Protocol Design

Diffusal is a decentralized options exchange where the protocol bears zero counterparty risk. This is achieved through a fundamental invariant: every option is minted as a pair (long + short), and the sum of all longs equals the sum of all shorts system-wide.

Collateral Requirement for Short Positions

Short positions create obligations. Users holding short positions MUST maintain sufficient USDC collateral to cover their potential payout obligations, or they will be liquidated.

Short Position = Obligation to Pay

How Collateral Guarantees Settlement

The margin system ensures short holders always have USDC to pay longs. Consider a short put with strike = $3000:

• At ETH $3000:$5,000 equity, healthy status, normal trading
• At ETH $2700:$3,500 equity, healthy status, normal trading
• At ETH $2400:$2,200 equity, warning zone
• At ETH $2200:$1,800 equity, unhealthy status → liquidated
• At ETH $1500: Would be insolvent, but never reached because already liquidated

Key insight: Liquidation happens at ~80% of initial margin, well before insolvency. By settlement time, all remaining short holders have sufficient collateral.

The Safety Layers

What This Means in Practice

1. Opening a short: User must deposit USDC collateral ≥ Initial Margin
2. Holding a short: If the option moves against the user, equity decreases
3. Approaching danger: When equity < Maintenance Margin, liquidation triggers
4. Liquidation: Keeper closes position at penalized price, collateral covers the loss
5. At settlement: Only healthy short holders remain → all have USDC to pay

The protocol never allows an undercollateralized short position to reach settlement.

Core Invariant: Paired Option Minting

Options are always minted in pairs. Calling mint(seriesId, amount) creates +amount long options (right to receive payout if ITM) and +amount short options (obligation to pay if ITM).

System-wide invariant:

Since positions are signed integers (positive = long, negative = short), this invariant is maintained automatically.

Self-Cancellation Property

If a user holds both +N long and -N short of the same series:

• At expiry, they owe themselves the payout
• Net obligation = 0
• Net exposure = 0

This enables free minting: Anyone can mint unlimited pairs because holding both sides creates zero net exposure.

Position Lifecycle

1. Minting (Creating New Options)

Any user can mint option pairs. In practice, this is primarily done by the Main Market Maker. When the MMM mints 100 pairs, they hold +100 long and -100 short, resulting in net exposure of 0 and zero collateral required (since positions cancel).

2. Trading (Transferring Risk)

When the MMM sells one side of their minted pair:

Example: MMM sells longs via RFQ

1. MMM mints 100 pairs → holds +100 long, -100 short → net: 0
2. MMM sells 100 longs to Buyer for premium → MMM now holds 0 long, -100 short (net: -100, short exposure); Buyer holds +100 long (net: +100, long exposure)
3. Premium flows: Buyer pays MMM

Example: Transferring short obligation

1. MMM holds -100 short (obligation)
2. MMM "sells" the short to Taker (pays Taker to take obligation) → MMM now holds 0 short (no obligation); Taker holds -100 short (has obligation)
3. Premium flows: MMM pays Taker (compensation for taking risk)

3. Settlement at Expiry

At expiry, for each series, if the option expires ITM (in-the-money), the payout per contract equals the intrinsic value. For each user: if position > 0 (long), user receives payout; if position < 0 (short), user pays |payout|.

Conservation of value:

What longs receive = what shorts pay. The protocol moves no funds of its own.

Pricing: Theoretical vs Market

There are two distinct pricing concepts in the protocol:

Mark Price (for Margin Calculations)

The mark price uses Black-Scholes as a theoretical reference for:

• Calculating unrealized PnL
• Determining margin requirements
• Triggering liquidations
• Computing stress scenarios

where:

• $d_1 = \frac{\ln(S/K) + (r + \sigma^2/2)T}{\sigma\sqrt{T}}$
• $d_2 = d_1 - \sigma\sqrt{T}$

Trade Price (Actual Premium)

The trade price is what users actually pay—determined by market forces, not Black-Scholes:

Why Trade Prices Differ from Black-Scholes:

Example: If Black-Scholes theoretical price is $50.00, the MMM might quote an ask of$51.50 (selling price, includes spread) and a bid of $48.50 (buying price). The spread represents the MMM's profit margin.

Portfolio Margin System

Cross-Margin Architecture

Users do not collateralize individual positions. Instead, all positions share a single collateral pool with deposited USDC and multiple option positions across different series.

Portfolio Equity Calculation

For long positions (size > 0):

For short positions (size < 0):

Stress Testing

We test the corners of the risk space (4 scenarios combining ±30% spot moves with ±50%/−30% IV changes) to find worst-case portfolio loss. See Margin System: Stress Scenarios for the complete scenario table and rationale.

Margin Thresholds

See also: Margin System for detailed margin calculations and worked examples.

Liquidation Mechanics

Trigger

A user becomes liquidatable when:

This can happen to any user regardless of position type:

• Long holders: Option values drop significantly
• Short holders: Option values rise significantly
• Mixed portfolios: Net losses exceed collateral buffer

Debt Calculation

If Debt > 0 and Equity < MM, the user is underwater and liquidation is triggered.

Process

1. Trigger: Keeper detects Equity < MM
2. Calculate: Determine debt and positions to close
3. Close Positions at penalized mark price: Long (size > 0) liquidator buys at mark × (1 - 1%); Short (size < 0) liquidator buys back at mark × (1 + 1%)
4. Settle: Proceeds applied to user's collateral, liquidator receives 5% bounty, and if shortfall, insurance fund covers

Mark Price Liquidation (No Orderbook/RFQ)

Liquidations use the mark price (Black-Scholes theoretical price) directly—they do not go through the orderbook or RFQ system. This ensures liquidations can always execute regardless of market liquidity.

Penalized pricing:

Proceeds calculation:

• For longs: Proceeds = size × mark × (1 - penalty)
• For shorts: Proceeds = |size| × mark × (1 + penalty)

Volatility-Adjusted Liquidation Penalty

The liquidation penalty scales with implied volatility to properly incentivize liquidators during market stress. Higher IV means faster position movement and more liquidator risk, so higher penalties ensure liquidators remain incentivized during stress.

See Liquidation: Volatility-Adjusted Penalty for the penalty formula and rate table.

Partial vs Full Liquidation

The protocol supports partial liquidation to give users a chance to recover.

Key insight: Margin requirements use stressed scenarios (±30% spot, +50% IV), but liquidation executes at current mark prices. This means:

• Selling positions at current mark barely reduces equity (just the penalty)
• But it dramatically reduces the margin requirement (which was stress-based)
• So partial liquidation often restores health without destroying the user

Liquidation Process:

1. Trigger: Equity < MM
2. First Attempt: Close 50% of positions (partial liquidation) — liquidator acquires 50% at penalized mark price, user's margin requirement drops significantly
3. Re-check: Is user now healthy? (Equity ≥ MM) — If yes, stop and user retains remaining 50%; if no, proceed to full liquidation (close remaining 50%)

After liquidation, the user retains any remaining equity and positions (if partial).

Liquidator Incentives

Liquidators receive:

1. 1-2%+ profit on positions (via penalized mark price, scales with IV)
2. 5% bounty on debt covered (from user's collateral)

Total profit = penalty (1-2%+) + 5% bounty

After liquidation, the liquidator owns the acquired positions and can:

• Sell via limit orders on the orderbook
• Sell via RFQ to the Main Market Maker
• Hold the positions

This incentivizes keepers to monitor and liquidate promptly.

Insurance Fund

The insurance fund provides bad debt coverage, covering shortfall if liquidation proceeds are less than debt. It is funded by protocol fees and liquidation penalties.

When liquidation proceeds are insufficient to cover the debt (bad debt scenario):

The insurance fund covers this shortfall to prevent protocol insolvency.

See also: Liquidation for worked examples and penalty calculations.

Main Market Maker (MMM)

The Main Market Maker is a privileged, non-liquidatable entity that serves as the backbone of protocol liquidity.

Why MMM is Non-Liquidatable

The liquidation check must:

1. First check if the user is the MMM address
2. If yes, always return false (not liquidatable)
3. If no, proceed with normal margin checks (equity vs maintenance margin)

This means anyone can call the liquidation function on the MMM, but it will always be rejected.

MMM Responsibilities

RFQ Flow

1. User/Liquidator sends RFQ request to MMM
2. MMM checks inventory, calculates quote, mints if needed
3. MMM sends quote response back to user
4. User accepts quote
5. On-chain settlement: MMM mints pairs and sells longs, positions transferred, premium settled in USDC, both parties' portfolios updated

MMM Position Lifecycle Example

Day 1: Fresh MMM with no positions.

Trade 1: User buys 100 ETH-3500-CALL via RFQ. MMM mints 100 pairs (+100 long, -100 short), sells 100 longs, receives $5,000 premium. Portfolio: -100 short, +$5,000 cash.

Trade 2: Another user buys 50 ETH-3500-CALL via RFQ. MMM mints 50 pairs, sells 50 longs, receives $2,500 premium. Portfolio: -150 short, +$7,500 cash.

Trade 3: MMM offloads risk via limit order. MMM sells 80 shorts, pays $2,000 to takers. Portfolio: -70 short, +$5,500 cash.

At Expiry: ETH = $3,600 (options ITM by$100). MMM owes 70 × $100 =$7,000. MMM has $5,500 cash. MMM injects$1,500 additional capital (external, injected before expiry).

Settlement: MMM pays $7,000 to long holders. Protocol balanced: longs receive what shorts pay.

Why MMM Must Never Go Underwater

Critical: If MMM becomes insolvent, protocol breaks.

Failure Cascade:

1. MMM can't fulfill settlement obligations
2. Long holders can't get paid (MMM holds shorts)
3. RFQ stops working (MMM has no capital)
4. Bad debt accumulates across all users
5. Protocol insolvency

Prevention:

• MMM operator continuously monitors portfolio
• Rebalancing before risk thresholds hit
• External capital injection if needed (insurance fund)

Trust Assumptions

See also: RFQ Flow for detailed quote mechanics and Options Settlement for expiry settlement.

Risk Parameters

Protocol Fee System

The protocol collects fees on all trades to fund operations and the insurance fund. Fees are denominated in basis points (BPS) where 1 BPS = 0.01%.

Fee Types

Maker Rebates

The maker fee can be negative, creating a rebate system that incentivizes liquidity provision:

Positive makerFeeBps: Maker pays fee to protocol
Negative makerFeeBps: Protocol pays rebate to maker

Example with makerFeeBps = -5 (0.05% rebate), takerFeeBps = 10 (0.10%):
  Trade premium: $1,000
  Maker receives: $1,000 + $0.50 rebate = $1,000.50
  Taker pays: $1,000 + $1.00 fee = $1,001.00
  Protocol receives: $1.00 - $0.50 = $0.50 net

Fee Invariant

Maker rebates are possible, but takerFeeBps + makerFeeBps > 0 is enforced to ensure net positive protocol revenue. See Order Book: Fee Invariant for details.

Fee Calculation

For each trade:

Fee Flow

Taker Fee (always positive): Taker pays feeRecipient.

Maker Fee (can be negative): If positive, maker pays feeRecipient. If negative, feeRecipient pays maker (rebate).

Net Result: Protocol always receives positive net fees (guaranteed by the takerFee + makerFee > 0 invariant).

Fee Recipient

The feeRecipient address receives all collected fees. This is the address of the insurance fund contract.

Default Fee Parameters

See also: Order Book and RFQ Flow for trading fee examples.

Security Invariants

Protocol-Level

1. Position Conservation: For every seriesId, sum of all positions = 0
2. No Protocol Obligation: Protocol never owes users from its own funds
3. Collateral Sufficiency: All healthy users have Equity ≥ MM
4. Settlement Balance: At expiry, payouts to longs = payments from shorts

User-Level

1. Position Updates: Only via trade execution or liquidation
2. Collateral Access: Withdrawable only if post-withdrawal Equity ≥ IM
3. Entry Premium: Weighted average, updated atomically with position

Summary

The Diffusal protocol achieves zero counterparty risk through:

1. Paired minting — Options always created as long + short pairs
2. Short positions require USDC collateral — Users holding shorts must maintain sufficient collateral or be liquidated
3. Portfolio margin — Users collateralize net exposure, not individual positions
4. Proactive liquidation — Positions closed before insolvency, guaranteeing USDC is available at settlement
5. Penalty pricing — Liquidated users pay a premium, incentivizing prompt liquidation
6. Insurance fund — Backstop for any remaining bad debt
7. MMM as backbone — Non-liquidatable entity ensures RFQ always available
8. Theoretical vs Market pricing — Black-Scholes for margin/liquidation, market forces for trading

Participant Summary

Regular Users: Trade via limit orders or RFQ; subject to margin requirements; liquidatable if equity < maintenance margin; pay/receive market prices (not Black-Scholes).

Third-Party Market Makers: Provide limit order liquidity; subject to same margin/liquidation rules; compete with MMM on pricing.

Main Market Maker (MMM): Receives all RFQ requests; mints pairs on-demand to fulfill orders; NOT liquidatable by protocol; managed operationally (external risk management); can offload shorts to other users.

Keepers: Monitor user health; execute liquidations; receive bounty for successful liquidations.

The Trust Model

Trustless (Protocol-Enforced):

• Position conservation (longs = shorts)
• User margin requirements
• User liquidation triggers
• Settlement calculations
• Premium/collateral flows

Trusted (Operational):

• MMM solvency management
• MMM RFQ availability
• Oracle price feeds (Pyth/Chainlink)

The protocol is purely administrative: track positions, enforce margins, coordinate liquidations. All value transfer happens between users (including MMM). The protocol itself holds no option positions and bears no payout obligations.

Contract Implementation

The protocol is implemented across several smart contracts:

Related

• Margin System — Detailed margin calculations and stress testing
• Liquidation — Liquidation mechanics and penalty calculations
• Options Creation — Series creation via lazy registration
• Options Settlement — TWAP settlement at expiry
• Order Book — Limit order trading mechanics
• RFQ Flow — Request-for-quote trading with MMM
• Black-Scholes Model — Pricing formulas and Greeks
• Margin Calculations — Mathematical stress testing formulas