Skip to main content

Stop Conditions

Vessel is experimental software in testnet. It is unaudited. This page lists the conditions under which the protocol team stops the protocol publicly, and what "stop" means. These are commitments, not predictions. They are written down so that nobody has to guess in the moment.

The list is short on purpose. A stop condition is a fact that can be observed, not a judgement about market conditions.

Testnet, unaudited

Everything on this page applies to the current testnet deployment, which hedges against SimVenue SIMVENUE — SIMULATED, a simulated venue with an owner-settable funding rate. Conditions 3 and 6 refer to a real venue and a real mainnet vUSD, neither of which exists yet. They are listed now so the commitment predates the situation.

The six conditions​

1. A conservation-invariant violation in a settled epoch​

The engine enforces ΔNAV_Hull + ΔNAV_Ballast + ΔReserve + fees = G for every epoch. It is enforced in code and fuzzed. If a settled epoch is observed where this equality does not hold, the accounting is wrong in a way the protocol cannot explain, and nothing downstream of it can be trusted. Vessel stops.

2. A Hull principal impairment​

The shortfall ordering is: Ballast NAV absorbs losses first, then the Reserve, and only then is Hull principal touched. Hull principal being impaired is defined in the litepaper as a credit event. If it happens, the subordination structure has been exhausted and the senior promise has been broken. Vessel stops.

3. Venue insolvency or an extended halt​

The short leg lives on a perp venue. If that venue becomes insolvent, or halts for long enough that the delta band and margin maintenance cannot be kept, the book is no longer delta-neutral and cannot be made so. Vessel stops. The threshold for "extended" is not yet a published number: halt duration that triggers a stop UNVERIFIED — PENDING GATE-0.

4. An unrecoverable subordination-floor breach​

The floor B / (H + B) ≥ 20% is enforced at all times and constrains new Hull issuance and Ballast withdrawals. A breach the engine cannot recover from through those constraints means Hull is no longer protected to the degree the design promises. Vessel stops.

5. A critical-severity finding in external review​

Vessel has not been audited. When external review happens, a finding rated critical severity stops the protocol until it is fixed and re-reviewed. The identity of the reviewer and the severity scale used are not yet published: audit firm and severity rubric UNVERIFIED — PENDING GATE-0.

6. A regulatory block on vUSD before mainnet​

vUSD is Phase 3, post-audit, minted 1:1 against the delta-neutral book. If a regulatory action blocks vUSD before mainnet, the vUSD phase does not launch. Whether the engine and tranches continue independently of vUSD in that case is not a decision the team has published: scope of a vUSD-only stop UNVERIFIED — PENDING GATE-0.

What stopping means​

Stopping is a sequence, not a switch. The order is fixed.

  1. New deposits stop first. No new Hull series is issued and no new Ballast deposits are accepted. Existing positions are untouched by this step.
  2. Exits remain open within design constraints. Hull redeems at maturity as usual; early exit is by secondary sale only, as it always is. Ballast withdrawals remain subject to the 48-hour cooldown and the subordination floor. A stop does not remove these constraints, because removing them is how a senior tranche gets hurt.
  3. Wind-down follows the waterfall. As the book is unwound, value is distributed in the accrual and shortfall order already documented: fees, then Hull accrual, then residual to Ballast on the way up; Ballast, then Reserve, then Hull on the way down. Nobody jumps the queue. See the risk pages for the full ordering.

What a stop does not include: an admin mint, a privileged withdrawal, or a discretionary reallocation between tranches. The landing page states there is no admin mint, and the litepaper states no privileged mint path exists in any Vessel contract. A stop does not create one.

The exact on-chain mechanism for pausing deposits is not publicly verifiable today. The repository contains only a README and LICENSE as of 2026-08-29, so the pause function, its owner, and its address render as pause mechanism and controlling key UNVERIFIED — PENDING GATE-0.

Where it is announced​

A stop is announced in three places:

  1. X
  2. Telegram
  3. The changelog on this site, at vessel.wtf

The announcement names the condition from the list above. Which channel is authoritative if they disagree has not been published; treat the changelog as the durable record and the other two as notification.

Notes​

  • Hull's rate is a contract parameter, r_H = clamp(EWMA_30d(net funding APR) × (1 − h), 0, r_cap), not a performance figure. None of the conditions above concern a low rate; a low rate is the parameter doing its job.
  • Ordinary negative funding is not a stop condition. It is absorbed by the Reserve (target 2% of TVL) and, beyond that, by Ballast. Only the exhaustion of that ordering (condition 2) stops the protocol.
  • Automatic de-risking on a buffer breach is not a stop. It is the engine reducing exposure, never adding leverage, and it runs without an announcement.
Verified from: vessel-team-brief · vessel.wtf/litepaper · vessel.wtf — Sat Aug 29 2026 00:00:00 GMT+0000 (Coordinated Universal Time) · How we verify this site →