Chapter ΣΤʹ · the backstop

The stability reserve and bad debt

The reserve is not a general insurance fund. It is a discontinuous-gap backstop: a continuous crash is fully absorbed by the liquidation ladder and never touches it. What the reserve covers is the residue - single-block price gaps, oracle outages, keeper downtime - and it is engineered to fail gracefully rather than to pretend it cannot fail.

1Funding

Four covenant-enforced inflows, all in L-BTC:

The borrow fee is the structural one: it funds the backstop in proportion to origination flow, independent of whether liquidations happen. A bigger liquidation-penalty share was deliberately avoided - it fills from the continuous-crash path, which never draws the reserve, and stays dry on the gap path, which does. Steady state, the reserve holds on the order of 0.5% of outstanding debt. How much to hold is a sizing question with two inputs: the liquidation ladder already absorbs a single-block price drop of up to about 23% without ever drawing the reserve (those bands self-finance), and only a gap larger than that reaches the reserve at all. Holding roughly 0.5% of outstanding debt is enough to backstop a single-block gap of about 35%, which leaves a comfortable margin over the ladder's free-absorb range.

2The bad-debt operation

When a vault's CR falls below 100% at the MAX quote, anyone may clear it. The keeper burns the vault's full debt in OBOL into the pot and takes the vault's collateral plus a payment from the reserve:

shortfall   = debt_sats - coll
bounty      = 5%  of debt_sats                    // keeper incentive (E-4)
cap         = 20% of debt_sats                    // per-vault exposure cap (M-1)
reserve_pay = min( shortfall + bounty, cap, reserve_balance )
keeper gets   coll + reserve_pay                  // output 0, pinned exactly

issuer.simf:451-474. Three properties carry the design:

• The full debt always burns. The pot must grow by exactly debt, and output 0 is pinned so no vault branch other than BAD-DEBT can match - the vault closes, period. A variant that made the keeper whole from a reduced burn was rejected because it reopens the fake-debt drain the attestation exists to close issuer.simf:483-508.
• The drain is saturating, not reverting. min against the balance means an underfunded reserve pays what it has, down to zero, and the transaction still constructs. The earlier design required shortfall <= balance exactly - a hard cliff where an empty reserve made every remaining bad vault unconstructible and froze them underwater. That cliff was judged the single most important thing to fix: now the failure mode is an explicit accounting deficit, not stranded unbacked OBOL.
• Per-vault exposure is capped at 20% of debt. A vault UTXO is byte-identical whether it ever minted OBOL or was conjured at the right address with dust collateral, so a "fake" underwater vault cannot be excluded outright. The cap makes conjuring strictly loss-making: the attacker must burn ~100% of the debt in real OBOL to pull at most 20% from the reserve - a 4:1 self-griefing cost. A genuine single-block gap past the 130% trigger lands a vault around CR 85% (shortfall ~15%), comfortably inside the cap.

Why the issuer attests: the reserve cannot verify a vault itself - reconstructing a vault needs VAULT_CMR, and the vault already reconstructs the reserve, so the check in the other direction would close a commitment cycle. The issuer is compiled after the vault and is recognizable by a flat token id, so it is the one covenant that can vouch for vault genuineness on the reserve's behalf (see the DAG, chapter Βʹ).

3Keeper break-even and the deep tail

The keeper's profit on a bad-debt clear is reserve_pay - shortfall, at most the 5% bounty. As CR falls, the shortfall grows until it meets the 20% cap: at par that happens at CR 80%, where profit reaches zero. Below CR 80% clearing at par is a loss - a dead zone, but only at par:

4The peg floor: min(par, backing)

REDEEM values a claim of x OBOL at coll_at_cr(x, MAX, min(par, backing_k)) - 0.5% vault.simf:438-442. While the system is fully backed, backing_k >= par and redemption pays par minus the fee - the classic arbitrage floor that holds OBOL near $1. When unbacked OBOL exists, redemption pays the backing ratio instead:

• At hard par, an under-backed pool is a bank run: early redeemers strip $1 of collateral per OBOL from the healthiest vaults and leave later holders with strictly worse backing. The floor converts that race into an approximately fair pro-rata settlement at the currently signed ratio.
• This is the honest terminal state of a fixed-supply asset: OBOL is a claim on a vault pool, and when the pool is under-backed the claim is worth the backing ratio. The design documents call this the graceful soft de-peg - a continuous float down to the true ratio instead of a freeze or a collapse.
• A dilutable backstop token (the MKR pattern) was explicitly rejected for v1: it recreates the unlimited-mint authority the whole design removes, and it fails reflexively in exactly the systemic tail it is meant to cover.

backing_k is signed by the same 3-of-5 quorum inside the regular tick (the oracle can see aggregate supply and collateral; a per-transaction covenant cannot), and only this one arm reads it. Every accepted signature covers the same field, so under the 2-Byzantine bound at least one honest signer vouches for the figure.

5Reserve identity

The reserve is a single constant address with no data leaf stability.simf:8-9. Identity questions - is this the genuine reserve? - reduce to one flat scriptHash pin, STABILITY_SPK, on every path that pays it. An earlier design gave the reserve a mutable ratcheted address; it opened a sybil-reserve fee diversion (route the mandatory fee to a lookalike) and a griefing freeze (poison the ratchet to u32::MAX), and its removal also fixed a liveness bug - multiple crash-underwater vaults now clear against one tick. Freshness for the reserve's one shrink path lives on the issuer's global anchor instead. The operational consequence: keep exactly one reserve UTXO (and one pot UTXO) - the covenant cannot consolidate fragments (see chapter Ιʹ).