Volatility and the borrowing limit
How much you may borrow is recomputed once a day from what the stock actually did over the last 7 and 30 days, under a fixed ceiling and above a fixed floor, while the liquidation threshold never moves.
Spec v0.9.1, reviewed 2026-09-08
The grid of 80%, 75% and 65% is a ceiling. The figure that governs a new position is computed from the realised volatility of the collateral, once every 24 hours, by one contract per branch that reads nothing else and is read by nothing else.
The liquidation threshold never reads it. A borrower who opened at the ceiling on a calm day and watches volatility triple is no closer to being liquidated than they were. Nor are they trapped: taking collateral back while repaying at least proportionally is judged on the tier ceiling, not on the lower limit of that day.
Rule R-5.2.1, Rule R-19.16, decisions D159 and D160
The formula
A position opened at a loan-to-value L becomes liquidatable when the price has lost 1 − L × MCR. The rule requires that loss to exceed the volatility-scaled move of a chosen horizon, plus a margin.
The borrowing limit of the day
1 − L × MCR ≥ K_VOL × σ × √(H_VOL ÷ 365) + MARGE_VOL
ltvMax = clamp( (1 − 2.33× × max(σ7, σ30) × √(3 days ÷ 365) − 2%) ÷ MCR , LTV_floor , LTV_cap )
CR_mint_dyn = 1 ÷ ltvMax, then CR_mint_eff = CR_mint_dyn ÷ (1 − h)
Two protections multiply. The first is the volatility of the underlying, recomputed daily. The second is the quality of the price sources, recomputed at every poke as the haircut h of the composite price. A borrower faces their product.
| Constant | Value | Why |
|---|---|---|
K_VOL | 2.33× | The one-sided 99% quantile. At the moment of opening, the position is not liquidatable within the horizon in 99 out of 100 trajectories of the current volatility |
H_VOL | 3 days | A weekend plus a session: the time a tier 2 branch without a signed feed can be frozen, plus a day to react |
MARGE_VOL | 2% | The execution gap between two pokes, and the estimation error on a volatility read from seven returns |
LTV_cap | 80% / 75% / 65% | The founder's grid, read as a ceiling |
LTV_floor | 60% / 50% / 40% | Borrowing never dies. Tier 1 reaches its floor only around 130% annualised volatility, never seen on an index |
SIGMA_PRIOR | 25% / 50% / 80% | What is assumed while the history is short: a new branch opens prudently |
How the sample is taken
sample() is permissionless and is also called at the head of open, borrow and withdraw. It takes one sample per fixed slot of 24 hours, aligned on midnight UTC, rather than on a delay running from the last call, so the series is a calendar rather than a record of who happened to call. It does nothing while the branch is frozen or halted, and nothing when the reference price is zero.
The value written is the median of 3 readings taken across the slot. One poked price cannot become the day's sample, which is what closes the cheapest way to push the series.
What is computed from the ring
for each window w, being 7 days and then 30 days, over the samples newer than now − w:
r_i = ln(p_i ÷ p_i−1), Δt_i = (ts_i − ts_i−1) in days
σ_w² = Σ r_i² ÷ Σ Δt_i × 365
if Σ Δt_i < w ÷ 2, then σ_w = SIGMA_PRIOR of the tier
σ_eff = max(σ7, σ30)
Taking the larger of the two windows is the asymmetry that matters: the limit falls quickly after a shock, because the 7-day figure reacts within days, and rises slowly, because the 30-day figure keeps a month of memory. Thirty-two slots give thirty-one returns, so a full thirty-day window plus a margin.
Degraded hours are sampled, at the conservative price, which raises the measured volatility rather than lowering it. Frozen and halted hours are not sampled at all: the next return covers the gap and is weighted by the elapsed time, so skipping samples reduces nothing.
A dormant branch fills the same series from its hourly price readings, which are taken anyway for the activation criteria. The covered-window condition therefore fills itself, and no dedicated keeper is needed to make a branch eligible to open.
A split or a dividend no longer purges anything. The multiplier change is handled where it belongs, in the price itself, so the series survives it. The earlier behaviour dropped the limit toward its prior for a fortnight after every corporate action, several times a year, for no risk that had actually appeared.
Rule R-19.16.1, Rule R-19.16.2
What it never touches
Your threshold does not move
MCR, CR_target, CCR, SCR, the fourth cap step, the branch debt ceiling, the pool
requirement, the liquidation buckets, redemption, the peg module and every constructor assertion
read the tier ceiling and the fixed threshold. None of them reads the volatility oracle. Only
open, borrow and a withdrawal that increases risk do, plus the activation criterion that
requires a covered window.
Rule R-19.16.4, decision D160, invariant 68
A withdrawal that leaves the position no riskier than it was, because at least a proportional share of the debt is repaid alongside it, is measured against the tier ceiling instead. That is what keeps a position openable and unwindable on the same terms, whatever the volatility did in between.
At an extreme volatility the limit reaches its floor of 60%, 50% or 40% and stops there. It blocks nothing: borrowing continues at the floor, and every way of reducing a position stays open.
A threshold that moved with volatility was designed, compared and rejected. It would have broken the one promise a borrower is given, and it would have created liquidations caused by a parameter rather than by a price. It also opens an attack that the fixed threshold does not have: pushing volatility up for thirty days to raise everybody's threshold at once.
Three years of measured history
Daily closes from 18 October 2023 to 4 September 2026, 723 windows, close to close, log returns weighted by calendar time and annualised. These are measurements of the past, not forecasts.
| Name | Tier | Median 30-day volatility | Median limit | Lowest limit | Share of time at the ceiling |
|---|---|---|---|---|---|
| SPY | 1 | 12.4% | 80% | 68.2% on 9 April 2025 | 96% |
| GLD | 1 | 16.6% | 80% | 67.1% on 3 February 2026 | 78% |
| AAPL | 2 | 23.1% | 75% | 55.5% on 9 April 2025 | 72% |
| NVDA | 2 | 40.0% | 72.8% | 53.8% on 31 January 2025 | 13% |
| TSLA | 3 | 52.3% | 61.6% | 42.7% on 10 April 2025 | 3% |
| COIN | 3 | 71.8% | 58.4% | 40%, the floor, on 6 November 2024 | 0% |
The floors bit once in three years across the six names. On the lively ones the ceiling is the limit of a calm day, and an interface is required to lead with the figure of the day.
The label is fixed: the current figure first, the ceiling in brackets after it. "Max now: 70.6% (ceiling for the category: 75%)", and never the other way round. Putting the ceiling first would advertise a limit that a lively stock reaches 13% of the time (Rule R-15.2.1).
April 2025 on SPY, week by week
| Date | 7-day volatility | 30-day volatility | Limit |
|---|---|---|---|
| 2 April | 16% | 20% | 80% |
| 9 April | 92% | 47% | 68.2% |
| 16 April | 39% | 50% | 76% |
| 1 May | 9% | 51% | 76% |
| 8 May | 14% | 43% | 77% |
| 15 May | 24% | 22% | 80% |
Twelve points of limit lost in one week, eight recovered in the next, and five weeks to return to the ceiling. The 30-day memory is what holds the limit down through the rebound, and it is deliberate.
A borrower who opened on 2 April at 79% was liquidatable after the −10.5% of 3 and 4 April, partially, at the same threshold as before. The dynamic limit changed nothing for them: it governs the next position, not the open one. A borrower opening on 9 April at 67% tolerated a further fall of 23% before reaching the threshold, where at the ceiling they would have tolerated 8%.
Edge cases
| Case | What happens |
|---|---|
| A fall of 20% in one day | The 7-day figure exceeds 160% annualised, so the limit sits at its floor for a week, then near 68% for a month. No open position is touched, borrowing continues at the floor, and taking collateral back against a proportional repayment is judged on the ceiling |
| No volatility at all | The limit rises to the tier ceiling, which is the worst case and is exactly the previous version's behaviour. The source haircut still applies if the sources are poor |
| A newly opened branch | The prior applies to any window covered less than halfway. A tier 2 branch opens near 72% rather than at its ceiling, and criterion 5 requires 15 days of real samples first |
| A rebound of 10% in a day | The limit falls, because squared returns do not care about direction. Volatility is symmetric and so is this |
| A split or a dividend | Nothing. The multiplier is handled in the price, the series is continuous, and the limit does not move because of it |
| USDG moving off its peg | The reference price is in dollars, converted by the same feed the peg module reads, so a stablecoin move does not enter the volatility at all |
What an attacker gets
Pushing volatility up means moving the reference price on a sampling day. That is the composite manipulation priced in the composite price: one to two million dollars of slippage and twenty to forty million dollars of capital to hold SPY 4% away for fifteen minutes. A 4% round trip across two samples raises the 7-day figure to about 41% and costs borrowers 2.3 points of limit for seven days. Nothing is blocked, because of the floor, and the attacker gains nothing.
Pushing it down is not available. A realised variance cannot be un-realised. Skipping samples does not help, because the returns are weighted by the elapsed time between them. Moving the reference price within a block moves it by less than two basis points, because the price is a truncated average of a median.
Rule R-19.16.6
What follows from this page
- What a borrower is shown, in two axes with a trend: your borrowing limit.
- The threshold that does not move: liquidations.
- The constants and their status: parameters.
Price regimes
Four states describing how well a branch can see its price, the exact table of what each one permits, and the three rules no state can break.
Liquidations
One threshold, one path, at every hour: the Stability Pool absorbs on the median of live markets, in slices, and stops entirely when those markets go quiet.