Economic model
Every economic parameter in STYX is a covenant constant - there is no governance dial to turn later. This chapter is the canonical parameter table, the keeper incentive map, the peg mechanism, and the record of the economic audit that shaped them.
1The parameter table
Ratios are encoded as k = CR_percent * 2,000,000; the k column is the literal
that appears in the source (why this encoding - it keeps all
ratio math in u64). Debt is denominated in cents; the OBOL supply is fixed at 100,000,000.
| Parameter | Value | k literal | Source |
|---|---|---|---|
| min CR to open / draw (MIN quote) | 150% | 300000000 | issuer.simf:186-190, vault.simf:305 |
| liquidation trigger (MAX quote) | CR < 130% | 260000000 | vault.simf:332 |
| partial heal band | [132%, 137%] | 264000000 / 274000000 | vault.simf:346-347 |
| keeper extraction cap (partial) | 1.15 x dd | 230000000 | vault.simf:353 |
| partial penalty split | 10% keeper / 5% reserve | 10000000 (reserve) | vault.simf:357 |
| full-liq band (MAX quote) | [100%, 115%] | 200000000 / 230000000 | vault.simf:377-379 |
| full-liq reserve share | excess / 3 | - | vault.simf:389-391 |
| bad-debt threshold (MAX quote) | CR < 100% | 200000000 | vault.simf:402 |
| bad-debt keeper bounty | 5% of debt | 10000000 | issuer.simf:451 |
| bad-debt reserve cap per vault | 20% of debt | 40000000 | issuer.simf:471 |
| borrow fee (L-BTC, at OPEN) | 0.5% | 1000000 | issuer.simf:257 |
| redemption fee | 0.5% | 1000000 | vault.simf:442 |
| redemption floor | min(par, backing_k) | 200000000 (par) | vault.simf:438-439 |
| interest | none | - | by design, see below |
2The keeper P&L map
Liquidation is permissionless, so the parameters must make honest keeping profitable at every rung and make dishonest keeping a loss. The map across the bands:
| Band | Keeper action | Keeper profit | Reserve |
|---|---|---|---|
| (115%, 130%] | repay dd, heal to [132%, 137%] | 10% of dd (extraction capped at 1.15 x dd) | +5% of dd |
| [100%, 115%] | repay full debt, seize collateral | two thirds of the excess above par - at most ~10% of debt | + excess / 3 |
| [80%, 100%) | bad-debt clear | up to the 5% bounty, shrinking to zero at CR 80% where the 20% cap saturates | - reserve_pay (capped) |
| below 80% | bad-debt clear once OBOL de-pegs | positive as soon as OBOL trades below the vault's backing ratio | - reserve_pay (capped) |
Continuity. At CR 115% a partial liquidation pays the keeper 10% of debt and the reserve 5%. A full liquidation at the same CR has an excess of exactly 15% of debt; splitting it 2:1 pays the keeper 10% and the reserve 5% - the same numbers. Without the split, crossing the 115% boundary handed the keeper a windfall jump and cut the reserve's funding to zero on precisely the band where liquidations become forced sales.
The original heal target was [150%, 155%]. Healing only to just above the 130% trigger means the owner keeps more equity per liquidation event and the keeper fronts a smaller repayment - smaller per-step collateral dumps, less reflexivity in a falling market. The cost is accepted and documented: a healed vault has a thinner buffer, re-triggers sooner, and if a crash follows it lands deeper - the reserve sizing accounts for this. The 115% full-liq boundary is set by the 1.15 extraction cap, not the heal target, so no dead zone reopens.
3The peg
- Floor (OBOL below $1): anyone buys cheap OBOL and redeems it for collateral at
min(par, backing_k) - 0.5%, at the MAX quote. While the system is backed, the floor is roughly $0.995; when it is not, the floor is the honest backing ratio (chapter ΣΤʹ). - Ceiling (OBOL above $1): anyone locks L-BTC at 150% and mints at the MIN quote, capping the price near $1 + 0.5% + cost of capital.
- The calm band is therefore about [$0.99, $1.02]. It breaks in exactly two ways: deep insolvency (a soft, continuous de-peg to the backing ratio - by design) and an oracle outage (both arbitrage paths are price-gated; mitigated by the 3-of-5 quorum).
4Why interest-free
STYX is Liquity-class: revenue is event-based - the one-time borrow fee, the redemption fee, and the penalty shares - and debt is static between events. This is not only a product choice; it is what the architecture wants. Debt lives in the vault's address, so time-based interest would require a lazy recompute at every touch (compound accrual is not expressible at all - no loops, no floats), an oracle-priced skim, a schema change to the address, and an accrue-then-gate step in every debt-reading arm. The known cost of forgoing it is finding E-7: zero carrying cost writes the borrower a free tail-risk put - accepted for v1, with linear accrual on a co-signed height documented as the v2 option. On the same principle, no protocol or developer fee exists in the covenant: a covenant tax is forkable and dilutes the trustless story.
5The economic audit, E-1 to E-9
The round-1 findings converged on one root: the reserve is the sole backstop, it filled only from liquidations, and there were bands and speeds where liquidations do not fire - so the reserve was empty exactly when needed. The resolutions:
| # | Finding | Resolution |
|---|---|---|
| E-1 | 3-of-3 oracle: one offline oracle halts every price-gated op; outage during a fall means unbacked OBOL | covenant: 3-of-5 directional quorum, same verification cost |
| E-2 | reserve insolvency; the old arm hard-required shortfall <= balance (all-or-nothing cliff) | covenant: borrow fee routed to the reserve + saturating partial drain; the deep systemic gap is an accepted soft de-peg |
| E-3 | the [100%, 115%] dead zone: neither partial-liquidatable nor bad-debt-eligible | covenant: the FULL-LIQ tier, self-financed |
| E-4 | bad-debt paid zero bounty - break-even keepers will not clear bad debt | covenant: 5% bounty, bounded by the M-1 cap |
| E-5 | keeper payout is covenant-unpinned - a mempool observer can copy the transaction and redirect it | builder: the mandatory keeper funding input signed SIGHASH_ALL commits the payout (chapter Ιʹ) |
| E-6 | the peg is soft on both sides | derivative of E-1 / E-2 plus the backing floor; no independent lever |
| E-7 | interest-free writes a free tail-risk put | accepted for v1; interest is the documented v2 option |
| E-8 | redemption can force-close a specific healthy vault | accepted: it is equity-neutral and costs the redeemer ~0.5%; a CR gate on redemption would degrade the peg floor |
| E-9 | POKE is an unfunded liveness duty; a quiet market widens the stale-mint window | operational: scheduled keeper duty |
Round 2, run pre-freeze as three parallel modeling passes against the current covenant, returned the freeze verdict: no covenant change required. Every remaining item partitions into parameter, builder, operational, or accepted-residual - and the two optional tweaks the architect elected (the full-liq reserve share and the lower heal band) were applied, re-validated on-node, and are part of the frozen source. The stressed end-state of the system is a smooth, honest, pro-rata soft de-peg rather than a bank run or a freeze.