| Negative carry | What happensThe short leg pays instead of receiving, and holding the hedge costs money before any other failure applies. This is not a tail case: SOL perpetual carry has been negative on the recent windows while the longer ones read positive, so the regime is something the book moves in and out of rather than an edge it occasionally touches. Every window is published with its sign and its coverage. | What Poyz doesIssuance is refused below the carry threshold, so the book does not grow into a losing position. The buffer absorbs the cost on the existing book, and the protocol deleverages on published buffer thresholds as it drains. | What it does not doThe gate protects new issuance, not existing holders. A regime that outlasts the buffer reduces backing per unit for everyone already in, and deleveraging trades carry cost for disclosed directional exposure rather than making the cost disappear. |
|---|
| Venue failure, which has happened three times | What happensA venue halts, socialises losses, auto-deleverages, is exploited, or shuts down, and the short can shrink or vanish without consent. Zeta Markets ended perpetual operations on 2025-05-01, Mango v4 finished liquidating on 2025-01-13, and Drift was drained in 2026-04. | What Poyz doesNotional is capped per venue so no single one carries the whole hedge, the keeper re-hedges the affected notional to a surviving venue as soon as the failure is detected, and the adapter layer makes adding a venue a configuration change rather than a rewrite. | What it does not doMargin stranded at a failed venue is not recoverable by re-hedging. That portion is a realised loss and it is reported as one. |
|---|
| Auto-deleveraging | What happensA venue force-closes profitable opposing positions to cover bankrupt ones. The short is most profitable during exactly the crash where it is most needed. | What Poyz doesMulti-venue exposure limits the blast radius, and a pre-authorised emergency re-hedge reopens the short at the new price. | What it does not doNothing prevents being selected. The hedge can be closed mid-crash and reopened lower, and the difference is a loss. |
|---|
| Liquidation of the short leg | What happensA fast rally exhausts margin on the perpetual before a correction lands, leaving collateral partly unhedged. | What Poyz doesHedge leverage stays low and the keeper tops up ahead of the threshold, funded by the collateral's own gain during that rally. | What it does not doA gap fast enough to cross the maintenance level between blocks liquidates before any keeper can respond. |
|---|
| Oracle staleness or deviation | What happensPyth returns a stale price or a wide confidence band, and mispriced mints or corrections become possible. | What Poyz doesMint and redeem are rejected outside the confidence band, and rebalancing halts on a stale feed rather than acting on it. | What it does not doA price that is wrong at every venue at once is also wrong here. Halting limits the damage; it does not undo it. |
|---|
| LST discount | What happensA liquid staking token trades below the asset the perpetual tracks, and the hedge ratio breaks quietly. | What Poyz doesCollateral is valued on its own feed rather than at par, so the discount shows in backing immediately instead of at redemption. | What it does not doThe discount is a real reduction in collateral value while it lasts. Pricing it honestly does not remove it. |
|---|
| Program risk | What happensA defect in the Anchor program, or misuse of the upgrade authority, affects mint, redeem, or the keeper path. | What Poyz doesThe program, the IDL, and the upgrade authority are published, and the parameters are readable from the chain rather than from this page. | What it does not doPublication is not proof of correctness. Unreviewed code with an active upgrade authority is an open exposure. |
|---|
| Keeper liveness | What happensKeepers stop submitting, and deviation grows past the threshold with nothing correcting it. | What Poyz doesKeeping is open and bonded: anyone can run one, and a missed or dishonest execution is slashed against the bond. | What it does not doIncentives raise the odds that someone is running. They do not guarantee that someone is. |
|---|
| The primary venue was drained four months ago | What happensDrift, the order-book venue the primary leg descends from, was exploited for 285 to 295 million dollars in 2026-04, the second largest theft in Solana's history. The attacker moved funds under pre-signed Security Council approval captured through a durable nonce. The venue relaunched as Velocity DEX on 2026-07-01 with a 127.5 million dollar credit facility behind it, and access is still restricted. The hedge that makes this instrument work runs through that book. | What Poyz doesThe venue is treated as a counterparty with four months of post-incident history rather than as infrastructure. Notional is capped per venue, capacity and concentration sit next to the issuance state, and the adapter layer keeps the venue set a configuration decision. Redemption is never gated on venue health. | What it does not doThere is no version of this instrument that depends on no perpetual venue at all. Choosing the leg that pays funding to a short means choosing the venue that was drained in April, because the alternative legs charge a borrow fee instead of paying one. That is a trade, and it is stated rather than smoothed over. |
|---|
| Hedge capacity, which is small | What happensA hedge cannot exceed the book that absorbs it. Open interest on the primary venue measured four figures of dollars on 2026-08-09, against a day of volume of the same order. There is not enough book there to hedge a large amount of collateral, so hedgeable size, not demand, is what limits issuance. | What Poyz doesIssuance is capped at what can actually be hedged, and venue capacity is published next to that cap rather than discovered at mint time. Overflow routes to a secondary leg that charges a borrow fee, and that cost is priced into the gate instead of being averaged away. | What it does not doA capacity cap is a real ceiling on the size of this product. It is not a temporary condition being managed, and it does not lift because more collateral arrives. |
|---|