The collateral invariant

This is the one page that matters most. Everything else in the protocol is a consequence of this idea.

The rule

An option cannot exist without full collateral already locked, and the payoff formula guarantees that collateral always covers what's owed, at any price, at any moment.

Not "usually covers." Not "covers under normal conditions." Always, by construction, because the math makes it structurally impossible for the number owed to exceed the number locked.

Calls

To write one call on one token, a writer locks exactly one token of the underlying. The payoff, at any settlement price S above strike K, is:

payout per option = (S − K) / S      [in units of the underlying token]

Look at what this expression can never do: as S grows without bound, (S − K) / S approaches 1 but never reaches it. At any finite price, no matter how high, the payout per option stays strictly below one full token. One locked token is always enough, forever, no matter how far the stock runs.

Worked example: strike $160, settlement $200. Payout = (200 − 160) / 200 = 0.2 tokens per option. Push the price to $10,000, and the payout per option is (10000 − 160) / 10000 ≈ 0.984 tokens — still under 1, still covered by the single token locked at the start.

Puts

To write one put at strike K, a writer locks K units of the quote currency (USDG). The payoff, at any settlement price S below strike, is:

payout per option = min(K, max(0, K − S))      [in units of quote currency]

The min(K, …) isn't decorative — it's the proof, written directly into the formula. Even if S fell to zero, the payout is capped at exactly K, which is exactly what was locked. There is no price low enough, including zero, that makes a put owe more than its writer locked.

Why this is the whole safety story

Most lending and leveraged trading works differently: a position can move against you until it owes more than what backs it, and someone — a liquidator, a margin engine, an insurance fund — has to step in before that happens. All that machinery exists to prevent one failure mode: value owed exceeding value held.

Plume's payoff formulas make that failure mode mathematically unreachable. There's no race against a falling price, because there's no way for the price to create a shortfall in the first place. This is also precisely why exercising at any moment is safe — the invariant holds at every price at every instant, not just at a scheduled expiry, so there's no reason to restrict exercise to Fridays.

What this invariant does not protect against

It's worth being precise about the boundary. The invariant guarantees the protocol's accounting always balances. It says nothing about:

Whether the asset backing that collateral could itself be frozen by its issuer (see Trust model).
Whether the oracle price used is accurate (see Resolution for the safeguards).
Whether the contract code correctly implements this formula — which is exactly why it's fuzz-tested against hundreds of random price and quantity combinations on every change, and why the contracts are open for anyone to read.

← Previous Architecture Next Series & position tokens →