Options that cannot go insolvent
Strider is an exchange for options on tokenized equities. Every short position is backed one-for-one by collateral locked in a contract, so the protocol never needs margin calls, liquidators, or an insurance fund. This paper explains how that works, and what it costs.
1. The problem with leveraged derivatives
Most on-chain derivatives take partial collateral. A writer posts a fraction of what they might owe, and the protocol watches their position. If the market moves against them, liquidators race to close it before the collateral is exhausted.
This works until it does not. In a sharp move, liquidations queue, gas spikes, oracles lag, and positions close below water. The shortfall becomes bad debt, and someone absorbs it: an insurance fund, the counterparty, or the protocol itself.
Strider removes the failure mode by removing the leverage. A writer locks the whole of what they could ever owe, up front.
2. Cash-secured puts
A put’s worst case is knowable. If the underlying falls to zero, the writer owes the full strike and no more. Locking strike × size in stablecoin covers every outcome.
At expiry the contract records an oracle price S. The holder receives max(0, K − S); the writer keeps min(K, S). Those two sum to exactly K — the amount locked — so the vault always covers both claims.
That identity is the whole design. It is enforced by randomised tests that settle at the strike, near zero, far above, and at sizes that do not divide evenly. Rounding always favours the vault: the worst observed residue is one unit of stablecoin left behind, never a shortfall.
3. Covered calls
A call has no worst case in cash. If the underlying rises without bound, so does the obligation, and no fixed amount of stablecoin covers it. This is why cash-collateralized calls need liquidations, and why Strider refuses to create one.
Collateralizing in the underlying token makes the obligation bounded again. A writer locks one share token per contract and can always deliver, whatever the price does. Settlement then splits that token rather than cash.
The holder is owed S − K in value. One token is worth S. So the holder receives (S − K) / S of the locked token and the writer keeps K / S. Those fractions sum to one.
The same conservation, expressed in tokens instead of dollars. A $100 call settling at $125 pays the holder 0.2 tokens, because $25 of value is a fifth of a $125 token. Settling at $10,000 still pays less than the single token backing it.
4. Positions are tokens
Long positions are ERC-1155 tokens whose id is the series id, so they transfer like any other token. Short positions are non-transferable obligations tied to the writer’s address — an obligation you could sell is not collateralized by you.
Because longs are transferable, a holder can exit before expiry by selling the position on. The original writer’s collateral and obligation are untouched; only the counterparty changes.
5. The order book
Orders live off-chain as signatures. A maker signs an EIP-712 message describing the terms — series, size, premium, deadline — which costs nothing and touches no chain. Only a fill is a transaction.
The signature is not a promise; it is proof of consent to those exact terms. Change any field and it stops verifying. A fill moves premium and creates or transfers the position atomically: both happen, or neither does.
The server storing those signatures holds no funds and has no authority. The worst it can do is show a stale order, and the fill reverts.
6. Settlement and its failure mode
Settlement is permissionless: anyone may call it, and the value recorded comes only from the price oracle. A quote observed before expiry is rejected, so a stale price cannot be locked in.
That leaves one hazard. If the oracle never produces a post-expiry price, settlement can never succeed — and a writer who sold their long has no way to unwind. Their collateral would be stuck permanently.
Seven days after expiry, a writer may reclaim exactly what they locked. The option is treated as having expired worthless. Because settling is permissionless, any holder who believes otherwise has a week to post a price and claim first.
7. What there is no admin key for
Neither the vault nor the market has an owner, a pause, or an upgrade path. Nobody can change fees, seize collateral, halt settlement, or redirect a market — including whoever deployed it.
That cuts both ways, and it is worth stating plainly: it also means there is no way to stop a live exploit. The tradeoff is deliberate, not an oversight.
The production oracle carries the only privileged function: listing a price feed for a new market. It is deliberately one-way — a listed feed can never be repointed, so no one can redirect a live market’s settlement source after people have traded it. That permission can be renounced permanently once the market set is final.
8. What this is not
This deployment runs on Robinhood Chain Testnet (chain 46630) with mock collateral and a mock price feed that anyone can write to. It is a demonstration. Nothing here is real money.
- Not audited. The accounting is fuzz tested and there is no admin key, but no third party has reviewed this code. That is the difference between no known vulnerabilities and no vulnerabilities.
- Not liquid. A venue is only as useful as the people quoting on it. There is no market maker of record and no liquidity guarantee.
- Not capital efficient. Full collateral is the price of never being insolvent. Leveraged venues will always offer more exposure per dollar.
- Not a regulatory position. Options on tokenized equities sit inside securities regulation in most jurisdictions. Nothing here is legal or financial advice.
9. Deployment
Robinhood Chain Testnet · 46630