Contract Reference
As of 2026-08-29 the public repository at github.com/Lemma-Development-Labs/vessel contains a README and a LICENSE. No contracts, no ABIs, no deployed addresses. This page documents the architecture as designed in the litepaper (vessel.wtf/litepaper) and the protocol team's build brief. Every contract name below is a design name, not a verified symbol. Every artifact a developer would integrate against, meaning source, ABI, and address, publishes at Gate-0. Until then, treat every field marked with an amber chip as unknown.
Vessel is experimental software in testnet, and it is unaudited. The contract set is small by design: one engine that holds the book, two deck tokens, a reserve, a venue interface with one simulated implementation behind it, and a crank surface anyone can call. What follows is one card per contract. Each card states the contract's role, the invariants the litepaper says it enforces, and its admin surface. Function names are not given, because none have been published.
How to read the cards
Three columns of truth run through every card.
- Role is what the contract holds and what it decides. Source: litepaper.
- Invariants are rules the litepaper says are enforced in code. Where the litepaper says a rule is fuzzed, the card says so. Where a rule is described but its enforcement point is not, the card says that too.
- Admin surface is what a privileged key can do. One commitment applies to every contract on this page, and it is stated once here so it does not need restating: per the litepaper, no privileged mint path exists in any Vessel contract. The landing page repeats it as "no admin mint". Where an owner-settable parameter does exist, the card names it.
The one live trust assumption that is not a design goal is the simulated venue. It is covered in its own card.
Engine
Role. The Engine holds the delta-neutral book: the long spot leg, the short perpetual leg, the idle USDC buffer, and the accounting that turns funding into deck NAV. At launch leverage λ ≤ 2, the book per $1 of TVL is λ/(1+λ) spot, 1/(1+λ) short margin, and λ/(1+λ) hedged notional, which resolves to 66.7% spot, 33.3% margin, 66.7% hedged notional. A 10% idle USDC buffer is held unhedged.
Invariants it enforces.
- Delta band. Net delta stays within 1% of gross notional. A breach of the band, or a 4-hour timer, triggers a rebalance.
- Buffer rule. Margin maintenance draws on the idle buffer. A buffer breach triggers automatic de-risking. The litepaper is explicit that a breach never adds leverage.
- Liquidation distance. The short-leg liquidation price sits at or above 40% from mark.
- Conservation. For every epoch,
ΔNAV_Hull + ΔNAV_Ballast + ΔReserve + fees = G. The litepaper states this invariant is enforced in code and fuzzed. - Waterfall ordering on accrual. Daily accrual with continuous NAV: first the protocol fee of
10% × max(G, 0), half of it to Reserve until target and the rest to treasury; then Hull accrualA_H = r_H × H × Δt; then the residual to Ballast. - Waterfall ordering on shortfall. Ballast NAV absorbs first, then Reserve, and only then is Hull principal impaired. The litepaper calls that last step a credit event.
Admin surface. No privileged mint path. Which Engine parameters are owner-settable (band width, timer, buffer target, leverage cap) is not stated in the litepaper and is not published in code, so the answer is not yet documented UNVERIFIED — PENDING GATE-0. The public artifact will state each parameter's setter and its bounds at Gate-0.
| Field | Value |
|---|---|
| Contract symbol | UNVERIFIED — PENDING GATE-0 |
| Testnet address | UNVERIFIED — PENDING GATE-0 |
| ABI | UNVERIFIED — PENDING GATE-0 |
Hull series token
Role. Hull is the senior deck. Each Hull is a fixed-maturity series, 4 weeks at launch, issued as a transferable token. A series redeems principal plus fixed yield at maturity. There is no early redemption; early exit is a secondary sale of the token. The series shape is a deliberate design decision so that a Hull series can be wrapped for Pendle-style fixed-rate distribution; no such market exists today.
The rate is a contract parameter. Hull's rate is set per series by the formula r_H = clamp(EWMA_30d(net funding APR) × (1 − h), 0, r_cap) with haircut h = 40% and r_cap = 15% APR. That is a parameter the contract fixes at issuance, not a forecast and not a historical return. Any Hull rate figure shown anywhere on this site is a parameter value.
Invariants it enforces.
- Subordination floor at issuance. New Hull issuance is constrained so that
B / (H + B) ≥ θ_min = 20%holds at all times. - Seniority. Hull accrues before the Ballast residual, and Hull principal is impaired only after Ballast NAV and Reserve are exhausted, in that order.
Whether the floor check lives in the Hull token or in the Engine is a design detail the litepaper does not settle; this page attributes the rule to both until code is published.
Admin surface. No privileged mint path. Issuance of a series is bounded by the subordination floor, not by a key. Who may open a new series, and whether the series parameters (maturity, h, r_cap) have a setter, is not yet documented UNVERIFIED — PENDING GATE-0.
| Field | Value |
|---|---|
| Token standard | UNVERIFIED — PENDING GATE-0 |
| Contract symbol | UNVERIFIED — PENDING GATE-0 |
| Testnet address | UNVERIFIED — PENDING GATE-0 |
| ABI | UNVERIFIED — PENDING GATE-0 |
Ballast
Role. Ballast is the junior deck: a perpetual, rolling tranche with no maturity. It absorbs losses first and earns the levered residual after the fee and the Hull accrual.
Invariants it enforces.
- Cooldown. Withdrawals are subject to a 48-hour cooldown.
- Subordination floor at withdrawal. A withdrawal that would push
B / (H + B)belowθ_min = 20%is not permitted. The floor constrains Ballast exits in the same way it constrains Hull issuance. - First loss. In a shortfall, Ballast NAV is written down before Reserve is touched and before any Hull principal.
Admin surface. No privileged mint path. Whether the cooldown length and the floor θ_min are immutable or owner-settable is not yet documented UNVERIFIED — PENDING GATE-0.
| Field | Value |
|---|---|
| Token standard | UNVERIFIED — PENDING GATE-0 |
| Contract symbol | UNVERIFIED — PENDING GATE-0 |
| Testnet address | UNVERIFIED — PENDING GATE-0 |
| ABI | UNVERIFIED — PENDING GATE-0 |
Reserve
Role. The Reserve is a buffer between Ballast and Hull principal. Its target is 2% of TVL. It is funded from the protocol-fee split: half of the 10% fee on gross positive yield goes to the Reserve until the target is met, and the remainder to treasury. Its job is to smooth transient negative funding so that a short run of inverted funding does not reach Hull.
Invariants it enforces.
- Fill order. Reserve receives its half of the fee before treasury receives anything, until the 2% target is reached.
- Drain order. Reserve is drawn only after Ballast NAV is exhausted, and before Hull principal.
- Conservation.
ΔReserveis a term in the epoch conservation identity stated on the Engine card.
Admin surface. No privileged mint path. Whether the 2% target is a settable parameter, and whether any key can withdraw from the Reserve other than through the shortfall path, is not yet documented UNVERIFIED — PENDING GATE-0. The litepaper describes the Reserve only as a target and a funding rule. Whether it is a separate contract or an account inside the Engine is also not stated.
| Field | Value |
|---|---|
| Contract symbol | UNVERIFIED — PENDING GATE-0 |
| Testnet address | UNVERIFIED — PENDING GATE-0 |
| ABI | UNVERIFIED — PENDING GATE-0 |
IVenue and the SimVenue adapter
Role. The Engine does not talk to a perp exchange directly. It talks to an IVenue interface, and an adapter behind that interface talks to the venue. Today the adapter is SimVenue SIMVENUE — SIMULATED, a simulated venue with an owner-settable funding rate. This is per the protocol team's build brief; it is not in the litepaper and it is not in published code.
Invariants it enforces. None that protect users. SimVenue exists so the Engine, the decks, and the waterfall can be exercised on testnet without a live counterparty. The funding rate the Engine harvests from SimVenue is whatever the owner set it to.
While the hedge venue is SimVenue, the funding rate is an owner-settable number. Every NAV movement on testnet is therefore downstream of a key, not of a market. That is the whole point of a simulation, and it is also the reason no testnet figure on this site should be read as protocol performance. Hull's rate stays a contract parameter under SimVenue as it does under any venue.
Admin surface. The SimVenue owner sets the funding rate. That is the one owner-settable input on this page that the team has stated directly. Whether the owner can also set mark price, fill behaviour, or margin outcomes is not yet documented UNVERIFIED — PENDING GATE-0. No privileged mint path exists in the adapter; it does not mint anything.
The Perpl adapter. The next adapter behind IVenue targets Perpl (docs.perpl.xyz), which the litepaper names as the short leg. The IVenue shape is what makes the swap possible without changing the Engine. The Perpl adapter's method surface, and its use of Perpl's delegated-account model, is not yet designed publicly UNVERIFIED — PENDING GATE-0.
| Field | Value |
|---|---|
IVenue method set | UNVERIFIED — PENDING GATE-0 |
| SimVenue testnet address | UNVERIFIED — PENDING GATE-0 |
| SimVenue owner | UNVERIFIED — PENDING GATE-0 |
| Perpl adapter | not started; see Perpl docs for the target venue |
Crank surface
Role. Three operations keep the book honest: margin top-ups, rebalancing, and funding harvest. The litepaper states that keepers execute all three permissionlessly. Anyone can call them; nobody has to be trusted to.
Invariants it enforces. The crank does not decide anything. It triggers logic the Engine already enforces: the band check, the buffer rule, the 4-hour timer, the waterfall. A caller cannot make the Engine take on leverage; a buffer breach de-risks regardless of who called.
Admin surface. None by design. The litepaper describes these operations as permissionless. Whether there is a keeper incentive, and whether any operation is gated by a minimum interval beyond the 4-hour timer, is not yet documented UNVERIFIED — PENDING GATE-0.
| Field | Value |
|---|---|
| Crank function names | UNVERIFIED — PENDING GATE-0 |
| Keeper incentive | UNVERIFIED — PENDING GATE-0 |
What is not on this page
- vUSD and svUSD. Phase 3, post-audit. vUSD mints 1:1 against the delta-neutral book, overcollateralized by Ballast plus Reserve, and the same no-privileged-mint commitment applies. Nothing is designed publicly beyond that sentence.
- Spot routing. The litepaper names Kuru and Uniswap-style routing for the spot leg. The router interface Vessel targets is covered under integrations, not here.
- Addresses. None. The table below is the shape the Gate-0 publish will fill.
| Contract (testnet) | Address | Actions |
|---|---|---|
| Engine | UNVERIFIED — PENDING GATE-0 | |
| Hull series token | UNVERIFIED — PENDING GATE-0 | |
| Ballast | UNVERIFIED — PENDING GATE-0 | |
| Reserve | UNVERIFIED — PENDING GATE-0 | |
| SimVenue (IVenue adapter) | UNVERIFIED — PENDING GATE-0 |
When addresses publish, verify code presence before trusting any of them:
cast code <address> --rpc-url https://testnet-rpc.monad.xyz
Verify this page yourself
- Open github.com/Lemma-Development-Labs/vessel and confirm the repository contents. If it now contains more than a README and LICENSE, this page is behind and the amber chips are stale.
- Read the litepaper at vessel.wtf/litepaper and check each invariant above against it. This page cites nothing from the litepaper that is not stated there.
- The SimVenue description comes from the protocol team's build brief and is not independently published. Treat it as a team statement until the adapter source is public.