04net

Three Solana perpetual venues have died or been drained in eighteen months.

Zeta Markets ended perpetual operations on 2025-05-01. Mango v4 finished liquidating on 2025-01-13. Drift, the largest order-book venue on the chain and the predecessor of the venue this protocol hedges through, was exploited for 285 to 295 million dollars in 2026-04 and relaunched as Velocity DEX on 2026-07-01 with a 127.5 million dollar credit facility behind it. Single-venue dependence on this chain is not a tail assumption. It is a documented event with three instances and three dates. Everything below is written on that basis.

04.1buffer

Three mechanics decide how much the buffer can absorb.

A buffer is only as credible as the rule that fills it, the rule that spends it, and the size it is aiming at. All three are below, and none of them is a discretionary decision taken after the fact.

01
Funded from revenue, which means it is not always being funded
A fixed share of positive carry is routed to the buffer before any distribution. In a negative regime there is no positive carry to route, so the buffer stops filling and starts draining. The balance and the direction it is travelling are published together.
02
Sized in days, against a measured precedent
The target is the cost of carrying the current book through a sustained negative regime. Bitcoin funding stayed negative for roughly 46 to 50 days after the November 2022 FTX collapse, so coverage is published as days of carry at the present rate rather than as a comfortable percentage.
03
Drawn first, refilled first
While carry is negative the buffer pays. When carry turns positive again it refills before distributions resume. Holders receive nothing for that period, and the schedule is published rather than announced afterwards.

04.2failure

Eight ways this breaks, each with the part it does not cover.

Every entry below has the same three lines: what the condition does to the book, what the protocol does about it, and what that response leaves untouched. The third line is the one most disclosures omit, so it is set in the warning colour and printed at the same size as the other two.

01condition

Negative carry

What happens

The short leg pays instead of receiving, and holding the hedge costs money before any other failure applies. This is not a tail case: measured on 2026-08-09, SOL perpetual carry was negative over the trailing 24 hours, the trailing 30 days, and the trailing year.

What Poyz does

Issuance is refused below the carry threshold, so the book does not grow into a losing position. The buffer absorbs the cost on the existing book, and the protocol deleverages on published buffer thresholds as it drains.

What it does not do

The gate protects new issuance, not existing holders. A regime that outlasts the buffer reduces backing per unit for everyone already in, and deleveraging trades carry cost for disclosed directional exposure rather than making the cost disappear.

02condition

Venue failure, which has happened three times

What happens

A venue halts, socialises losses, auto-deleverages, is exploited, or shuts down, and the short can shrink or vanish without consent. Zeta Markets ended perpetual operations on 2025-05-01, Mango v4 finished liquidating on 2025-01-13, and Drift was drained in 2026-04.

What Poyz does

Notional is capped per venue so no single one carries the whole hedge, the keeper re-hedges the affected notional to a surviving venue as soon as the failure is detected, and the adapter layer makes adding a venue a configuration change rather than a rewrite.

What it does not do

Margin stranded at a failed venue is not recoverable by re-hedging. That portion is a realised loss and it is reported as one.

03condition

Auto-deleveraging

What happens

A venue force-closes profitable opposing positions to cover bankrupt ones. The short is most profitable during exactly the crash where it is most needed.

What Poyz does

Multi-venue exposure limits the blast radius, and a pre-authorised emergency re-hedge reopens the short at the new price.

What it does not do

Nothing prevents being selected. The hedge can be closed mid-crash and reopened lower, and the difference is a loss.

04condition

Liquidation of the short leg

What happens

A fast rally exhausts margin on the perpetual before a correction lands, leaving collateral partly unhedged.

What Poyz does

Hedge leverage stays low and the keeper tops up ahead of the threshold, funded by the collateral's own gain during that rally.

What it does not do

A gap fast enough to cross the maintenance level between blocks liquidates before any keeper can respond.

05condition

Oracle staleness or deviation

What happens

Pyth returns a stale price or a wide confidence band, and mispriced mints or corrections become possible.

What Poyz does

Mint and redeem are rejected outside the confidence band, and rebalancing halts on a stale feed rather than acting on it.

What it does not do

A price that is wrong at every venue at once is also wrong here. Halting limits the damage; it does not undo it.

06condition

LST discount

What happens

A liquid staking token trades below the asset the perpetual tracks, and the hedge ratio breaks quietly.

What Poyz does

Collateral is valued on its own feed rather than at par, so the discount shows in backing immediately instead of at redemption.

What it does not do

The discount is a real reduction in collateral value while it lasts. Pricing it honestly does not remove it.

07condition

Program risk

What happens

A defect in the Anchor program, or misuse of the upgrade authority, affects mint, redeem, or the keeper path.

What Poyz does

The program, the IDL, and the upgrade authority are published, and the parameters are readable from the chain rather than from this page.

What it does not do

Publication is not proof of correctness. Unreviewed code with an active upgrade authority is an open exposure.

08condition

Keeper liveness

What happens

Keepers stop submitting, and deviation grows past the threshold with nothing correcting it.

What Poyz does

Keeping is open and bonded: anyone can run one, and a missed or dishonest execution is slashed against the bond.

What it does not do

Incentives raise the odds that someone is running. They do not guarantee that someone is.

09condition

The primary venue was drained four months ago

What happens

Drift, the order-book venue the primary leg descends from, was exploited for 285 to 295 million dollars in 2026-04, the second largest theft in Solana's history. The attacker moved funds under pre-signed Security Council approval captured through a durable nonce. The venue relaunched as Velocity DEX on 2026-07-01 with a 127.5 million dollar credit facility behind it, and access is still restricted. The hedge that makes this instrument work runs through that book.

What Poyz does

The venue is treated as a counterparty with four months of post-incident history rather than as infrastructure. Notional is capped per venue, capacity and concentration sit next to the issuance state, and the adapter layer keeps the venue set a configuration decision. Redemption is never gated on venue health.

What it does not do

There is no version of this instrument that depends on no perpetual venue at all. Choosing the leg that pays funding to a short means choosing the venue that was drained in April, because the alternative legs charge a borrow fee instead of paying one. That is a trade, and it is stated rather than smoothed over.

10condition

Hedge capacity, which is small

What happens

A hedge cannot exceed the book that absorbs it. Open interest on the primary venue measured four figures of dollars on 2026-08-09, against a day of volume of the same order. There is not enough book there to hedge a large amount of collateral, so hedgeable size, not demand, is what limits issuance.

What Poyz does

Issuance is capped at what can actually be hedged, and venue capacity is published next to that cap rather than discovered at mint time. Overflow routes to a secondary leg that charges a borrow fee, and that cost is priced into the gate instead of being averaged away.

What it does not do

A capacity cap is a real ceiling on the size of this product. It is not a temporary condition being managed, and it does not lift because more collateral arrives.

04.3questions

The three questions that decide whether to hold this.

Negative funding, a venue that stops existing, and the possibility of losing money. Each answer names the mechanism and the point at which it stops helping.

Because the alternative designs do not stop. A protocol that mints regardless of carry hands its holders a cost and reports it as a yield until the buffer runs out. Poyz publishes the signed rate on every page, refuses new issuance below its threshold, and keeps redemption open throughout. When carry turns positive the gate opens on its own. The product is the discipline, not a prediction about when the market turns.

The buffer is drawn down first, and the interface publishes how many days of carry it covers at the current rate. Distributions to stakers floor at zero. As the buffer drains further, the protocol deleverages on published thresholds, cutting the carry cost at the price of reintroducing bounded and disclosed directional exposure. Below the last threshold, issuance is fully closed and the book unwinds toward a lower-leverage posture. Redemption stays open the entire way down, which means the exit is available while the loss is still small. Bitcoin funding stayed negative for roughly 46 to 50 days after the November 2022 FTX collapse, so the buffer is sized in days against that precedent rather than against a comfortable one.

Three Solana perpetual venues have already died or been drained in eighteen months, so this question is not hypothetical. Zeta Markets ended perpetual operations on 2025-05-01. Mango v4 finished liquidating on 2025-01-13. Drift, the largest order-book venue on the chain, was exploited for 285 to 295 million dollars in 2026-04 and relaunched as Velocity DEX on 2026-07-01. Poyz routes through a venue-adapter interface, which makes the venue set a configuration decision rather than an architectural one, and caps notional per venue so no single one carries the whole hedge. What that does not fix: margin stranded at a failed venue is not recoverable by re-hedging, and auto-deleveraging can close the short during exactly the crash where it is most needed. Both are realised losses and both are reported as such.

04.4 direct

Can you lose money holding this?

Yes, and while carry is negative that is the expected direction rather than the unlucky one, because a negative rate is a cost incurred simply by holding the hedge. Beyond that, backing per unit falls if a negative regime outlasts the buffer, if a venue strands margin, if the short is auto-deleveraged or liquidated during a gap, if an LST trades below the asset it tracks, or if the program has a defect. The protocol's answer to the first of those is to stop issuing, not to promise it away. Anyone describing this instrument without that paragraph is selling something else.

Three Solana perpetual venues have died or been drained in eighteen months.

Can you lose money holding this?

Three Solana perpetual venues have died or been drained in eighteen months.

Three mechanics decide how much the buffer can absorb.

Funded from revenue, which means it is not always being funded

Sized in days, against a measured precedent

Drawn first, refilled first

Eight ways this breaks, each with the part it does not cover.

Negative carry

Venue failure, which has happened three times

Auto-deleveraging

Liquidation of the short leg

Oracle staleness or deviation

LST discount

Program risk

Keeper liveness

The primary venue was drained four months ago

Hedge capacity, which is small

The three questions that decide whether to hold this.

01If carry is negative, why does this exist?+

02What happens when carry stays negative?+

03What if a hedge venue goes down?+

Can you lose money holding this?

Three Solana perpetual venues have died or been drained in eighteen months.

Three mechanics decide how much the buffer can absorb.

Funded from revenue, which means it is not always being funded

Sized in days, against a measured precedent

Drawn first, refilled first

Eight ways this breaks, each with the part it does not cover.

Negative carry

Venue failure, which has happened three times

Auto-deleveraging

Liquidation of the short leg

Oracle staleness or deviation

LST discount

Program risk

Keeper liveness

The primary venue was drained four months ago

Hedge capacity, which is small

The three questions that decide whether to hold this.

01If carry is negative, why does this exist?+

02What happens when carry stays negative?+

03What if a hedge venue goes down?+

Can you lose money holding this?