Backing & solvency
Every eToken is backed by a two-layer portfolio, tied together by one solvency number checked on every mint.
Layer 1: Reserve Vaults
One protocol-owned pool per asset holds wrapper tokens (real tokenized stock from regulated issuers) against the eTokens outstanding. Reserve vaults are share-less: no LP deposits, no LP claim, so redemptions retire protocol liabilities against protocol assets and never transfer LP value. Wrapper collateral is delta-1 with the liability it backs (its price moves with the eToken's), so it can back issuance 1:1 with no overcollateralization.
Reserves fill through the backfill loop: after every RFQ mint, the maker uses the buyer's USDG to buy the wrapper token and deposit it, and through direct PSM mints, which deliver the wrapper up front.
Layer 2: LP collateral vaults
Pooled crypto from liquidity providers insures the residual: exposure minted via RFQ that a maker has not yet backfilled, a wrapper depeg, an issuer failure, or an unfilled redemption that gets force-executed. LPs are paid for carrying this first-loss risk.
The solvency rule
For each asset: net exposure = value of eTokens outstanding minus its reserve (floored at zero). Summed across assets, net exposure must stay at or below the global utilization cap of counted LP collateral. The check runs on the mint path, so issuance can never outrun its insurance.
| Control | Current setting | Meaning |
|---|---|---|
| Global utilization cap | 60% | Net exposure / counted LP collateral must stay at or below this |
| Per-asset issuance cap | $1M per asset | Maximum outstanding value per eToken |
| Concentration cap | Opt-in per vault | Bounds any one vault's share of counted collateral |
| Governance rule | Never raise the cap to make room for demand | When the cap binds, attract more collateral instead |
Failure containment
Wrapper issuers, market makers, and oracle signers are all semi-trusted and individually fenced (bands, caps, single-use quotes). The system is built so any single backing layer can fail with holders made whole from the rest: an issuer failure is absorbed by LP collateral at the oracle price; a maker default leaves the escrowed funds and reserves intact; steady state, reserves cover issuance 1:1 and LP collateral is pure insurance.