How Fulcrum works

Split one unit of a stock token and you hold both halves of it. Arm takes the price up to a cap, Lev takes everything above. At any settlement price the two add back to the price, with nothing left over.

payoff(Arm)    = min(P1, K)
payoff(Lev) = max(P1 - K, 0)
                 ------------------
                 = P1              for every P1

K = P0 x (1 + C)     fixed at the open, immutable until settlement

Because the identity is exact, merging the two back into the stock can be free and can never need external capital. That is what holds the peg: if the halves trade below the whole, an arbitrageur buys both and merges; if above, they split and sell. The corridor is only as wide as the 10 bps split fee.

For example: at $250.00 with a +5% cap, the strike is $262.50. Entry is $247.29 for Arm and $2.71 for Lev. Arm is bought at a discount and that discount is its income; Lev is prefunded leverage of about 24x with no liquidation, because the most it can lose is what was paid for it.

Epochs are 30 days by default and run back to back. Lev is minted fresh each epoch and expires at settlement; Arm is perpetual, so its liquidity never has to migrate. That is the reason there is one pool per ticker rather than a grid of pools per expiry.

T0            oracle fixes P0, strike is written, tranche is minted
T0 + 0..2h    Dutch auction sells the tranche for USDG
inside        Arm and Lev trade; split and merge stay open
T1            oracle gives P1 as a 30-minute median of three sources
              Lev receives max(P1 - K, 0) / P1 units of stock per token
T1 + 0..30m   premium reaches Arm, next epoch opens

The auction has no pricing formula. It opens at 130% of a model premium and falls to 85% over two hours in 30-second steps, and the first 15 minutes belong to locked stakers. Anything unsold is burned, which simply leaves that convexity with Arm.

Once an hour a keeper sweeps whatever has accumulated, converts it to USDG and splits it four ways: 55% the hourly sweep, 20% buyback and burn, 15% backstop vault, 10% treasury. Sweeps under $50 roll into the next hour so gas does not eat the distribution.

Rewards are paid only in USDG, and only out of fees actually collected. The protocol never pays income with its own emission, which is why the reward stream is tied to turnover rather than to the direction of the market.

Settlement takes the median of three independent reporters, each measured as a 30-minute time-weighted average. If the three disagree by more than 1.5%, settlement is postponed for up to 24 hours and the epoch simply runs longer. The strike does not move.

A proposed price then sits in a two-hour dispute window. Any veFULC holder can cancel it by posting a bond, which governance either returns or slashes. Only after that window does the settlement land.

Corporate actions apply as a multiplier to the strike and the index at once, so the ratio between the two shares never changes. A delisting or merger forces settlement at the last valid price: Lev is redeemed, Arm converts back to the stock at its index.

Twelve rules are checked inside every vault transaction, fuzzed across the full price range, and re-run on every commit. They are the structure the rest of the protocol hangs from.

1. I-1Fully backedThe vault always holds at least the Arm index x Arm supply plus every settled Lev claim. Checked in every transaction.
2. I-2Merge is always onMerging Arm and Lev back into the stock is free and can never be paused. Losing merge is a critical incident.
3. I-3Exact identityArm plus Lev equals P1 with no remainder. Rounding always favours the vault.
4. I-4Nothing goes negativeBoth payoffs are non-negative for any settlement price, including zero.
5. I-5No external capitalNo payout ever needs money from outside the vault. The protocol is never in debt.
6. I-6Tranche is collateralisedLev supply never exceeds the stock held in the vault.
7. I-7Rewards are revenueThe sweep pays only USDG, only from fees actually collected. Never emission.
8. I-8Strike is frozenK is fixed at epoch open and immutable until settlement.
9. I-9The Arm index moves twiceDown at Lev payout, up on compounded premium. Nowhere else.
10. I-10One live epochA vault can only have one open epoch at a time.
11. I-11Fixed supply$FULC has no mint function in its bytecode. Supply only goes down.
12. I-12Guardian only pausesThe guardian multisig cannot move funds, change K, or disable merge.

The protocol ships in phases, and each one has an exit condition rather than a date. Caps stay on until the contracts have been through a second audit and a run of clean settlements.

1. Phase 0Contracts and auditdone

   Contracts, first audit, testnet, invariant fuzzing. Done: every invariant is green and the contracts are on Robinhood Chain.

2. Phase 1Mainnet, first tickersin progress

   AAPL is live with a $1M cap and a manual keeper; SPY and QQQ follow. Exits after three epochs without incident and $500k of value locked.

3. Phase 2Caps off

   Second audit, open keeper, protocol owned liquidity and the first full month of hourly sweeps.

4. Phase 3Governance listings

   New tickers by vote, a deep-buffer third tranche, and baskets instead of single names.

Test coverage today: 123 tests, including the payoff identity fuzzed from zero to four times the opening price, and a handler-driven invariant run that exercises splits, merges, settlements and redemptions in random order. A separate monitor re-checks the same invariants against the live chain, and probes the one that cannot be read from a variable by simulating a real holder’s merge.

Availability is fenced by jurisdiction on this site, not in the contracts. The contracts are permissionless and have no identity checks; the app is simply not served where the regulatory treatment of these positions is unresolved.

Deployed on Robinhood Chain. Verify every address against the block explorer before you sign anything — this page is a convenience, not a source of truth.

• VaultFactory0xbB5e...34dc
• EpochManager0x55fC...b892
• ConvexAuction0x1565...6e4b
• BagDistributor0x9B0e...B883
• Staking0xFB0B...E029
• PriceOracle0x1d8d...357b
• USDG0x5fc5...d168
• FULC0x196c...927e

Fulcrum is a set of smart contracts. Nothing here is investment advice or an offer to sell securities, and the two shares may not be available in your jurisdiction.