CapletFi

CapletFi is the structured-product layer for DeepBook Predict: one DUSDC deposit becomes capDUSDC shares, PLP carry, a policy-capped downside hedge, settlement, and Sui/Walrus receipts. Each cycle the vault supplies Predict liquidity, buys a policy-capped downside binary, settles against the oracle, and records NAV receipts on Sui.

The hedge is priced against the live SVI surface: open_cycle reads DeepBook Predict's own ask, records it on chain every roll via HedgeFillChecked, and rejects any fill above a surface-anchored circuit-breaker ceiling (wide by default, tunable to a tight band on mainnet). Rolls are operator-executed today because the vault PredictManager is owner-gated upstream, but every roll parameter is policed on chain and all receipts are public on Sui and Walrus.

• Live app: https://capletfi.vercel.app
• Proof JSON: https://capletfi.vercel.app/api/proof
• AI-readable summary: https://capletfi.vercel.app/llms.txt
• Track: Sui Overflow 2026, DeepBook specialized track

Product Moment

CapletFi packages low-level DeepBook Predict primitives into one vault loop a treasury manager can understand and audit:

1. Deposit DUSDC and receive capDUSDC shares minted against vault NAV, a portable Sui coin.
2. The vault supplies idle buffer into the DeepBook Predict PLP leg to earn carry.
3. Each cycle the vault opens a downside binary hedge inside the onchain hedge budget.
4. open_cycle enforces, on chain, that the hedge budget is within policy, the strike is a downside strike inside the band, and the executable ask stays within a surface-anchored ceiling.
5. The vault operator signs manager-gated balance moves, while the Move policy bounds every roll parameter and the admin cap can never move funds.
6. At expiry the cycle closes, NAV trues up from DeepBook Predict events, and receipts post to Sui and Walrus.
7. Withdraw against the liquid buffer any time; settled cycles and surface-priced fills are on the Notes and Risk pages.

The product enforces the hedge budget and the surface-anchored fill, not the final outcome. CapletFi is not principal-guaranteed, not risk-free, and not fixed APY.

Treasury Use Case

An idle DUSDC treasury wants structured exposure without becoming a raw prediction-market desk. The manager sets a 10% hedge budget, CapletFi enforces that budget before mint, routes the remainder into PLP carry, and later produces a settlement receipt showing hedge spend, PLP payout, manager credit, and whether the realized result stayed within the declared budget. This is the real-world workflow: risk-budgeted carry with receipts a treasury committee can replay.

Enforced vs Disclosed

Item	Enforced on-chain	Disclosed after mint/settlement
Hedge budget	Binary budget must be <= declared risk budget.	Actual binary cost and unspent manager credit.
Hedge structure	Downside-only binary, active oracle, expiry match, strike below spot.	Oracle id, strike, expiry, and DeepBook events.
Settlement outcome	No realized-loss assert, so settlement cannot brick valid notes.	Keeper/Walrus summary compares realized total value against the declared budget.

Why DeepBook Is Load-Bearing

CapletFi cannot mint or settle without DeepBook Predict:

• predict::create_manager creates the holder-owned manager used for binary redemption.
• predict::mint buys the downside binary hedge.
• predict::supply supplies the carry leg into PLP.
• predict::redeem_permissionless redeems the hedge after oracle settlement.
• predict::withdraw returns PLP value to the note holder.
• predict_manager::withdraw lets the holder claim manager credit after settlement.
• predict::get_trade_amounts reads the protocol's SVI-derived ask and bid, so the vault (v5) checks the hedge fill against a surface-anchored ceiling in open_cycle and emits HedgeFillChecked (ask, bid, ceiling) every roll. The surface price is recorded and bounded on chain, not just measured.

Without those calls there is no hedge leg, no carry leg, no payout, and no settlement path, and without the ask gate an operator bug could route the hedge at an off-surface price.

Live Proof Snapshot

Proof	What it shows	Digest
Hedge paid	Same note structure can recover binary payout plus PLP value	Cbgrz1si8QioAXR8CPL7pmAjEmqUPiiYzoZU9FtbCn2S
Hedge expired	Same note structure still settles PLP when binary payout is zero	CFNQ4q8jqDiVzf2uTnUguphegRPBJvKQkc2yfDpFjEhU
V3 enforced budget	Mint emitted CapletRiskBudgetEnforced; later settled by a non-holder with risk-budget Walrus attestation	EWfmQzAt72ThYg2qCSC4s3HjcF3ZtLrLdYhn54HrLhmU
V3.1 surface-priced fill	At mint, the live SVI surface implied fair value 0.191160; DeepBook Predict filled the binary at ask 0.199039, a +412 bps spread over surface fair (ask >= fair). Snapshot captured at mint, so the comparison is fair. Proves the binary is vol-surface-priced, not hand-listed.	2K9FvvucvdqyL2nZfHiiExz79xVRVnT5XNw7M4rwyaoT
V5 on-chain ask gate	open_cycle reads DeepBook Predict's SVI-derived ask via get_trade_amounts, records it every roll via HedgeFillChecked (ask, bid, ceiling), and rejects any fill above a surface-anchored circuit-breaker ceiling (MAX_HEDGE_ASK_BPS = 2500 bps, a wide catastrophe bound tunable to a tight band on mainnet). The gate predicates are unit-tested, and it emits on chain every roll: e.g. tx ANpQxwFUgnmNuFe8awduRTXZFHrDUjwsLipKKum38ALu recorded ask cost 14,887 on 1,149,808 notional, about 129.47 bps, below the 2500 bps ceiling.	package 0xa5f6a189cf5e2a31a0c0b5a9ad4fbf32e728e807f91935de04ea028ae39199d1
V5 self-serve vault flow	A connected testnet wallet deposited 0.010000 DUSDC, received 0.010523 capDUSDC, then burned those exact shares to withdraw 0.009999 DUSDC through the public vault transaction builders.	deposit ATVK3kh9GmXWoz1RSnXxpzxTD1iBYgKtyZkMw4VMjR9G; withdraw 4uLETUf5QSEwD7nNGMeN7z4WJzuEA56y6mTfacUHveXF
V3.1 scenario sheet	Five-row treasury scenario grid (flat, mild down, strike touch, sharp down, up) with worst case and explicit non-guarantee assumptions	2K9FvvucvdqyL2nZfHiiExz79xVRVnT5XNw7M4rwyaoT
V2 non-holder settled	Shared CapletNote was settled by a non-holder signer and paid the recorded holder	FXYriUuFnuqkvBtiPZTkXttCAQE5xCqtgFGAaZVZdYTv

The headline receipt is the surface-priced fill (mint 2K9Fvvucvdqy...): because the SVI snapshot is captured at mint, simultaneous with the fill, the DeepBook Predict ask 0.199039 can be measured against the at-mint surface fair value 0.191160, a +412 bps spread that is the protocol margin over surface fair. That is what vol-surface-priced means in practice, and it is what a hand-listed binary venue cannot show. The V3 enforced-budget receipt remains the settlement proof: the mint capped binary budget at the declared 0.100000 DUSDC risk budget, emitted CapletRiskBudgetEnforced, then the shared note was settled by 0x06db...ddf while payout routed to holder 0xa751...9c1, with Walrus realized delta -84 bps and withinDeclaredBudget: true.

Detailed receipt ledger, package ids, and namespace notes live in docs/PROOF_SURFACE.md.

Verify

Replay the live receipt portfolio:

npm run verify:receipts

Expected markers:

• CAPLETFI_V1_1_PORTFOLIO_VALID
• CAPLETFI_V2_SETTLED_NOTE_VALID
• CAPLETFI_V3_RISK_BUDGET_VALID
• CAPLETFI_V5_ASK_GATE_VALID
• CAPLETFI_SURFACE_FILL_VALID
• CAPLETFI_SCENARIO_SHEET_VALID
• CAPLETFI_NON_HOLDER_SETTLEMENT_VALID
• CAPLETFI_DEEPBOOK_CALL_PATH_VALID

Run the full local check:

npm run verify:full

This builds the keeper, replays live receipts, validates the committed vault ledger, typechecks the web app, and builds the web app. GitHub Actions also runs Move build/tests, web checks, keeper checks, live receipt replay, vault-ledger integrity, and the V2/V3 invariant guard.

Run the full submission gauntlet:

npm run verify:submission

This adds both Move packages, the contract invariant guard, production dependency audits, live public-surface verification, and narrative safety checks to the full local check.

Judge-equivalent alias:

npm run verify:judge

This intentionally runs the same full submission gauntlet, so reviewers have one obvious command for final verification.

Narrative safety:

npm run verify:narrative

Expected marker: CAPLETFI_NARRATIVE_VALID. Bankr is optional; the deterministic guarded narrative is the live-safe path and avoids guarantee language.

Use The App

Use a Sui testnet wallet with:

1. SUI gas from https://faucet.sui.io
2. DUSDC from https://tally.so/r/Xx102L

Open the vault, deposit DUSDC, and receive capDUSDC shares minted against vault NAV, a portable Sui coin. The vault opens and closes each hedge cycle through its own PredictManager, so depositors never manage one. Withdraw against the liquid buffer any time; the keeper trues up NAV at each cycle close. Open Notes to inspect settled note receipts and Risk for the surface-priced fill proof and the crash stress illustration.

Boundaries

• CapletFi runs on Sui testnet because DeepBook Predict is testnet-only during the Sui Overflow submission window.
• DUSDC is a DeepBook Predict test asset.
• The May 30 V2 receipt proves non-holder settlement and holder-directed payout, not mainnet production readiness.
• Some historical proof events still use the original Strata module namespace so already published receipts remain verifiable. The public product is CapletFi; the note proof is V3/V3.1 and the pooled vault proof is V5.

See docs/RISK_MODEL.md, docs/SECURITY_NOTES.md, and docs/MAINNET-RUNBOOK.md for risk, security, and mainnet boundaries.

Repo Layout

caplet_contracts/   CapletFi-native Move package, note router, and pooled vault
strata_contracts/   Legacy V1.1 proof-only package kept so published receipts keep verifying
keeper/             TypeScript settlement daemon, verifier, and Walrus summary tooling
web/                Next.js vault, notes desk, receipts UI, and narrative API route
docs/               Current risk/proof docs plus archived build and deployment notes

Sources

• DeepBook Predict docs: https://docs.sui.io/onchain-finance/deepbook-predict/
• DeepBook Predict announcement: https://blog.sui.io/introducing-deepbook-predict/
• DeepBookV3 repo: https://github.com/MystenLabs/deepbookv3
• Sui Overflow 2026: https://overflow.sui.io/

License

MIT.