Scenario margin and constant maturity volatility for onchain equity options

Introduction

Overview

Prior Protocol is an exchange for equity options on a public ledger. It lists calls and puts on any underlying with a ratified price adapter, offers perpetual exposure to implied volatility directly, and extends credit against an options book without requiring the book to be closed.

What ships today

Everything described in these pages runs. The testnet terminal is the production pricing engine, the production Greeks and the production margin model executing locally in a browser against synthetic marks. What changes at mainnet is the settlement layer and the price adapters, not the mathematics.

101 tests in total. Zero runtime dependencies, no build step for the library itself.
Component	Module	Tests	Status
Pricing, Greeks, surface, solver	site/options.js	21	Running
Indices, funding, margin, collateral	site/perp.js	24	Running
Counterparty risk pricing	site/underwrite.js	18	Running
Claims, commitments, resolution	lib/	38	Running

Three products, one margin account

Options. European, cash settled, priced from a volatility surface with skew and term structure rather than a single number per underlying.

Volatility perpetuals. A perpetual whose index is 30 day at the money implied volatility. One unit is one vega and delta is exactly zero.

Credit. Borrowing power derived from the same scenario computation that produces margin, so the advance rate reflects the shape of the risk rather than a flat percentage of market value.

Design principles

No hand entered figures. Every number in this documentation and on the site is produced by the reference implementation and regenerated by npm run emit.
Revaluation over approximation. Margin prices the actual payoff in every scenario rather than expanding it locally, because the positions whose margin matters most are precisely those that are not locally quadratic.
State the limits. The limitations page is written at the same length as the results.

Why onchain options failed

Perpetual futures reached substantial volume on public ledgers. Options did not, despite repeated attempts by well funded teams. The usual explanations are capital inefficiency and adverse selection against passive liquidity providers. Both are real. Neither is the binding constraint.

Counting instruments

A perpetual venue listing n underlyings operates n markets. An option venue listing the same underlyings with m strikes and k expiries operates 2nmk, since calls and puts are distinct instruments.

2 n m k = 2 \times 20 \times 11 \times \bar{k} = 2376

The reference configuration lists twenty underlyings across eleven strikes. Equities carry five tenors and crypto carries six, since a market that never closes can support a one day expiry. That is 1320 equity contracts and 1056 crypto contracts, 2376 in total, against twenty markets for the perpetual equivalent. A ratio of 119.

Aggregate flow that produces a usable book on a perpetual venue produces, spread across an option surface, under one percent of that depth per contract.

The consequence

Market makers respond to thin books by widening or withdrawing, which removes the remaining flow, which thins the book further. The failure is not that participants dislike options. It is that the instrument count divides liquidity past the point where any single contract is tradable.

What follows

Two design consequences organise the rest of the protocol.

Quoting must be parameterised. A maker should express a view once, as a surface, and have that view price every contract at once. This is why the volatility surface is a first class object rather than an afterthought.

Common exposures should be single instruments. The exposure traders most often want from options is volatility, and assembling it from several thin contracts is expensive. Hence the constant maturity index.

Architecture

Four modules, each with one responsibility and no dependency on anything above it. All are plain JavaScript with no build step and no runtime dependencies, imported unchanged by the browser, the test suite and the simulations.

module graph

site/options.js     pricing, Greeks, surface, implied vol solver
      └─ no imports

site/perp.js        indices, funding, scenario margin, collateral
      └─ imports options.js

site/underwrite.js  counterparty risk priced off a track record
      └─ no imports

lib/                claims, commitments, resolution, scoring
      └─ no imports

One file, two runtimes

The pricing and risk modules live under site/ rather than lib/ so that the browser can import them directly. The test suite and the simulations import the same files. There is no second implementation to keep in sync, and therefore no possibility of the browser and the server disagreeing about a price.

Why this matters for a margin engine

A venue whose front end and risk engine compute margin differently will eventually show a trader a number it does not honour. Sharing the module removes the failure mode rather than testing for it.

Generated figures

sim/emit.js runs the engine and writes site/data/*.json plus an ES module for pages that need to work without a server. Pages render from that output only, so a change in the engine is a change on the site.

Quickstart

The reference implementation has no dependencies and no build step. Node 18 or later.

clone and verify

$ git clone https://github.com/ghosting9458/prior-protocol
$ cd prior-protocol/priorem

$ npm test
  101 passing

$ npm run emit
  regenerates every figure used by the site

$ npm run underwrite -- --sweep
  the cold start curve for counterparty pricing

Price an option

node

import { price, greeks, surfaceVol } from './site/options.js';

const S = 182.40, K = 190, T = 30 / 365;
const sigma = surfaceVol({ S, K, T, atmVol: 0.42 });

price({ S, K, T, r: 0.05, q: 0, sigma, kind: 'call' });
greeks({ S, K, T, r: 0.05, q: 0, sigma, kind: 'call' });

Margin a portfolio

node

import { marginRequirement, borrowingPower } from './site/perp.js';

const book = [
  { kind: 'call', K: 190, expiryDays: 30, qty: -10 },
  { kind: 'call', K: 210, expiryDays: 30, qty:  10 }
];
const market = { S: 182.40, atmVol: 0.42, r: 0.05, q: 0 };

marginRequirement(book, market).initial;   // nets the spread
borrowingPower(book, market).advanceRate;  // what it lends

The testnet terminal runs these same calls in the browser. Nothing is fetched and no account is required.

Pricing

Notation

Symbols used throughout the documentation.

S: spot price of the underlying
K: strike
T: time to expiry in years
r: continuously compounded risk free rate
q: continuous dividend yield
σ: annualised volatility
τ: fixed tenor of a constant maturity index, in years
Φ, φ: standard normal distribution function and density
P: a portfolio, as a set of signed positions
V(P): mark to market value of P
L(P): worst case scenario loss of P
h: liquidation horizon in days
κ: scenario width in standard deviations

Greek units

Greeks are returned in the units used on a trading desk rather than in raw analytic units. This is a presentation choice applied consistently, and the conversion is part of the tested surface.

Greek	Reported as	Conversion
delta	per unit of spot	none
gamma	per unit of spot, per unit	none
vega	per volatility point	× 0.01
theta	per calendar day	÷ 365
rho	per rate point	× 0.01

Model and assumptions

Valuation is Black-Scholes-Merton with continuous dividend yield. The assumptions are stated here along with where each is violated, because a margin engine built on an unstated model cannot be audited.

Assumptions

European exercise. All listed contracts are European and cash settled. This is a design choice and removes early exercise entirely.
Frictionless continuous hedging. Violated in practice. The cost is borne by liquidity providers rather than by the margin engine.
Constant volatility to expiry. Violated, and the surface exists precisely because it is. Each strike carries its own implied volatility, so the model is used as a quoting convention and an interpolation device rather than as a claim about the law of the underlying.
Lognormal terminal distribution. Violated in the tails. Scenario margin does not rely on it.

On using a model known to be wrong

Black-Scholes is retained as the mapping between price and implied volatility, which is all that is asked of it. Because every strike carries its own volatility, the model imposes no distributional view of its own, and the risk calculation inherits no tail assumption from it.

The pricing functional

C = S e^{- q T} Φ (d_{1}) - K e^{- r T} Φ (d_{2})

d_{1} = \frac{\ln (S / K) + (r - q + \frac{σ^{2}}{2}) T}{σ \sqrt{T}}, d_{2} = d_{1} - σ \sqrt{T}

The normal distribution function

Φ is evaluated by the Hart rational approximation as refined by West, accurate to approximately 1e−15 across the real line. The precision is not decorative: the implied volatility solver differentiates through Φ, and a lower accuracy error function appears as noise in vega, which propagates into both quoting and margin.

Degenerate inputs

For T ≤ 0 or σ ≤ 0 the functional returns discounted forward intrinsic value, which is the correct limit. A pricer that returns NaN at expiry is a margin engine that fails at expiry.

Greeks

Analytic derivatives, converted to desk units on return. See notation for the conversions.

ν = \frac{\partial V}{\partial σ} \times 0.01 = S e^{- q T} φ (d_{1}) \sqrt{T} \times 0.01

Checked against numerical derivatives

Each analytic Greek is verified against the numerical derivative of the function it claims to differentiate: a central difference for vega, a second difference for gamma. An analytic expression that disagrees with its own numerical derivative is wrong however it was derived.

Anchor case: S = K = 100, T = 1, r = 0.05, q = 0, σ = 0.20. Asserted to 1e−10.
Quantity	Value
delta	0.636830651175619
gamma	0.018762017345847
vega	0.375240346916938
theta	−0.017572678209420
rho	0.532324815453763

Structural invariants

Gamma and vega are identical for a call and its matching put.
Put delta equals call delta less the dividend discount e^−qT.
Put-call parity holds across strikes, tenors and a non-zero dividend yield.

Parity in particular catches almost every sign error that survives inspection, which is why it is asserted across a grid rather than at a single point.

The volatility surface

Equity options do not trade at one volatility across strikes. Demand for downside protection is persistent and one sided, so out of the money puts trade above equidistant calls. A venue pricing every strike from a single number misprices its own wings, and a margin engine built on that surface cannot be trusted with collateral.

Parameterisation

Log moneyness is normalised by the square root of tenor, which holds the shape of the smile stable as expiry varies instead of letting it flatten mechanically.

k = \frac{\ln (K / S)}{\sqrt{T}}, σ = σ_{atm} (T) (1 + β k + γ k^{2})

Parameter	Value	Effect
β skew	−0.12	puts richer than calls
γ curvature	0.35	a smile rather than a line
term slope	0.04	per log unit of tenor about 30 days
clamp	[0.02, 4]	no strike can return a nonsense volatility

Measured shape

At S = 100, 30 days, 30% at the money

The surface returns 35.41% at K = 85, 30.00% at the money and 30.74% at K = 115. Downside is richer than upside as required, and upside sits slightly above the at the money level because the curvature term dominates the skew term once |k| is large. This is a smile with a negative tilt, which is the correct shape for single name equity.

Limitation

Skew and curvature are constants rather than fitted to traded prices. Adequate for a testnet, inadequate for a venue carrying real risk, where the surface should be fitted continuously and the margin engine should consume the fitted surface.

Implied volatility

Implied volatility is recovered by Newton iteration on vega with a bisection fallback, since Newton is unreliable where vega approaches zero.

When the solver returns nothing

Two cases. The first is a target price outside no arbitrage bounds. The second is more interesting and is often fudged elsewhere.

report σ only if \frac{\partial V}{\partial σ} \geq 10^{- 5}

Why

A deep in the money option at low volatility is worth intrinsic value whatever the volatility is. At S = 100, K = 70, T = 0.6 and σ = 0.08, vega is about 1.2e−6, so changing σ by 0.004 moves the price by 5e−9. The volatility is not identified by the price. Reporting a figure to four decimals would be false precision, so the solver returns nothing and the surface value is used instead.

Convergence

Newton converges in a handful of steps near the money. The bisection fallback always converges because price is monotone in volatility, and it covers the wings where Newton oscillates. Round trip accuracy is asserted at 1e−6 across strikes from 70 to 130, tenors and both option types.

Volatility perpetuals

Constant maturity indices

A perpetual future has no expiry and is held to its index by periodic funding. Applying that construction to a single option contract fails, and not for an implementation reason.

Why a fixed contract cannot carry a perpetual

Let the index be the price of a contract expiring at T₀. As t → T₀ the index tends to the terminal payoff and time value tends to zero.

\lim_{t \to T_{0}} V (t) = max (0, S - K), θ \neq 0

The index therefore carries a deterministic drift. Funding would have to offset theta in perpetuity, meaning the funding rate would be dominated by a known quantity rather than by the imbalance it exists to price. Past T₀ the index is undefined. The instrument is ill posed, not merely awkward.

Holding the tenor fixed

Fix τ instead of fixing the contract, and re-derive the index from the current surface at every observation.

I_{t} = 100 \times σ (k = 0, τ)

Since τ does not depend on t, there is no theta term. The index is a level in volatility points, not a decaying price. The same construction supports a rolling fixed delta call or an at the money straddle, quoted in currency.

Exposure, verified

One unit is one vega and exactly zero delta. Adding 100 units to a book carrying 12.27 vega and 84.86 delta produces 112.27 vega and leaves delta at 84.86, unchanged. Clean vega is otherwise obtainable only by running a hedged straddle and rebalancing it by hand.

Funding

Funding is charged on an eight hour cycle, proportional to the premium of mark over index, damped and capped.

f = clamp (\frac{(M - I) / I}{λ}, - f_{\max}, f_{\max})

Parameter	Value	Reason
interval	8h	convention
λ damping	3	nudge the mark over several intervals rather than snap it
f_max	0.0075	a dislocation must not generate a payment that liquidates the book it rebalances

Longs pay shorts when the mark trades above the index and receive when below, which pulls the two together without anyone settling. Damping is deliberate: an aggressive funding response is itself a source of liquidation cascades.

Margin

Scenario construction

Margin is computed by full revaluation of the portfolio at every node of a two dimensional grid in spot and volatility, taking the worst outcome.

L (P) = - \min_{(u, w) \in G} [V (P; S (1 + u), σ (1 + w)) - V (P)]

Revaluation, not a Greek expansion

A delta and gamma approximation is a local expansion. The positions whose margin matters most are exactly those that are not locally quadratic: short options near the strike, spreads whose legs cross, anything close to expiry. The grid prices the actual payoff at each node and inherits no approximation error.

An asymmetric volatility axis

Implied volatility rises far more violently than it falls, so the grid extends to +44.41% and only −11.10%. A short option book that looks safe under symmetric volatility shocks is exactly the book that fails in a real selloff.

Axis	Points	Range at 42% vol
Spot	9	±9.33%
Volatility	6	−11.10% to +44.41%
Cells priced	54	per margin call

Horizon scaling

The width of the grid determines whether the system is usable. What must be covered is the distance the market can travel before a liquidator can close the position, so the shock is derived from the liquidation horizon and the volatility of the underlying rather than chosen as a round percentage.

u_{\max} = κ σ \sqrt{\frac{h}{365}}

At σ = 0.42, h = 2 days and κ = 3 this gives 9.33%.

Inverting the relation

A system using a fixed ±25% shock is asserting a horizon:

h = 365 {(\frac{u_{\max}}{κ σ})}^{2} = 365 {(\frac{0.25}{3 \times 0.42})}^{2} \approx 14.4

Principal result

A fixed ±25% grid at single name volatility encodes an implied liquidation horizon of roughly two weeks. Under that assumption every long option is stressed to near zero and the system concludes, correctly given its own premise, that no option has collateral value. The conclusion is an artefact of the grid width, not a property of options. This is the difference between an engine that lends nothing and one that advances 65.7% against the same position.

What the horizon assumes

That a liquidator can exit within h days at a price near the mark. In a dislocation the wings do not trade at any price. No liquidity term is present in the model, and advance rates on thin strikes should be lower than the engine currently sets them.

Requirements and netting

Initial and maintenance requirements are multiples of the scenario loss.

The advance multiple is deliberately smaller. Opening new risk and lending against existing risk are different questions, and using one multiple for both double counts the buffer.
Quantity	Multiple	Meaning
initial	1.3	required to open new risk
maintenance	1.0	below this the account is liquidatable
advance	1.1	haircut for lending against risk already held

Liquidation level

Solved numerically by bisection. A portfolio of options admits no closed form for the spot at which it becomes liquidatable, and any closed form that did exist would be invalidated by adding a second leg.

Netting

Because the requirement is a function of the portfolio rather than a sum over positions, offsetting legs net automatically.

Measured

Converting a naked short call into a vertical spread reduces the initial requirement from $178.31 to $74.83, a reduction of 58.0%, with no special case for spreads anywhere in the implementation. A perfectly flat book requires zero margin, verified as a test rather than assumed.

Cross symbol margin

Margin computed one symbol at a time treats a book long twelve correlated names as twelve independent risks. It is not, and the error runs in the dangerous direction: the account is charged too little for precisely the concentration that fails together. This page closes that gap, which earlier revisions listed as the largest in the risk model.

Why not shock everything jointly

A joint grid over N symbols is |G|^N scenarios. At 54 cells and 20 symbols that is 54²⁰, which nobody will evaluate. Real risk systems impose a factor structure instead.

r_{i} = β_{i} F + ε_{i}, σ_{i}^{2} = β_{i}^{2} σ_{F}^{2} + σ_{ε}^{2}

The systematic part is one shared shock and diversifies not at all. The residuals are independent by construction. Everything is mutually independent, so the losses combine in quadrature.

M = \sqrt{L_{sys}^{2} + \sum_{i} L_{ε, i}^{2}}

Linear in the number of symbols to evaluate rather than exponential.

The decomposition

Factor volatility is 18% for equities and 45% for crypto. Residual volatility follows from the identity above.

BTC is close to being the crypto factor itself, so almost none of its risk diversifies. DOGE carries volatility no beta can explain, so most of its risk does.
Symbol	Vol	Beta	Systematic	Residual
MSFT	22%	0.95	17%	14%
NVDA	42%	1.60	29%	31%
MSTR	92%	3.20	58%	72%
BTC	46%	1.00	45%	10%
ETH	58%	1.20	54%	21%
DOGE	112%	1.90	86%	72%

Correlations rise in a crash

A model using placid period correlations awards its largest diversification credit precisely when that credit is least deserved. Beta is therefore stressed toward one as the factor move worsens, and only on the downside, because correlations rising in a rally does not threaten a margin system.

β^{*} = β + (1 - β) \cdot λ \cdot min (1, | F | / 0.15)

A defensive name is pulled up toward the factor, not down. Correlations going to one means everything behaves more like the market, which for a low beta name is more exposure rather than less.

Measured credit

Equal notional per name, 30 day calls 5% out of the money. A single symbol receives nothing, and credit grows with genuine breadth.
Book	Standalone	Cross margin	Credit
One name	$2,415	$2,415	0.0%
Two crypto majors	$6,242	$5,799	7.1%
Three correlated crypto	$11,417	$10,414	8.8%
Four megacap tech	$5,776	$5,518	4.5%
Eight, both classes	$24,676	$23,294	5.6%
Twelve, wide	$39,159	$36,077	7.9%

Deliberately conservative

Credits of 4% to 9% are well below what a mature prime broker awards. That is the intended setting for a venue that has never run in production. The credit is also hard capped at 45%, because a model that can award unlimited benefit will eventually award it to a book that is not diversified at all.

Errors found building this

Three, all caught by the numbers being wrong in an obvious direction

The factor grid was built from average symbol volatility and then multiplied by beta, counting beta twice. The result charged a diversified book roughly double the standalone sum.

Volatility was shocked in both legs. Implied volatility is overwhelmingly a systematic risk, and shocking it in the residual leg as well double counted the largest risk in an option book, overcharging a lone symbol by about 70%.

The legs were added linearly. Factor and residual returns are independent, so their losses combine in quadrature.

What is still missing

Betas are static constants, not estimated from returns and not updated. A real venue would re-estimate continuously and widen the grid when estimates are unstable.
One factor per asset class. Sector structure within equities is not modelled, so a book concentrated in semiconductors receives the same credit as one spread across sectors.
The cross class correlation is a constant pair of placid and stressed values rather than a fitted quantity.

Credit

The advance rate

A haircut on mark to market value is the wrong instrument for options. A long call and a short call may carry identical value and entirely different downside, so value alone contains no information about what is lendable.

B (P) = max (0, V (P) - η L (P)), a = \frac{B (P)}{V (P)}

Borrowing power follows from the same scenario loss that produces margin, with advance haircut η = 1.1. Positions whose scenario loss exceeds their value contribute nothing and can drive the expression negative, which is correct treatment: a short option book is a liability, not collateral.

A correction made during development

An earlier revision applied the initial margin multiple of 1.3 to borrowing as well, which double counted the buffer and reported zero borrowing power against every long position. That looked like a property of options and was a property of the formula.

Measured advance rates

The same underlying, expiry and quantity. The only variable is the strike.

Twenty sixty day calls, underlying at 182.40, 42% at the money volatility, two day horizon at three standard deviations.
Strike	Value	Intrinsic share	Scenario loss	Advance rate
130	1091	96%	330	65.7%
150	725	89%	313	52.5%
170	414	60%	239	36.5%
182	273	3%	178	28.2%
200	134	0%	98	19.7%
230	40	0%	31	15.4%
short	−	−	unbounded	0.0%

Reading the ladder

The advance rate falls monotonically with strike across the economically meaningful range and tracks the intrinsic share of value closely. The reading is simple: intrinsic value survives a shock, time value does not. A position that is mostly intrinsic is mostly collateral.

Hedging raises it

A long call position advancing 37.4% advances 53.8% once a protective put is added, because the worst node of the grid becomes less bad. There is no special case for hedges anywhere in the implementation.

Settlement

Claims and resolution

A cash settled option requires a terminal price nobody can dispute afterwards. The settlement layer provides it.

Typed claims

A claim names its own referee. If no adapter can resolve it, it is not a claim.

grammar

CLAIM      := SUBJECT COMPARATOR THRESHOLD TEMPORAL VIA SOURCE
COMPARATOR := >= | <= | > | < | crosses
TEMPORAL   := AT <iso8601> | ANYTIME_BEFORE <iso8601>

NVDA.close >= 182.00 AT 2026-10-16T16:00-04:00 VIA nasdaq.official

Implementation note

Comparator matching must be longest first. Matching > before >= splits >= 182 into comparator > and threshold = 182, which then fails as non-numeric. There is a test for it.

Commitments

Every field is bound into one hash. Commitments accumulate into a Merkle tree with domain separated leaf and node hashing, and only the epoch root is anchored, at constant cost per epoch rather than per claim. Epochs chain by previous root, so a deleted or reordered epoch is detectable rather than merely discouraged.

Resolution ladder

Layer	Mechanism	Share
Primary	registered adapter at the stated timestamp	~94%
Redundant	k of n independent operators agree within tolerance	~5%
Dispute	24h window, bonded challenge, committee vote	<1%
Void	source failed, halt, corporate action	rare

A void resolution is excluded from the record rather than settled arbitrarily.

Listing and adapters

Listing is not a committee decision. A symbol becomes tradable once a price adapter for it exists and has been ratified.

adapter lifecycle

propose → bond → shadow (90 days resolving in public,
                     nothing depending on it)
        → ratify → live → earn

Adapters are bonded and slashable on proven misresolution, and forkable: anyone may propose a competing adapter for the same source, operators choose between them, and the better specification wins on disagreement rate. This is closer to open source package maintenance than to governance.

Why this makes the claim real

An exchange that says it lists any stock is making a claim about adapter coverage, not about ambition. The constraint is how much of the economy someone has written an adapter for, and adapter authorship is open precisely because no core team can cover release calendars, revision policies and corporate action quirks across every asset class.

Corporate actions

The unglamorous hard part. Every price claim stores its adjustment policy at commitment time, so the rule cannot be chosen after the outcome is known. Most naive designs break here.

Reference

API: options.js

Import path site/options.js. Pure arithmetic, no imports, safe in any runtime.

Pricing

price(o): {S, K, T, r, q, sigma, kind} to a number. Returns discounted forward intrinsic for degenerate T or sigma. Throws if S or K is not positive.
greeks(o): Same arguments, returns {delta, gamma, vega, theta, rho} in desk units.
probITM(o): Risk neutral probability of finishing in the money.

Distribution

ncdf(x): Standard normal CDF, Hart and West, about 1e−15 accurate.
npdf(x): Standard normal density.

Surface and solver

surfaceVol(o): {S, K, T, atmVol, skew, curve, termSlope} to a volatility, clamped to [0.02, 4].
impliedVol(o): Newton with bisection fallback. Returns null outside no arbitrage bounds or where vega is below the identifiability threshold.
strikeForDelta(o): Inverts delta numerically. One branch serves calls and puts, since delta decreases in strike for both.
chain(o): Prices a list of strikes on the surface, returning prices, Greeks and probabilities.
strikeLadder(S, n): Round strike ladder bracketing spot, shifted up rather than truncated if it would run through zero.

API: perp.js

Import path site/perp.js. Imports options.js and nothing else.

Indices and funding

constantMaturityIndex(o): kind of 'vol', 'call' or 'straddle'. Returns {value, unit, T, K}.
fundingRate(o): {mark, index} to a rate per interval, damped and capped.
fundingPayment(o): Signed payment for a position over one interval.

Marking and risk

markPortfolio(p, m): Returns {value, legs, greeks}. Handles option, perp and spot legs.
shockGrid(o): Derives the scenario grid from {atmVol, horizonDays, sigmas}.
stressPortfolio(p, m): Full revaluation at every node. Returns the worst loss, the scenario that produced it, and every cell.
marginRequirement(p, m): Initial and maintenance from the scenario loss.
borrowingPower(p, m): Value less the haircut scenario loss, floored at zero, plus the advance rate.
accountHealth(o): Equity over maintenance margin. Below 1.0 is liquidatable.
liquidationSpot(o): Bisection for the spot at which the account becomes liquidatable, or null if it never does in that direction.

Position shapes

accepted legs

{ kind: 'call' | 'put', K, expiryDays, qty }
{ kind: 'perp', indexKind, tenorDays, qty, entry }
{ kind: 'spot', qty }

negative qty is short

Verification

101 tests. The pricing and risk components are anchored against published values and structural invariants.

Anchor case: S = K = 100, T = 1, r = 0.05, q = 0, σ = 0.20.
Quantity	Computed	Tolerance
Call	10.450583572185550	1e−10
Put	5.573526022256964	1e−10
Φ(1.96)	0.975002104851780	1e−12

Invariants

Put-call parity across four strikes, three tenors and a non-zero dividend yield.
Vega equals the central difference of price in volatility; gamma the second difference in spot.
Implied volatility round trips wherever vega exceeds the identifiability threshold, and returns nothing elsewhere.
A long option can never produce a scenario loss exceeding the premium paid.
A flat book requires zero margin; a spread requires materially less than its naked leg.
Borrowing power against any short position is exactly zero.

Defects these caught

Recorded rather than buried

The delta inverter had the put branch reversed, producing 25 delta put strikes above spot. Delta decreases in strike for calls and puts alike, so one branch was correct and writing two is what allowed the sign to flip.

The strike ladder emitted non-positive strikes for low priced underlyings and silently returned short ladders.

The scenario grid used fixed shocks, with the consequence analysed under horizon scaling.

reproduce

$ npm test                          101 passing
$ node --test 'test/options.test.js'
$ node --test 'test/perp.test.js'
$ npm run emit

Limitations

The following are unresolved. They are stated at the same length as the results because documentation that omits them is marketing.

Cross symbol correlation

Now implemented through a factor model with stressed betas, described under cross symbol margin. What remains is the estimation problem, which is the harder half. Betas are static constants rather than fitted to returns, there is a single factor per asset class so sector structure within equities is invisible, and the cross class correlation is a constant pair rather than a fitted quantity. A book concentrated in semiconductors currently receives the same diversification credit as one spread across sectors.

Liquidity, as distinct from price

Horizon scaling assumes a liquidator can exit within h days at a price near the mark. In a dislocation the wings do not trade at any price. Advance rates on thin strikes should be lower than the engine currently sets them, and no liquidity term is present.

Gap risk beyond the grid

A three standard deviation two day move is a scenario, not a bound. Overnight halts, corporate events and fraud all exceed it. The insurance fund exists for the region the grid does not cover and is finite. Nothing here claims the grid is a worst case.

Surface parameters are not fitted

Skew and curvature are constants rather than estimated from traded prices. Adequate for a testnet and inadequate for a venue carrying real risk.

Regulatory status

Offering options on securities is a licensed activity in every major jurisdiction, and a perpetual instrument referencing the volatility of a security is a derivative referencing a security. The testnet holds no customer funds, executes nothing and settles against nothing. No claim is made that a compliant path exists in any particular jurisdiction.

Every numerical value in this document is produced by the reference implementation and regenerated by npm run emit. Testnet marks are synthetic; no market data is fetched and nothing settles against a live venue.

This document is a technical specification. It is not an offer to sell securities, not an offer of options or any other derivative, not a solicitation, not investment advice and not legal advice.

Revision 1, September 2026. Return to the exchange.