Delta-neutral synthetic dollar on Solana
A delta-neutral synthetic dollar whose carry is published with the sign attached. While that carry sits below threshold, issuance stays closed.
Spot collateral is offset by an equal-notional perpetual short. What that pair earns is perpetual carry, a market rate with a sign rather than a return, published as it is measured. Delta Keeper corrects the pair past threshold and commits each execution on-chain, and the protocol declines to issue while carry sits below its floor.
A delta-neutral dollar is usually sold as a yield. That yield is perpetual carry, carry is a market rate, and a market rate can stay negative for months at a stretch. What follows is not a list of things that could go wrong. It is a list of things already measured.
The short leg receives funding only while the market is net long. Measured on 2026-08-09, SOL perpetual carry was negative over the trailing 24 hours, the trailing 30 days, and the trailing year, which makes the standard pitch for this product backwards in that regime.
Three have died or been drained in eighteen months. Zeta Markets ended perpetual operations on 2025-05-01, Mango v4 finished liquidating on 2025-01-13, and Drift was exploited for 285 to 295 million dollars in 2026-04 before relaunching as Velocity DEX on 2026-07-01. A hedge welded to one venue inherits whichever of those comes next.
An order-book venue pays funding to a short. A liquidity-pool venue charges a borrow fee to any open position regardless of side. Summing them into one figure hides that the second leg is a fixed cost rather than a smaller version of the first.
A hedge is only as large as the book that can absorb it. Open interest on the primary venue measured four figures of dollars on 2026-08-09, which is a hard ceiling on how much collateral can be hedged and therefore on how much can be issued.
A short opened at equal notional stops being equal as soon as the underlying moves. The book is neutral at the instant it was set, and every minute after that is drift.
Unwinding means buying back the short into the same market that caused the redemption, at the moment depth is worst.
None of these is exotic. Each is the ordinary case, and each is priced by how long it goes unmeasured.
Five operations, run in order. The first is the one that makes this different: before collateral is accepted the protocol reads net carry and available hedge capacity, and declines when either sits on the wrong side of its threshold. The other four are the ordinary mechanics, on-chain where it counts, and each is a real instruction with a signature attached.
01
Net carry and hedge capacity are read before anything else. When the smoothed carry sits below its floor, or the venue book cannot absorb the hedge the deposit would require, the mint reverts and the reason is published. Refusing is a state the protocol enters on its own, not a decision someone makes that week. Past the gate, SOL or a supported LST is deposited at the Pyth mid with a confidence band, and a deposit outside that band is rejected rather than filled at a stale price.
02
A perpetual short of equal notional is opened. Velocity DEX carries it by default, because an order-book venue is the only leg that can pay funding to a short. Jupiter Perps takes the overflow when capacity or concentration forces it, and that leg charges a borrow fee rather than paying one. The router prices that asymmetry instead of splitting evenly.
03
The synthetic dollar is minted against the hedged pair. Backing is the pair, not the spot leg, which is why the mint fails outright if the short could not be filled at the required notional.
04
Delta Keeper measures deviation against collateral notional each interval. Past the threshold it resizes the short, then commits venue, notional change, fill price, and the deviation before and after to the Anchor program, which recomputes the delta rather than trusting the submitted figure.
05
Burning the synthetic dollar reduces the short by the same notional and releases the matching collateral. The quote shown before signing includes the unwind cost, so the number on the confirmation is the number received. Redemption is not gated on carry: the exit stays open when the entrance does not.
The synthetic dollar is minted against the hedged pair, never against the long leg on its own. A short that cannot be filled at the required notional is a mint that does not happen.
Delta is reported as signed deviation from collateral notional, so the figure means the same thing at every book size. It is published live, not averaged over a month.
Correcting on every tick would cost more in fees and slippage than the drift does. The book is held inside a band and pulled back when it leaves, which is a stated tradeoff rather than an approximation of perfection.
Each venue is scored on carry, execution slippage, persistent basis, and margin health. An order-book leg can pay the hedge; a liquidity-pool leg charges it. Being hedged at a small carry cost beats being unhedged, and the router prices that rather than averaging it away.
Corrections in the last 24 hours sit in the header with the time of the most recent one, rather than in a monthly report. A long silence in that number is itself information.
Zeta Markets ended perpetual operations on 2025-05-01. Mango v4 finished liquidating on 2025-01-13. Drift, the largest order-book venue on the chain and the predecessor of the venue this protocol hedges through, was exploited for 285 to 295 million dollars in 2026-04 and relaunched as Velocity DEX on 2026-07-01 with a 127.5 million dollar credit facility behind it. Single-venue dependence on this chain is not a tail assumption. It is a documented event with three instances and three dates. Everything below is written on that basis.
A fixed share of positive carry is routed to the buffer before any distribution. In a negative regime there is no positive carry to route, so the buffer stops filling and starts draining. The balance and the direction it is travelling are published together.
The target is the cost of carrying the current book through a sustained negative regime. Bitcoin funding stayed negative for roughly 46 to 50 days after the November 2022 FTX collapse, so coverage is published as days of carry at the present rate rather than as a comfortable percentage.
While carry is negative the buffer pays. When carry turns positive again it refills before distributions resume. Holders receive nothing for that period, and the schedule is published rather than announced afterwards.
| Risk | What happens | What Poyz does | What it does not do |
|---|---|---|---|
| Negative carry | What happensThe short leg pays instead of receiving, and holding the hedge costs money before any other failure applies. This is not a tail case: measured on 2026-08-09, SOL perpetual carry was negative over the trailing 24 hours, the trailing 30 days, and the trailing year. | What Poyz doesIssuance is refused below the carry threshold, so the book does not grow into a losing position. The buffer absorbs the cost on the existing book, and the protocol deleverages on published buffer thresholds as it drains. | What it does not doThe gate protects new issuance, not existing holders. A regime that outlasts the buffer reduces backing per unit for everyone already in, and deleveraging trades carry cost for disclosed directional exposure rather than making the cost disappear. |
| Venue failure, which has happened three times | What happensA venue halts, socialises losses, auto-deleverages, is exploited, or shuts down, and the short can shrink or vanish without consent. Zeta Markets ended perpetual operations on 2025-05-01, Mango v4 finished liquidating on 2025-01-13, and Drift was drained in 2026-04. | What Poyz doesNotional is capped per venue so no single one carries the whole hedge, the keeper re-hedges the affected notional to a surviving venue as soon as the failure is detected, and the adapter layer makes adding a venue a configuration change rather than a rewrite. | What it does not doMargin stranded at a failed venue is not recoverable by re-hedging. That portion is a realised loss and it is reported as one. |
| Auto-deleveraging | What happensA venue force-closes profitable opposing positions to cover bankrupt ones. The short is most profitable during exactly the crash where it is most needed. | What Poyz doesMulti-venue exposure limits the blast radius, and a pre-authorised emergency re-hedge reopens the short at the new price. | What it does not doNothing prevents being selected. The hedge can be closed mid-crash and reopened lower, and the difference is a loss. |
| Liquidation of the short leg | What happensA fast rally exhausts margin on the perpetual before a correction lands, leaving collateral partly unhedged. | What Poyz doesHedge leverage stays low and the keeper tops up ahead of the threshold, funded by the collateral's own gain during that rally. | What it does not doA gap fast enough to cross the maintenance level between blocks liquidates before any keeper can respond. |
| Oracle staleness or deviation | What happensPyth returns a stale price or a wide confidence band, and mispriced mints or corrections become possible. | What Poyz doesMint and redeem are rejected outside the confidence band, and rebalancing halts on a stale feed rather than acting on it. | What it does not doA price that is wrong at every venue at once is also wrong here. Halting limits the damage; it does not undo it. |
| LST discount | What happensA liquid staking token trades below the asset the perpetual tracks, and the hedge ratio breaks quietly. | What Poyz doesCollateral is valued on its own feed rather than at par, so the discount shows in backing immediately instead of at redemption. | What it does not doThe discount is a real reduction in collateral value while it lasts. Pricing it honestly does not remove it. |
| Program risk | What happensA defect in the Anchor program, or misuse of the upgrade authority, affects mint, redeem, or the keeper path. | What Poyz doesThe program, the IDL, and the upgrade authority are published, and the parameters are readable from the chain rather than from this page. | What it does not doPublication is not proof of correctness. Unreviewed code with an active upgrade authority is an open exposure. |
| Keeper liveness | What happensKeepers stop submitting, and deviation grows past the threshold with nothing correcting it. | What Poyz doesKeeping is open and bonded: anyone can run one, and a missed or dishonest execution is slashed against the bond. | What it does not doIncentives raise the odds that someone is running. They do not guarantee that someone is. |
| The primary venue was drained four months ago | What happensDrift, the order-book venue the primary leg descends from, was exploited for 285 to 295 million dollars in 2026-04, the second largest theft in Solana's history. The attacker moved funds under pre-signed Security Council approval captured through a durable nonce. The venue relaunched as Velocity DEX on 2026-07-01 with a 127.5 million dollar credit facility behind it, and access is still restricted. The hedge that makes this instrument work runs through that book. | What Poyz doesThe venue is treated as a counterparty with four months of post-incident history rather than as infrastructure. Notional is capped per venue, capacity and concentration sit next to the issuance state, and the adapter layer keeps the venue set a configuration decision. Redemption is never gated on venue health. | What it does not doThere is no version of this instrument that depends on no perpetual venue at all. Choosing the leg that pays funding to a short means choosing the venue that was drained in April, because the alternative legs charge a borrow fee instead of paying one. That is a trade, and it is stated rather than smoothed over. |
| Hedge capacity, which is small | What happensA hedge cannot exceed the book that absorbs it. Open interest on the primary venue measured four figures of dollars on 2026-08-09, against a day of volume of the same order. There is not enough book there to hedge a large amount of collateral, so hedgeable size, not demand, is what limits issuance. | What Poyz doesIssuance is capped at what can actually be hedged, and venue capacity is published next to that cap rather than discovered at mint time. Overflow routes to a secondary leg that charges a borrow fee, and that cost is priced into the gate instead of being averaged away. | What it does not doA capacity cap is a real ceiling on the size of this product. It is not a temporary condition being managed, and it does not lift because more collateral arrives. |
Yes, and while carry is negative that is the expected direction rather than the unlucky one, because a negative rate is a cost incurred simply by holding the hedge. Beyond that, backing per unit falls if a negative regime outlasts the buffer, if a venue strands margin, if the short is auto-deleveraged or liquidated during a gap, if an LST trades below the asset it tracks, or if the program has a defect. The protocol's answer to the first of those is to stop issuing, not to promise it away. Anyone describing this instrument without that paragraph is selling something else.
Nothing below is asserted. Each of the four is read from the chain or from the live book at the moment you are looking at it.
The figure carries its trailing window, its estimate label, and its sign, and it is shown across 24 hours, 7 days, and 30 days at once, because publishing one flattering window is the standard trick in this category. Funding received from an order-book venue and a borrow fee paid to a liquidity-pool venue are different economics, so they render as different rows and are never summed into a single number.
Venue open interest, the hedge already placed against it, and the concentration across venues are all published. Capacity is what limits this product first, so it sits beside the issuance state rather than in a technical appendix.
Each correction commits venue, notional change, fill price, and the deviation before and after to the Anchor program, which recomputes the delta itself instead of trusting the submitted figure. The signature is linked from the row, so a claimed correction and a settled correction are the same object.
Any metric without a fresh reading is removed from the interface rather than filled with a last-known value or a zero. An absent number is a truthful state, and it is displayed as one.
This page runs on that rule: a figure with no fresh reading is left out of the markup rather than filled in.
$POYZ is what protocol revenue settles through and what keepers put at stake. Each function below is an on-chain instruction with a parameter you can read from the program rather than from this page. Three of the four depend on positive carry existing, which is stated here rather than discovered later.
A share of protocol fees taken from positive carry buys $POYZ on the open market and burns it. The share is a program parameter, and burned supply is cumulative and queryable. When carry is negative there are no fees of this kind, so this stream is absent rather than small.
Staked $POYZ raises a holder's share of the net carry distribution up to a stated cap. It changes how a distribution is divided; it does not create one. When net carry is negative there is nothing to divide, and a larger share of nothing is still nothing.
Running a Delta Keeper requires bonding $POYZ. Corrections are submitted against that bond, and an execution that is late, misreported, or routed outside the allowed path is slashed. Keeping is open to anyone willing to post the bond and be measured on it, and this function works in every regime, because correction is needed most when carry is worst.
$POYZ staked into the buffer earns a premium out of positive carry and is first in line to absorb a negative regime. This is compensated risk-taking, stated as such: the premium exists because the stake can be drawn down, and the current drawdown state is shown before anyone stakes.
Read the carry, read the failure conditions, then decide. The order matters more than the decision, and the first number is published on every page for that reason.
Questions, answered at length
A synthetic dollar on Solana. Collateral is SOL or a liquid staking token, and against every unit of it an equal-notional perpetual short is opened. The long and the short move against each other, so the pair holds a dollar value while neither leg does on its own. What that pair earns or costs is perpetual carry, a market rate with a sign, and the protocol publishes it rather than converting it into a headline return.
From carry paid to the short leg while the market is net long. Measured on 2026-08-09 there was not one: SOL perpetual carry was negative over 24 hours, over 30 days, and over one year, which means a delta-neutral SOL position cost money to hold in that regime. The current answer is not in this paragraph, it is in the header, where the signed figure is published next to the issuance state. That is the reason the protocol gates issuance instead of advertising a number.
Because the alternative designs do not stop. A protocol that mints regardless of carry hands its holders a cost and reports it as a yield until the buffer runs out. Poyz publishes the signed rate on every page, refuses new issuance below its threshold, and keeps redemption open throughout. When carry turns positive the gate opens on its own. The product is the discipline, not a prediction about when the market turns.
The buffer is drawn down first, and the interface publishes how many days of carry it covers at the current rate. Distributions to stakers floor at zero. As the buffer drains further, the protocol deleverages on published thresholds, cutting the carry cost at the price of reintroducing bounded and disclosed directional exposure. Below the last threshold, issuance is fully closed and the book unwinds toward a lower-leverage posture. Redemption stays open the entire way down, which means the exit is available while the loss is still small. Bitcoin funding stayed negative for roughly 46 to 50 days after the November 2022 FTX collapse, so the buffer is sized in days against that precedent rather than against a comfortable one.
Three Solana perpetual venues have already died or been drained in eighteen months, so this question is not hypothetical. Zeta Markets ended perpetual operations on 2025-05-01. Mango v4 finished liquidating on 2025-01-13. Drift, the largest order-book venue on the chain, was exploited for 285 to 295 million dollars in 2026-04 and relaunched as Velocity DEX on 2026-07-01. Poyz routes through a venue-adapter interface, which makes the venue set a configuration decision rather than an architectural one, and caps notional per venue so no single one carries the whole hedge. What that does not fix: margin stranded at a failed venue is not recoverable by re-hedging, and auto-deleveraging can close the short during exactly the crash where it is most needed. Both are realised losses and both are reported as such.
Not large, at present. Open interest on the primary venue measured four figures of dollars on 2026-08-09, and a hedge cannot exceed the book that absorbs it. Issuance is capped at what can actually be hedged, and the venue capacity figure is published next to that cap rather than discovered at mint time. A capacity ceiling is a real limit on this product's size, not a temporary condition being worked around.
Yes, and while carry is negative that is the expected direction rather than the unlucky one, because a negative rate is a cost incurred simply by holding the hedge. Beyond that, backing per unit falls if a negative regime outlasts the buffer, if a venue strands margin, if the short is auto-deleveraged or liquidated during a gap, if an LST trades below the asset it tracks, or if the program has a defect. There is also a case that is not about backing at all: the token can trade on a secondary market below what it redeems for, and selling there returns less than redeeming at the protocol.
Three independent paths. The header publishes delta against its threshold, net carry with its sign, and the issuance state, live. Every rebalance commits venue, notional change, price, and the deviation before and after to the Anchor program, which recomputes the delta rather than trusting the submitted number, and each row links to its signature. The delta command prints the same figures from a terminal and exits non-zero when the book is outside its threshold, which makes it usable as a monitor rather than a page you have to remember to open.
Three ways across
Balanced. Always.
Not because nothing moves. Because something keeps moving it back.
