings, and a withdrawal returns that fraction of each asset in kind.
No price enters the share accounting
A depositor brings the same basket the vault holds and receives its fraction. Pushing the tick before a deposit changes the basket for everybody equally and changes nobody's share. There is nothing to sandwich.
Rule R-19.15.2
Supplying only one of the two assets is a front-end operation outside the protocol: the interface swaps the missing leg, with the user's own minimum, then deposits. No zapper sits on the critical path.
A deposit is refused, with PoolOffPrice, while the vault's pool sits further than 1% from the composite price. The pool is briefly off price and somebody is about to arbitrage it; entering then would mean buying the wrong side and being taken out of it within minutes. The interface says so and asks the user to try again in a few minutes.
When the stock token stops moving
If the issuer freezes the stock token, a withdrawal still returns the fyUSD side. The stock side stays claimable separately, through claimStock, and is paid the moment transfers work again. After 7 days of a blocked transfer the locks fall, so a lot with a year to run does not keep somebody inside a position that cannot move. The frozen stock stays frozen: nothing here unfreezes it, and NothingStuck is what a caller gets when there is nothing waiting.
Locks
| Step | Duration | Points multiplier |
|---|---|---|
| 0 | 7 days minimum | 1.0 |
| 1 | 90 days | 1.5 |
| 2 | 180 days | 2.0 |
| 3 | 365 days | 3.0× |
Each deposit is a lot with its own unlock date and multiplier, at most 8 per holder before they merge. Locked shares are neither transferable nor withdrawable. There is no early exit, no penalty and no buyback: the lock is the only thing the programme actually buys, and a paid exit during a crash is precisely the exit it exists to prevent.
Two mechanical exceptions exist, both permissionless and neither of them a choice: unlockAll() as soon as the branch is shut down or the terminal mode has started, and the same release after 7 days of a stock token that will not transfer.
Rule R-19.15.3
The fees, and where they go
harvest() is permissionless, once an hour at most. It realises the accrued fees on both positions and routes them.
| Share | Destination | What happens to it |
|---|---|---|
| 50% | the FBR distributor | the reserve first, then a bounded buyback credited into existing stakes |
| 25% | locked lots only | claimable in fyUSD, in proportion to shares times multiplier |
| 25% | the interest router | mostly to the Stability Pools, split by unbacked debt |
Lots at the shortest step receive none of the second share. They carry multiplier 1.0 and a free exit, which is what they chose.
While no lot of ninety days or more is alive on a vault, that quarter is not held back for whoever locks up later: it goes to the splitter, and the effective split becomes 50 / 0 / 50.
The stock side of the fees is sold by a VaultSale, which is the same contract as the wrapper's collateral sale: a discount rising from zero to 3% over six hours, at full price quality only, under its own bucket. A lot smaller than $250 does not start a sale at all, so the discount is not spent on dust. The vault never swaps in its own pool, because it would pay itself a fee and hand anybody a free way to move the tick.
Uniswap's own protocol fee controller can take up to 0.1% of each swap on any pool. That is up to a fifth of the vault fees, it cannot be prevented, and it is stated.
Rule R-19.15.6, Rule R-19.15.8
As a price source
Each vault pool is registered at deployment as an on-chain source of its branch, alongside the USDG pools and never instead of them, and in the depth measurement. Because it is quoted in fyUSD rather than USDG, its price is converted by a peg factor read from the canonical fyUSD/USDG pool and clamped to 2%. Outside that band the source is absent: a discounted fyUSD is not a unit of account.
It adds no signer group. Two on-chain pools are one group, whichever assets they hold.
In the first year it will not count at all. Qualification needs 0.10× of the reference depth, which is 200,000 dollars per 1% for a fund and 100,000 for a single name, and the programme buys far less than that. Until then the vault pool contributes only to exit depth, and there only for its locked share: lots more than 24 hours from unlocking. The depth indicator publishes the total and the locked figure separately. See caps and liquidity.
Rule R-19.15.8, decision D155
What this actually buys
The honest size of the programme
At the emission the seasons allow, a tier 1 vault sustains roughly one to two million dollars of locked value, which is 7 to 15 thousand dollars of depth per 1% of price move in the first year. The wider ranges bought resilience with depth at the centre, and this is the price. The ceilings the protocol lends against assume 250,000 to 375,000 dollars per 1%, and a pool counting as a deep price source needs 500,000 to one million. The programme buys a floor, not the protocol's depth, and it must never be presented as the latter. QQQ, being dormant, receives nothing at all.
Three further facts belong on the same page. A vault provider is a Stability Pool depositor without the bonus: the pool buys below the market with a discount of 2% to 4%, the vault buys at the market and pays a fee it does not receive. The impermanent loss of a concentrated range is several times that of a full-width one, and past the lower bound the provider holds nothing but the stock. A tier 1 vault still holds 53% of its fyUSD at a 20% fall and reaches its lower bound only at 40%, below which it is entirely stock and falls with it. And incentivised liquidity leaves: expect half to four fifths of the vault value to go between the fourth and the eighth season, staggered by the locks.
Nothing in the protocol depends on any of that. The depth measurement sums every pool, the ratchet absorbs a fall at 10% a day, no cap is reserved for a vault, and a vault that empties makes every one of its functions a no-op.
Rule R-19.15.9
The loop that has no bound
A tier 1 vault at 20% down has pushed nearly half of its value out as fyUSD, into the hands of whoever sold it stock. Some of that fyUSD arrives at the peg module's exit, which is never closable, against a reserve of about 10% of supply. The amplification is proportional to vault holdings divided by that reserve.
The protocol places no cap on it. What exists is an indicator, vault holdings over reserve, with an alert above one. Read peg and reserve risk.
Rule R-19.15.10
What follows from this page
- The provider's guide: provide liquidity.
- What the reward is and how it leaves: FBR and sFBR.
- The full risk statement: vault risk.
Caps and liquidity
How much Fyber lends is a function of measured exit depth, measured pool depth and a dated ladder, and of no number anybody sets after deployment.
FBR internals
Seven contracts, a fixed supply distributed by on-chain counters, a staking weight that does five jobs, an exit grid that prices impatience, and an invariant that keeps all of it out of the risk layer.