Invariants
An invariant is a statement that must be true of the protocol in every state. This page lists the six that the litepaper commits to. For each one: the exact statement, the mechanism that holds it, how a reader will be able to check it without trusting Vessel, and where verification stands as of 2026-08-29.
All six are litepaper commitments. As of 2026-08-29 the public repository at github.com/Lemma-Development-Labs/vessel contains only a README and a LICENSE. No contract source, no ABI, no deployed address, and no fuzz suite is public. Nothing below has been verified against code by anyone outside the team. Public code verification is pending the first public code release, referred to in the build brief as Gate-0 UNVERIFIED — PENDING GATE-0; no date for it is on record. Vessel is experimental, unaudited software on testnet.
Summary
| # | Invariant | Litepaper | Public code | Independent check |
|---|---|---|---|---|
| 1 | Conservation | committed | not public | not possible yet |
| 2 | Subordination floor | committed | not public | not possible yet |
| 3 | Delta band | committed | not public | not possible yet |
| 4 | Reserve target | committed | not public | not possible yet |
| 5 | Liquidation buffer | committed | not public | not possible yet |
| 6 | No privileged mint | committed | not public | not possible yet |
"Committed" means the litepaper states it. It does not mean it has been observed to hold.
1. Conservation
Statement. ΔNAV_Hull + ΔNAV_Ballast + ΔReserve + fees = G for every epoch, where G is the gross yield of the epoch.
Mechanism. Every unit of gross yield is assigned to exactly one of four places: Hull NAV, Ballast NAV, the Reserve, or fees. The accrual waterfall is the assignment rule. Protocol fee is 10% of max(G, 0), split half to the Reserve until the Reserve target is met and the rest to treasury. Hull accrues A_H = r_H × H × Δt, where r_H is a contract parameter. The residual goes to Ballast. When G is negative, the ordering reverses: Ballast NAV absorbs first, then the Reserve, then Hull principal. Nothing is created and nothing is dropped; the four terms always sum to G.
The litepaper states the invariant is enforced in code and fuzzed. The fuzz suite is not public.
Public check. Once contracts are published and verified on a Monad explorer, a reader can read the four balances at two consecutive epoch boundaries, sum the deltas, and compare against the gross funding harvested in between. The epoch length and the exact view functions that expose these balances are not in any verified source, so this page cannot name them.
Status. Litepaper commitment. Enforcement and fuzzing are claimed, not publicly demonstrated.
2. Subordination floor
Statement. B / (H + B) ≥ θ_min = 20% at all times, where B is Ballast NAV and H is Hull NAV.
Mechanism. The floor is a gate on the two actions that can lower it. New Hull issuance is refused if it would push the ratio below 20%. Ballast withdrawals are refused on the same condition, in addition to the 48-hour cooldown. Losses can still lower the ratio, since Ballast absorbs losses first; the floor constrains user actions, not market outcomes. What the protocol does when losses alone push the ratio under 20% is not stated in any verified source.
Public check. Read Hull NAV and Ballast NAV from the contracts and compute the ratio. Attempt a Hull mint or Ballast withdrawal that would breach the floor and confirm it reverts. Neither the view functions nor the revert conditions are public yet.
Status. Litepaper commitment. Not verifiable against code today.
3. Delta band
Statement. Net delta stays within 1% of gross notional. Rebalance is triggered on a band breach or on a 4-hour timer, whichever comes first.
Mechanism. Vessel holds spot long and an equivalent notional short on a perp venue. Price moves and funding flows push the two legs apart. Keepers execute rebalancing permissionlessly when either trigger fires. Today the short leg is against SimVenue SIMVENUE — SIMULATED, a simulated venue with an owner-settable funding rate behind the IVenue interface; Perpl is the next venue.
Two things the verified sources do not say: whether the 1% band and the 4-hour timer are enforced by the contract (a rebalance call reverts outside the conditions) or are keeper policy, and what happens if no keeper acts.
Public check. Read spot position and short notional, compute net delta, and confirm it never sits outside the band for longer than the timer. This requires an indexer over rebalance events. The events do not exist publicly yet.
Status. Litepaper commitment. Enforcement locus (contract or keeper) is undocumented.
4. Reserve target
Statement. Reserve target is 2% of TVL.
Mechanism. The Reserve is funded from the protocol-fee split: half of the 10% fee goes to the Reserve until the target is met, after which the full fee goes to treasury. The Reserve sits second in the shortfall ordering, after Ballast and before Hull principal. It exists to smooth transient negative funding.
This is a target, not a floor. The Reserve can be below 2% after a drawdown, and the litepaper describes it that way. The precise invariant is that the fee split routes to the Reserve whenever it is under target. Whether the split is enforced in code is not stated in any verified source.
Public check. Read the Reserve balance and TVL. Observe that, while Reserve < 2% × TVL, half of each epoch's fee lands in the Reserve. Not possible until contracts are public.
Status. Litepaper commitment.
5. Liquidation buffer
Statement. Short-leg liquidation price sits ≥ 40% above mark. A buffer breach triggers de-risking, never added leverage.
Mechanism. At launch leverage λ ≤ 2, so per unit of TVL the book is 66.7% spot, 33.3% short margin, and 66.7% hedged notional, with a 10% idle USDC buffer held unhedged. Margin maintenance draws on the idle buffer; keepers top up margin permissionlessly. If the buffer is breached, the protocol reduces exposure. The litepaper is explicit that the response is never to add leverage.
The verified sources do not state what "de-risk" means in position terms (close a fraction of both legs, close the short only, or halt), nor whether the 40% distance is a hard revert condition or a keeper target.
Public check. Read the short position's liquidation price from the venue and the mark price, and compute the distance. On SimVenue SIMVENUE — SIMULATED the funding rate is owner-settable, so this check on testnet says nothing about behaviour on a live venue. It becomes meaningful once the Perpl leg is wired.
Status. Litepaper commitment. Testnet observations will be against a simulated venue.
6. No privileged mint path
Statement. "No privileged mint path exists in any Vessel contract."
Mechanism. Hull and Ballast tokens are minted only against deposited capital, subject to the subordination floor. vUSD, planned for Phase 3 after audit, is minted 1:1 against the delta-neutral book and overcollateralized by Ballast plus Reserve. The landing page states the same commitment as "no admin mint." The claim is that no role, owner, or governance key can create tokens without backing.
Public check. This one is checkable from source alone, without running anything. Read every mint call site in the verified contracts and confirm each is reachable only through a deposit path. Until the source is public, the only evidence is the sentence in the litepaper.
Status. Litepaper and landing-page commitment. The strongest of the six to verify once source exists, and unverifiable until then.
What "verified" will mean
Each invariant moves from "committed" to "verified" on this page only when all three hold: the contract source is public and explorer-verified on Monad testnet, the check described above has been run by someone outside the team, and the result is linked from this page. Until then the status column does not change.