# Vanta — RMM Stock Liquidity

**Liquidity by design.** Vanta is a compact name with a dark, restrained visual identity for the liquidity protocol. Native ticker: VANTA; internal active-stake label: vVANTA.

Working protocol name: Vanta. Working launchpad ticker: VANTA. Neither availability nor trademark status has been verified.
Status: implementation specification and research gates. A working Anvil-only local prototype now exists; no public contracts are deployed and no real funds are committed. The Docs site describes implemented features and remaining release gates.
Network target: Robinhood Chain; initial market: one approved stock token against USDG.
Shared token, staking, accounting, and deployment requirements are defined in [the shared platform specification](./00-shared-token-and-platform.md).

## 1. Product thesis

Vanta makes a stock-token liquidity position behave approximately like a covered-call portfolio through its trading curve.
An LP selects a stock, strike, volatility calibration, and expiry, then supplies the required stock-token/USDG inventory.
Spot traders use that inventory to exchange the two assets; their trades rebalance the LP portfolio and generate actual fees.
The LP receives a transferable pool-specific claim on the remaining inventory, including retained LP fees.
There is no separate option buyer, minted call liability, PT, YT, exercise payment, or promise to pay the strike in cash.
The interesting primitive is an expiring, directional AMM position with a controllable payoff shape.
The product succeeds only if its executable prices attract enough trading to justify its inventory risk and approximation error.

The initial user statement is: “Provide AAPL-token/USDG liquidity with a 30-day horizon and a chosen upside cap profile.”
The displayed cap is a model benchmark, not a contractual maximum or guaranteed terminal payment.
Realized fees can lift value above the benchmark; market discontinuities and trading frictions can push value below it.
Use “covered-call-like liquidity” throughout the application until the simulation gate justifies more precise product language.
The reference research explicitly studies approximate covered-call replication. [Replicating Portfolios](https://arxiv.org/abs/2205.09890)

## 2. Participants and complete user flows

### LP

1. Select an existing pool; compare strike, expiry, fixed volatility, swap fee, reserve mix, and historical replication error.
2. Review both asset requirements and a terminal scenario chart that separates model value from actual inventory value.
3. Approve the two underlying assets and supply them at the current pool reserve ratio with maximum amounts and minimum LP output.
4. Receive Vanta LP tokens; watch actual token balances, fees, and market value rather than an accrued “premium” counter.
5. Burn LP tokens before or after expiry to receive the proportional stock-token and USDG balances.
6. Optionally sell the received stock tokens through a separate router transaction with an explicit price limit.

### Trader

1. Request a quote with exact input, recipient, minimum output, deadline, and expected pool calibration hash.
2. Review trading fee and price impact separately; submit through the router.
3. Receive the other asset if the live invariant, market-status gate, and price guard all pass.
4. A failed quote or expired pool leaves the trader's assets unchanged.

### VANTA holder and staker

1. Acquire the standard launchpad VANTA token outside the LP market.
2. Stake VANTA to receive an internal, nontransferable vVANTA stake balance.
3. Earn a pro-rata share of funded USDG streams sourced from realized Vanta protocol fees.
4. Claim USDG; request unstaking; withdraw VANTA after the shared seven-day cooldown.
5. Ordinary VANTA holding does not receive an automatic distribution; staking activates the fee claim.

## 3. Assets and token roles

| Asset | Creation | Economic role | Explicitly excluded role |
|---|---|---|---|
| Approved stock token | External issuer | Risky pool inventory | Protocol revenue or VANTA backing |
| USDG | External issuer | Quote inventory and actual fee payment | Guaranteed one-dollar redemption by Vanta |
| Vanta LP token | One ERC-20 per pool | Pro-rata claim on that pool's two accounted reserves | A cash-settled option or fixed-rate debt |
| VANTA | Imported launchpad ERC-20 | Transferable native token eligible for staking | Pool inventory, required trade currency, loss guarantee |
| vVANTA | Internal staking ledger | Active staking weight for funded USDG distributions | Transferable receipt, lending collateral, insurance capital |

The supported VANTA deployment must have ordinary ERC-20 transfers and no transfer tax or balance rebase.
The protocol never remints VANTA to manufacture staking yield and does not depend on a future token price.
Launchpad sale proceeds, if any, are separately disclosed treasury funding and are not recurring trading revenue.
No pool requires a VANTA pair, LP stake, token burn, or forced VANTA purchase to trade.

## 4. Economic deliverable and corporate actions

One curve “risky unit” is a fixed raw-token lot, not one permanently fixed displayed share.
At creation record m0, the underlying's positive UI multiplier, and define D = 1 / m0 raw tokens per risky unit.
All formulas in this document use decimal real quantities; implementations use explicit fixed-point scaling.
For example, if m0 = 1.25 displayed shares per raw token, D = 0.8 raw tokens per risky unit.
Store a rational conversion using m0; do not round D once into a low-precision integer and reuse that approximation.
For raw-token reserve R, the curve reserve is X = R / D = R * m0.
The current displayed-share reserve is R * m(t); it is an informational quantity, not the curve reserve.
The live value per curve risky unit is S_D(t) = D * P_raw(t), quoted in USDG.

A two-for-one split can double m(t) and halve displayed-share price without changing X or economic inventory value.
It cannot mint LP units, VANTA rewards, a synthetic dividend, or additional reserve capacity.
Reinvested dividends remain inside the raw token's economic exposure; the pool therefore references that total-return token lot.
No separate dividend distribution is assumed, and the pool cannot classify a multiplier increase as cash income.
The strike K is USDG per creation-time risky unit, immutable over the pool's lifetime.
Display the current equivalent strike per UI share as K / (D * m(t)), with an explanation of its adjusted denomination.
A reverse split similarly changes presentation; it must not trigger a principal write-down solely because share count falls.
True issuer losses, depegs, redemptions at a discount, or changes to the token's economic rights remain real LP risks.

An unclassified token upgrade, transfer restriction, decimal change, or unsupported economic transformation pauses new risk.
Existing LP exits remain available whenever the underlying token itself permits transfers.
The adapter records pending multiplier changes for monitoring; scheduled actions never authorize an operator to change K or sigma.
This fixed-lot design intentionally does not reuse HDFI's high-water yield index.

## 5. Mathematical state and verified curve orientation

Let R be raw stock-token reserves, Y be USDG reserves, and L be total pool liquidity units.
Let X = R * m0, x = X / L, y = Y / L, tau = max(T - t, 0) / YEAR.
Here YEAR is exactly 365 days; sigma is annual volatility as a decimal and K is USDG per risky unit.
Both x and the standard normal CDF Phi are dimensionless; y and the invariant offset have units USDG per liquidity unit.
Set a = sigma * sqrt(tau), z = Phi^-1(1 - x), and g(x,tau) = K * Phi(z - a).
The normalized invariant is:

~~~text
psi(x, y, tau) = y - K * Phi(Phi^-1(1 - x) - sigma * sqrt(tau))
              = kappa
~~~

This orientation and the signed offset match Primitive's primary implementation. [ReplicationMath.sol](https://github.com/primitivefinance/rmm-core/blob/master/contracts/libraries/ReplicationMath.sol)
At fixed time and offset, stable reserve decreases as risky reserve increases.
The marginal USDG price of one risky unit is -dg/dx = K * exp(a*z - a*a/2).
Consequently x = 1 - Phi(d1), where d1 = (ln(S_D/K) + sigma*sigma*tau/2) / a.
At zero initial offset, y = K * Phi(d1 - a).
With zero interest and the raw-lot total-return convention, the model inventory value is S_D*x + y = S_D - C_BS.
The terminal mathematical benchmark per liquidity unit is min(S_D(T), K).
The same orientation is discussed in the primary pricing analysis. [Analysis of the RMM-01 Market Maker](https://arxiv.org/abs/2310.14320)

These equalities describe the zero-offset reference curve under model assumptions, not a funded payoff obligation.
The live pool can acquire a nonzero offset through fees, passage of time, rounding, and its actual trading history.
The application must show actual reserve NAV separately from the reference curve value.

### Time update rule

Before every swap, compute tau once from the current block timestamp and calculate kappaBefore from current reserves.
Price the entire candidate swap using that same tau and compare its invariant with kappaBefore.
Do not carry yesterday's kappa forward as a required target and fabricate reserves to restore it.
Do not compare a post-swap invariant at one tau against a pre-swap invariant at another tau.
No token is transferred merely because time advances, and no accounting balance accrues theta automatically.
Primitive's engine also updates time before taking the pre-swap invariant. [PrimitiveEngine.sol](https://github.com/primitivefinance/rmm-core/blob/master/contracts/PrimitiveEngine.sol)
Concentration approaching expiry changes executable prices; external trading and fees determine the actual portfolio outcome.

## 6. Initial calibration and liquidity accounting

Immutable pool calibration includes stock token, USDG, m0, K, sigma, creation time, expiry, fee rates, and math-version identifier.
The initial pool duration is selected from 7 and 30 days; it must pass the market-calendar and numerical-domain checks.
The launch candidate sigma range is 10%–200% annualized; narrowing this range after simulation is permitted before deployment.
K is selected relative to an observed reference price, but neither its monetary value nor sigma can change after activation.
At seeding, select a valid x0 and compute y0 = g(x0,tau0), using zero target offset within conservative rounding bounds.
The creator supplies R0 = L0*x0/m0 and Y0 = L0*y0; verify actual transfer amounts and reserve feasibility.
Reference-price initialization is checked within the configured price band; the creator cannot seed at an arbitrary misleading quote.
Lock a fixed minimum LP supply at an irrecoverable address to prevent empty-pool manipulation.
Creator-owned LP tokens and their exposure are publicly identified; seeding is not a protocol fee.

Later LP minting is proportional to both accounted reserves and total L.
For requested deltaL, require rawIn = ceil(R*deltaL/L) and usdIn = ceil(Y*deltaL/L).
Mint exactly deltaL; refund unused maximum input amounts without treating refunds as fees.
This preserves x, y, and the live offset apart from bounded integer rounding.
LP burning returns floor(R*burn/L) raw tokens and floor(Y*burn/L) USDG, using pre-burn L.
Reduce reserves and supply atomically, then transfer both assets under a reentrancy guard.
Keep pro-rata burns available in the active, risk-paused, and expired states.
Minimum locked liquidity is the only intentionally unredeemable LP supply.
Single-asset deposit and exit are later router features that compose an ordinary swap with these exact proportional operations.

## 7. Swap fees: one settlement asset and no double counting

All trading fees are charged on the USDG side, in USDG, so protocol revenue requires no stock-token liquidation worker.
Let q be the fee-free USDG leg quoted by the curve, f the total swap-fee rate, and p the protocol share of that fee.
The launch example is f = 0.30% and p = 20%; these are proposed parameters, not market observations.
Compute totalFee = ceil(q*f), protocolFee = floor(totalFee*p), and lpFee = totalFee - protocolFee.
For a stock-token sale, the trader receives q - totalFee USDG; reject trades whose fees consume the entire output.
For a stock-token purchase, the trader pays q + totalFee USDG.
For exact USDG-input quotes, find the maximum q satisfying q + ceil(q*f) <= inputBudget.
Any unused budget is refunded; it cannot be silently retained as revenue.

| Direction | Raw reserve delta | USDG LP reserve delta | Protocol-fee account delta |
|---|---:|---:|---:|
| Trader sells raw stock | +rawIn | -q + lpFee | +protocolFee |
| Trader buys raw stock | -rawOut | +q + lpFee | +protocolFee |

Calculate the fee-free candidate against kappaBefore; retained lpFee can only improve its USDG invariant at the same tau.
Require sufficient reserves for the trader payment and the protocol-fee liability together.
The trader's all-in amount, gross q, LP fee, protocol fee, and normalized price are emitted separately.
Fee direction differs from implementations that multiply risky input by gamma; do not copy their fee code unchanged.
There is no separate option premium, yield strip payment, or guaranteed theta receipt to add to swap fees.

### Exact balance ownership

Maintain accountedRawReserve, accountedUsdReserve, accruedProtocolUsd, and unaccountedDonations separately for each pool.
The invariant reads only accounted LP reserves; it must never include accruedProtocolUsd.
Actual USDG balance must cover accountedUsdReserve + accruedProtocolUsd at all times.
Actual raw balance must cover accountedRawReserve; unsupported direct transfers do not increase curve capacity automatically.
Collecting protocol fees decreases accruedProtocolUsd and actual pool balance equally, without touching LP reserves or L.
Only explicit protocol-fee collection may fund the fee distributor.
Do not sweep LP fees, expired reserves, locked minimum liquidity, or unclaimed exits into VANTA staking.
Donations may be absorbed into LP reserves only through a separately specified, timelocked policy; the initial implementation strands them.

## 8. Numerical implementation and executable quotes

Use integer token amounts at transfer boundaries, WAD liquidity/normalized quantities, and a reviewed signed high-precision math layer.
USDG decimal scaling and stock-token decimal scaling must be validated against the exact approved deployments.
Do not silently assume every stablecoin has 18 decimals or every replacement stock token shares the existing decimal convention.
Initial candidate domain: 1e-6 <= x <= 1 - 1e-6; require the actual pre- and post-swap states inside this domain.
Use normal CDF/inverse-CDF implementations with explicit proven error bounds over that interval.
The mathematical kernel must support signed kappa; a negative offset is not by itself an insolvent state.
Require actual stable reserves nonnegative and sufficient for the proposed transfer regardless of curve offset.
Use log-space price calculations and guarded exponential ranges; reject rather than saturate an unrepresentable price.
Cap K, L, raw reserves, and USDG reserves with documented overflow proofs before approving any asset or pool range.

An exact raw-input quote evaluates the target stable reserve from the invariant at xNew.
An exact stable-input quote inverts the same decreasing function using bounded monotone search and interval arithmetic.
Output amounts round down; required inputs and fees round up.
The executable quote includes a domain status and maximum feasible size; no quote returns a plausible number after a domain failure.
The verifier computes a lower bound for the candidate invariant and an upper bound for the required invariant.
Accept only if lowerBound(invariantAfter) >= upperBound(invariantBefore); do not subtract a harvestable tolerance.
If math uncertainty consumes more than 0.1 basis point of a candidate quote's gross USDG value, reject that quote.
Use an absolute rounding budget of at most two smallest units of the output asset in differential tests.
These are release acceptance targets: failing them requires a better kernel, larger minimum trade, or narrower domain.
Minimum trade size must exceed the proven numerical uncertainty and total rounding costs by at least 100 times.
Test repeated microscopic round trips to ensure accepted rounding cannot create a cumulative subsidy.

## 9. Pool lifecycle and market interruptions

State transitions are Created -> Active -> Expired; a reversible RiskPaused flag can coexist with Active.
Only a fully funded, valid calibration can activate.
Swaps and new LP additions stop at cutoff T - 300 seconds; the expiry T remains immutable.
The five-minute cutoff avoids singular near-expiry evaluation and is part of the disclosed approximation.
The pool expires by timestamp even if no keeper calls finalize.
Finalize records a final reserve snapshot and emits an event; it does not exchange assets or create settlement liabilities.
An LP exiting after expiry receives its actual proportional pair of assets at the moment of redemption.
There is no grace-period trade at a fixed strike and no promise that reserves will become entirely USDG.
If arbitrage never arrives, the residual inventory remains exactly what LPs own.
Rolling creates a new pool and requires an explicit user action or previously authorized vault policy.
An operator cannot extend expiry, change the strike, or move expired reserves into a successor pool.

Initial trading is restricted to an approved market-status window rather than assuming stock liquidity exists continuously.
The state gate requires an unexpired OPEN status, a fresh positive reference price, and no flagged unsupported corporate action.
The signed status validity is at most 60 seconds; the initial maximum reference-price age is 90 seconds during OPEN.
These heartbeat settings are launch candidates and must be compatible with verified data-source update guarantees.
After a gap or reopening, require the post-swap marginal price within the immutable reference-price deviation limit.
An initial 5% limit is only a candidate; simulations must test rejection rates, manipulation resistance, and arbitrage feasibility.
If no feasible inventory state satisfies the band, swaps remain unavailable and LPs can exit in kind.
RiskPaused disables swaps and additions, never proportional withdrawals or claims of already funded staking rewards.

## 10. Oracle assumptions and trust boundaries

The curve itself uses inventory, time, and immutable calibration; it does not use an oracle to calculate derivative settlement.
The chosen production wrapper nevertheless depends on reference prices and market-status data for its trading guard.
Therefore market Vanta as an oracle-independent curve with explicit operational data dependencies.
The adapter must identify whether each price is per raw token, per UI share, USD-denominated, or USDG-denominated.
If the source provides USD per raw token, convert to USDG per risky unit using D and a fresh USDG/USD price.
If it provides USD per UI share, include the current multiplier exactly once before applying D.
Every feed needs identifier, decimals, timestamp, sign, staleness, and applicable sequencer-outage checks.
USDG depeg, stale conversion data, oracle disagreement, or status-provider outage disables new risk under the fixed policy.
No oracle failure can transfer pool inventory to an administrator or make stakers liable for LP losses.
Freshness and market-status services do not prove token redeemability or eliminate issuer and chain risks.

## 11. Contracts and interfaces

Deploy independent immutable pools; keep configurable onboarding and protocol administration outside pool custody.
VantaFactory validates asset adapters, parameter bounds, math version, and deterministic pool uniqueness.
VantaPool owns two reserves, LP supply, immutable calibration, fee liabilities, and the state gate.
VantaMath evaluates interval-valued CDF, inverse CDF, invariant, price, and maximum feasible trade size.
VantaRouter transfers bounded inputs and exposes ordinary trade, mint, and burn flows.
VantaLens produces quotes and complete reserve snapshots using the same math implementation as execution.
VantaStatusAdapter verifies data freshness and denomination and cannot arbitrarily rewrite reserve accounting.
VantaFeeCollector moves only collected USDG protocol fees into the shared distribution pipeline.
VANTAStaking and the fee distributor use the shared audited accounting design and have no pool withdrawal permission.

~~~text
struct Calibration {
    stockToken; usdToken; creationMultiplier; strikeWad; sigmaWad;
    maturity; cutoff; feeBps; protocolShareBps; mathVersion; statusPolicy;
}
createPool(calibration, seedLiquidity, maxRawIn, maxUsdIn, recipient)
addLiquidity(deltaL, maxRawIn, maxUsdIn, recipient, deadline)
removeLiquidity(lpIn, minRawOut, minUsdOut, recipient, deadline)
swapExactRawIn(rawIn, minUsdOut, recipient, deadline, calibrationHash)
swapExactUsdIn(usdBudget, minRawOut, recipient, deadline, calibrationHash)
quoteExactInput(direction, amount) -> amounts, fees, bounds, status
snapshot() -> reserves, protocolFees, supply, calibration, liveState
collectProtocolFees() -> usdTransferred
finalize() -> finalSnapshot
~~~

All value-changing functions are non-reentrant and use actual pre/post transfer balance checks.
Reject fee-on-transfer and rebasing assets; a mismatched received amount must revert the complete operation.
The first version does not expose arbitrary callbacks or delegate execution.
Emit PoolCreated, LiquidityAdded, LiquidityRemoved, Swap, RiskStatusChanged, ProtocolFeesCollected, and PoolFinalized.
Administrative powers may pause new risk; no authority can confiscate reserves or mutate existing pool economics.

## 12. VANTA holding demand and funded staking cash flows

The credible reason to retain VANTA is the option to keep receiving protocol-fee distributions through staking.
vVANTA earns a share of revenue actually funded in USDG; it is not a promise of a fixed APR or appreciation.
The shared design uses weekly funded reward streaming, balance checkpoints, and a seven-day unstaking cooldown.
Stake weight stops earning when it enters the cooldown queue; previously earned rewards remain claimable.
An unfunded week has zero new yield; undistributed funds when no stake exists remain explicitly accounted.
All pool LP claims are senior only to their own reserve accounting; VANTA staking has no claim on those reserves.
VANTA staking is not slashed, does not insure a model shortfall, and cannot be advertised as a safety module.

Proposed revenue waterfall: 60% stakers, 25% treasury, 15% operations/reserve.
For G = sum(protocolFee actually collected in USDG), the baseline distributable basis N equals G because this version needs no fee-asset conversion.
Pay collection, keeper, and other operational costs from the 15% operations allocation or the treasury; do not subtract them again before calculating staker rewards.
Stakers receive 0.60*N, treasury 0.25*N, and operations/reserve 0.15*N. These shares refer to protocol fees, after the separate LP/protocol trading-fee split.
The operations allocation may fund keepers and audits; it creates no guarantee to recapitalize LPs.
Governance proposals can change fees for newly created pools through a timelock; existing fee schedules remain immutable.
The token need not have unrestricted custody governance to justify its revenue role.

### Illustrative fee sensitivity

Assume monthly fee-bearing volume V equals the sum of each swap's fee-free USDG leg q, counted once per swap, with fee 0.30% and protocol share 20%. Operational spending is funded from its allocation after the split.
The table is arithmetic, not a volume forecast, token valuation, or promised distribution.

| Monthly V | Total trader fees | Retained LP fees | Protocol fees | Staker allocation |
|---:|---:|---:|---:|---:|
| 1 million USDG | 3,000 USDG | 2,400 USDG | 600 USDG | 360 USDG |
| 10 million USDG | 30,000 USDG | 24,000 USDG | 6,000 USDG | 3,600 USDG |
| 100 million USDG | 300,000 USDG | 240,000 USDG | 60,000 USDG | 36,000 USDG |

At 10 million USDG volume, changing the fee to 0.10% gives 1,200 USDG to stakers under the same allocation shares.
Changing the fee to 0.50% gives 6,000 USDG only if volume remains constant, which must not be assumed in forecasting.
Taking a larger protocol share reduces LP compensation and can harm execution quality, replication, and future volume.
Show rolling realized rewards per staked VANTA and actual distributions; optional annualization must identify its short sample.
Do not derive a token valuation from LP TVL or treat inventory mark-to-market gains as distributable protocol revenue.
The staking feature is economically weak until genuine fee-paying volume exists; token emissions cannot substitute for that evidence.

## 13. Frontend, indexer, and workers

Pool cards show expiry, adjusted strike denomination, fixed sigma, fee, reserve mix, pool size, trading status, and freshness.
The deposit preview labels initial inventory cost, target payoff shape, actual NAV, modeled shortfall, and raw/UI token conversions.
The terminal chart includes spot-hold, a same-cost static inventory portfolio, and the theoretical covered-call benchmark.
Never add an “option premium earned” number to modeled covered-call value or already included trading fees.
Portfolio screens show redeemable raw stock tokens and USDG before showing an estimated combined value.
Expiry screens offer direct dual-asset redemption first; optional asset sales disclose their separate route and slippage.
VANTA screens show funded stream balance, observed protocol fees, stake weight, cooldown end, and claimable USDG.
Hide token-price-based APR when a defensible VANTA market price is unavailable; USDG per staked token remains measurable.

An indexer consumes pool, fee, staking, and token-multiplier events with reorg-safe checkpoints.
Workers publish approved status updates, monitor data freshness, collect accrued fees, and fund weekly reward streams.
No worker can mint reserves, alter calibration, sell LP inventory without consent, or force an LP rollover.
Expose quote rejection metrics by cause: market closed, stale data, price guard, depleted domain, and numerical uncertainty.
Keep manual finalize and fee collection callable if a worker fails; withdrawals do not depend on indexer availability.

## 14. Tests, invariants, and simulation acceptance

Unit tests cover both fee directions, exact-budget refunds, all decimal conversions, seed rounding, and proportional liquidity.
Test forward and reverse splits with reciprocal UI-price changes: NAV and LP claims must remain unchanged within rounding.
Test dividend reinvestment separately: raw ownership is unchanged and no fee or VANTA reward is minted from a multiplier event.
Compare quotes and derivative orientation against an independent high-precision reference over the full approved parameter domain.
Fuzz late blocks, timestamp jumps, sigma bounds, near-boundary x, signed offsets, reserve exhaustion, and expiry cutoff.
Fuzz every action under repeated pauses, stale feeds, restarts, malicious transfers, and unsupported token behavior.
Verify source-version licensing before any code adaptation; independent implementation still requires mathematical review.

Permanent invariants:

- Actual balances cover LP reserves and separately accrued protocol-fee liabilities.
- Proportional burn returns only the caller's reserve share; stake weight and VANTA price never affect that share.
- Protocol fee collection cannot change pool reserve NAV, normalized curve state, or LP supply.
- A same-block round trip cannot profit from rounding when external prices and state are unchanged.
- At one common tau, an accepted fee-free trade does not reduce the conservative invariant bound.
- Adding and removing liquidity cannot create value through rounding or an empty-pool donation.
- Split-only denomination changes cannot create fees, synthetic cash, LP supply, or reward funding.
- Expiry, data failure, and pause preserve in-kind withdrawal rights.
- Reward liabilities never exceed funded USDG after accounting for paid rewards and remaining streams.
- No unit test may assert that actual terminal reserves always equal min(S_T,K).

Build an event-driven simulator with the exact proposed USDG-side fee rule, not the reference implementation's default rule.
Model external arbitrage with execution delay, gas costs, spreads, finite liquidity, and limited profitability.
Run at least 10,000 seeded paths per major parameter family; record confidence intervals and save reproducible seeds.
Include constant price, geometric Brownian motion, stochastic volatility, volatility miscalibration, and both directional trends.
Include 5%, 15%, and 30% price gaps; multi-day closures; earnings jumps; issuer freezes; and missing arbitrage.
Include USDG depegs, reference-price outages, sequencer interruptions, and multiplier actions at reopening and near cutoff.
Measure terminal error versus a same-capital covered-call benchmark, LP return versus static inventory, and retained fee income.
Attribute all value changes to market movement, inventory trading, fees, rounding, or model error; prohibit unexplained “theta.”
Report trader execution quality, price-guard rejection rate, time without feasible quotes, and protocol fees after costs.
Evaluate protocol-share and fee sensitivity jointly; maximize neither staker revenue nor LP APR in isolation.

Launch gate: deterministic accounting and numerical properties must pass with zero unexplained value creation.
Under the predeclared continuous-price baseline, require median absolute replication error <=2% of initial NAV and 95th percentile <=5%.
Those thresholds are acceptance criteria, not expected results; failure blocks covered-call-like marketing and public capital.
Publish stress losses without imposing an artificial profit floor; a stress test passes by conserving claims and exposing real losses.
Independent review must approve the math kernel, corporate-action units, reward separation, and simulation methodology.

## 15. Delivery phases and boundary of reuse

Phase 0: high-precision simulator, source derivation, fixed-lot adapter model, and frozen acceptance criteria.
Phase 1: Solidity math harness and immutable pool with proportional LP mint/burn, no VANTA integration or single-asset routing.
Phase 2: router, quotes, status guard, fee accounting, indexer, and frontend with explicit dual-asset exits.
Phase 3: external review, adversarial simulation, and a capped pilot using one asset, one expiry family, and small seeded capital.
Phase 4: activate VANTA staking only after a complete real-fee collection and funded distribution cycle is verified.
Phase 5: consider opt-in rollover vaults, further stocks, and richer volatility surfaces as independently reviewed products.

HDFI's factory conventions, custody discipline, deadline/slippage patterns, snapshots, and lifecycle-testing style are useful references.
HDFI's PT/YT accounting, share high-water index, logit interest-rate AMM, and maturity-at-par oracle are not Vanta's pricing engine.
Vanta needs new normal-distribution mathematics, stock/stable inventory accounting, and a validated replication model.
The largest uncertainty is economic replication and order flow under stock-market discontinuities, not whether an ERC-20 can be deployed.

## 16. Primary source register

- [Primitive RMM core](https://github.com/primitivefinance/rmm-core): reference repository, implementation organization, and license.
- [ReplicationMath](https://github.com/primitivefinance/rmm-core/blob/master/contracts/libraries/ReplicationMath.sol): invariant orientation, signed offset, and time scaling.
- [PrimitiveEngine](https://github.com/primitivefinance/rmm-core/blob/master/contracts/PrimitiveEngine.sol): common-time invariant validation and inventory operations.
- [CumulativeNormalDistribution](https://github.com/primitivefinance/rmm-core/blob/master/contracts/libraries/CumulativeNormalDistribution.sol): historical numerical implementation to review, not import without validation.
- [Replicating Portfolios: Constructing Permissionless Derivatives](https://arxiv.org/abs/2205.09890): approximate derivative replication through RMMs.
- [Analysis of the RMM-01 Market Maker](https://arxiv.org/abs/2310.14320): pricing and time-dependent market-maker analysis.
- [Primitive RMMS simulator](https://github.com/primitivefinance/rmms-py): reference simulation architecture for independent differential work.

Sources were inspected on 2026-09-06. Pin exact source commits and verify the deployed token/feed interfaces before implementation.