diff --git a/appendices/glossary.md b/appendices/glossary.md index 7175abdc..d43d5b4e 100644 --- a/appendices/glossary.md +++ b/appendices/glossary.md @@ -80,15 +80,15 @@ The extra byte found while deriving a PDA that pushes the result off the ed25519 ### call -An [option](#option) giving its holder the right to buy the underlying at the [strike](#strike). Its writer's obligation is to sell, and the *Options* chapter's writer posts the underlying itself as collateral, which makes the call a [covered call](#covered-call). +An [option](#option) giving its holder the right to buy the underlying at the [strike](#strike). Its writer's obligation is to sell, and the *Options* chapter's writer supplies the underlying asset to the program as collateral, which makes the call a [covered call](#covered-call). ### cash settlement -Settling a derivative by paying the difference between the market price and the contract's price in money, with no asset changing hands. It needs a price feed, and every check the *Offchain Truth* chapter describes. Compare [physical settlement](#physical-settlement). +Settling a derivative by paying the difference between the market price and the contract's price in the quote token, USDC in this book, with the underlying never changing hands. It needs a price feed, and every check the *Offchain Truth* chapter describes. Compare [physical settlement](#physical-settlement). ### cash-secured put -A [put](#put) whose writer has posted the full strike, in the quote token, as collateral, so the writer cannot fail to pay if the holder exercises. The *Options* chapter's puts are all cash-secured. +A [put](#put) whose writer has supplied enough of the quote token, USDC here, to buy every share at the strike price, held by the program as collateral, so the writer cannot fail to pay if the holder exercises. The *Options* chapter's puts are all cash-secured. ### ceil (ceiling) @@ -135,9 +135,13 @@ An oracle's own statement of its uncertainty: a price of $250 ± $8 is a differe The party on the other side of your trade, and the one who owes you when you win. On an [order book](#order-book) the counterparty is another trader; in this book's pooled venues the program's pool is the counterparty to everyone at once, which is why the design is organized around the pool's solvency. See the *Perpetual Futures* chapter. +### covered + +See [covered call](#covered-call). + ### covered call -A [call](#call) whose writer has posted the underlying itself as collateral, so the shares the holder might buy are already in custody and the writer cannot fail to deliver them. The *Options* chapter's calls are all covered. +A [call](#call) whose writer has supplied the underlying asset to the program as collateral, so the shares the holder might buy are already in custody and the writer cannot fail to deliver them. The *Options* chapter's calls are all covered. ### CPI (cross-program invocation) @@ -429,7 +433,7 @@ An overflow in the middle of a calculation whose final answer would have fit: `p ### physical settlement -Settling a derivative by moving the asset itself: an exercised call hands the holder the underlying for the strike, and an exercised put hands the writer the underlying for the strike. No price is computed, so no oracle is read. The name predates blockchains, and nothing about it happens offchain: onchain, physical means the tokens themselves change hands. The *Options* chapter's venue settles physically. Compare [cash settlement](#cash-settlement). +Settling a derivative by moving the asset itself: an exercised call hands the holder the underlying for the strike, and an exercised put hands the writer the underlying for the strike. No price is computed, so no oracle is read. The name predates blockchains, and nothing about it happens offchain: onchain, physical means the underlying token itself changes hands, where cash settlement moves only a price difference in the quote token. The *Options* chapter's venue settles physically. Compare [cash settlement](#cash-settlement). ### PnL (profit and loss) @@ -473,7 +477,7 @@ A [put](#put) bought by someone who already holds the underlying, as insurance a ### put -An [option](#option) giving its holder the right to sell the underlying at the [strike](#strike). Its writer's obligation is to buy, and the *Options* chapter's writer posts the full strike as collateral, which makes the put a [cash-secured put](#cash-secured-put). +An [option](#option) giving its holder the right to sell the underlying at the [strike](#strike). Its writer's obligation is to buy, and the *Options* chapter's writer supplies the program with enough of the quote token to buy every share at the strike price, which makes the put a [cash-secured put](#cash-secured-put). ### quote token @@ -607,6 +611,10 @@ A signed bundle of instructions that executes atomically: all of it lands or non A time-weighted average price: the average of a market's price over a window, used instead of the instantaneous price so a manipulator must hold a distortion for the whole window rather than rent it for one slot. See the *Adversary* chapter. +### underlying + +The asset an [option](#option) or other derivative is about: what a [call](#call) buys and a [put](#put) sells at the [strike](#strike). It is short for the underlying asset, and every options market uses it as a noun on its own. In the *Options* chapter the underlying is NVDAx and the quote token is USDC. + ### utilization In a lending reserve, borrowed divided by total liquidity. The input to the interest rate curve: high utilization means the pool needs deposits, and rates rise. @@ -633,7 +641,7 @@ What a plain `+` or `*` does in a Rust release build when the result is too big ### writer -The party who sells an [option](#option): they receive the [premium](#premium) and take on the obligation to sell (a [call](#call)) or buy (a [put](#put)) at the strike if the holder exercises. In the *Options* chapter a writer posts the whole of that obligation before the lot can be sold. Compare [holder](#holder). +The party who sells an [option](#option): they receive the [premium](#premium) and take on the obligation to sell (a [call](#call)) or buy (a [put](#put)) at the strike if the holder exercises. In the *Options* chapter a writer supplies the whole of that obligation to the program before the option can be sold. Compare [holder](#holder). ### zero-copy diff --git a/building-financial-products-in-solana/figures/options-payoff.svg b/building-financial-products-in-solana/figures/options-payoff.svg index 445a63c1..102ad9aa 100644 --- a/building-financial-products-in-solana/figures/options-payoff.svg +++ b/building-financial-products-in-solana/figures/options-payoff.svg @@ -1,38 +1,56 @@ - What each side of a 180 call makes at expiry - - - - - profit, USDC - NVDAx price at expiry - - - 180 (the strike) - - - 185 (break-even) - - 160 - - 200 - - - +25 - - −25 - - +100 - - −100 - - - Bob (holder) - flat at −25: the premium is all he can lose - - - Alice (writer) - flat at +25: the premium is all she can make - - the two lines sum to zero at every price: the option moves money between them and creates none + Four ways the week can end for the 180 call + NVDAx ends the week below the strike + NVDAx ends the week above the strike + + the strike, $180 + $160 + Bob lets the call expire + Alice (writer) + keeps the 25 premium + keeps her 5 NVDAx + +25 USDC + + Bob (holder) + paid the 25 premium + buys nothing + −25 USDC + $180 + exercising would gain nothing + Alice (writer) + keeps the 25 premium + keeps her 5 NVDAx + +25 USDC + + Bob (holder) + paid the 25 premium + buys nothing + −25 USDC + $185 + Bob exercises: break-even + Alice (writer) + keeps the 25 premium + sells her 5 NVDAx for 900 + though they are worth 925 + 0 USDC + + Bob (holder) + paid the 25 premium + buys 5 NVDAx for 900 + they are worth 925 + 0 USDC + $200 + Bob exercises + Alice (writer) + keeps the 25 premium + sells her 5 NVDAx for 900 + though they are worth 1,000 + −75 USDC + + Bob (holder) + paid the 25 premium + buys 5 NVDAx for 900 + they are worth 1,000 + +75 USDC + each result is against doing nothing, Alice keeping her shares and Bob his USDC; in every column the two sum to zero diff --git a/building-financial-products-in-solana/options.md b/building-financial-products-in-solana/options.md index 17bd2a90..96a3fabc 100644 --- a/building-financial-products-in-solana/options.md +++ b/building-financial-products-in-solana/options.md @@ -6,31 +6,31 @@ Bob thinks NVIDIA will pass $180 within the week, and he wants that upside for l An **option** serves them both: Alice sells Bob the right, but not the obligation, to buy her five NVDAx at $180 any time in the next week, and Bob pays her 25 USDC for it now. If NVIDIA rallies, Bob buys the shares below the market. If it does not, he loses the 25 USDC and Alice keeps it as income on shares she still owns. -Alice's offer to sell five NVDAx for 900 USDC is an ordinary offer with two additions: it expires, and the taker pays to reserve it. The program lives at `finance/options` in the companion repository. It keeps one account per option, so that the custody stays legible and the whole lifecycle fits in three states; what that choice gives up is covered in the failure-modes section. +Alice's offer to sell five NVDAx for 900 USDC, 180 USDC a share, is an ordinary offer with two additions: it expires, and the taker pays to reserve it. The program lives at `finance/options` in the companion repository. It keeps one account per option, which simplifies the custody, and the whole lifecycle is three states: `Listed`, `Held`, and `Exercised`. The limits of this approach are covered in the failure-modes section. ## An Option Is a Right on One Side and an Obligation on the Other An option has five terms: +- Its **premium** is what the buyer pays for the right, once, up front. - Its **kind** is a **call**, the right to buy the underlying asset, or a **put**, the right to sell it. - Its **strike** is the price the trade happens at if the right is used. - Its **expiry** is the last moment the right can be used. -- Its **premium** is what the buyer pays for the right, once, up front. - Its two parties are the **writer**, who sells the right, and the **holder**, who holds it. Using the right is **exercising** the option. The two sides have different shapes, and the shapes are the whole subject: -- **The holder's** loss is capped at the premium whatever happens, and the holder's gain is open-ended. - **The writer** keeps the premium whatever happens, and in exchange takes on an obligation: to sell the underlying at the strike (a call) or to buy it at the strike (a put) whenever the holder asks. The writer's gain is capped at the premium, and the writer's obligation is not. +- **The holder's** loss is capped at the premium whatever happens, and the holder's gain is open-ended. -![The holder's line is flat at minus 25 USDC until the strike and then rises; the writer's is its mirror, flat at plus 25 and then falling. The lines sum to zero at every price.](figures/options-payoff.svg) +![Four ways the week can end, and what each side has at the end of it, against doing nothing. Below the strike the writer keeps the premium and the holder loses it. Above it the holder's gain grows with the price and the writer's loss grows with it, and in every column the two sum to zero.](figures/options-payoff.svg) Traditional options venues let a writer take on that obligation with only a fraction of it posted as **margin**, and then watch the position every day to make sure the fraction still covers it. This program does something simpler. **A writer posts the whole obligation, up front, into the vault.** -- A call writer posts the underlying itself, so the call is **covered**: the shares the holder might buy are already in custody, and the writer cannot fail to deliver them. -- A put writer posts the full strike in the quote token, so the put is **cash-secured**: the money the holder might be paid is already in custody, and the writer cannot fail to pay. +- A call writer supplies the underlying asset to the program, so the call is **covered**: the shares the holder might buy are already in custody, and the writer cannot fail to deliver them. +- A put writer supplies the program with enough of the quote token to buy every share at the strike price, so the put is **cash-secured**: the money the holder might be paid is already in custody, and the writer cannot fail to pay. -Nothing in this program is ever undercollateralized, so it has no margin, no health factor, no liquidator, and no oracle. Every one of those returns in the *Perpetual Futures* chapter, where writers are allowed to post less than they owe. +Nothing in this program is ever undercollateralized, so it has no margin, no health factor, no liquidator, and no oracle. ## Settlement Is Physical, So No Price Is Read @@ -39,9 +39,9 @@ Exercising moves tokens, and no price is computed: - When a holder exercises a call, they pay the strike into the vault and take the underlying out. - When a holder exercises a put, they deliver the underlying and take the strike. -This is **physical settlement**, and it is why the program has no oracle.[^psyoptions] The name is inherited from markets where settling meant delivering the share certificates or the barrels of oil themselves, and it does not mean anything happens offchain: physical here means the tokens themselves change hands, rather than a cash difference. Whether exercising is worth doing is the holder's decision, made against whatever the market is doing offchain, and a holder who exercises an option that is out of the money only hurts themselves. The program enforces the terms of the deal and has no opinion about the price. +This is **physical settlement**, and it is why the program has no oracle.[^psyoptions] The name is inherited from markets where settling meant delivering the share certificates or the barrels of oil themselves, and it does not mean anything happens offchain. Physical here means the underlying asset itself changes hands at the strike, where cash settlement moves only the difference between the strike and the market price, in the quote token, and the underlying stays where it was. Whether exercising is worth doing is the holder's decision, made against whatever the market is doing offchain, and a holder who exercises an option that is out of the money only hurts themselves. The program enforces the terms of the deal and has no opinion about the price. -The other design, **cash settlement**, pays the holder the difference between the market price and the strike, and that difference is a number only a price feed can supply. A cash-settled venue needs a price feed, a staleness check on it, and a defense against its manipulation. Zeta Markets took that road on Solana, with margin and an oracle.[^zeta] +The other design, **cash settlement**, pays the holder the difference between the market price and the strike in the quote token, USDC here, and that difference is a number only a price feed can supply. A cash-settled venue needs a price feed, a staleness check on it, and a defense against its manipulation. Zeta Markets took that road on Solana, with margin and an oracle.[^zeta] ## The Account Model: One Venue, Two Vaults, One Account per Option @@ -145,7 +145,7 @@ Alice calls `collect_proceeds()`. The handler requires the option to be `Exercis ![collect_proceeds() pays Alice the 900 USDC strike from the quote vault and closes the option, rent back to her; only Maria's 0.25 USDC fee is left in the vault.](figures/options-collect-proceeds.svg) -Alice sold her five NVDAx for 900 USDC and had already been paid 24.75 USDC for agreeing to. She holds 1,924.75 USDC, an effective $184.95 a share against the $200 they now trade at. The $15.05 a share she gave up is the writer's side of the payoff figure: the premium was all she could make, and she made it. +Alice sold her five NVDAx for 900 USDC and had already been paid 24.75 USDC for agreeing to. She holds 1,924.75 USDC, an effective $184.95 a share against the $200 they now trade at. The $15.05 a share she gave up is the writer's side of the four-ways figure, its last column: the premium was all she could make, and she made it. ## A Put Writer Posts Cash, and the Option Expires Unexercised @@ -197,7 +197,7 @@ Every checked operation maps to `MathOverflow`. There is no rounding rule to cho - **A held option has exactly one open exit at every instant.** Before `expiry` the holder can exercise and the writer cannot reclaim; at and after it, the reverse. There is no moment at which both can claim the same collateral and none at which neither can. - **Every exit closes the account.** Cancel, collect, and reclaim all end with `close = writer`, so an option cannot be collected twice: the account is gone. - **The admin reaches only the fees.** `collect_fees()` moves `fees_owed` and nothing else; no handler moves collateral or a strike payment to the admin under any parameters. -- **Physical settlement moves exactly the posted terms.** What the holder receives is what the writer posted, and what the writer collects is what the holder paid, to the minor unit, for every option the program would accept. +- **Physical settlement moves exactly the posted terms.** What the writer collects is what the holder paid, and what the holder receives is what the writer posted, to the minor unit, for every option the program would accept. The companion repository's `kani-proofs` crate proves the last two and the first: `proof_vault_ledger_stays_consistent_across_every_lifecycle` writes two options of either kind into shared vaults, sends each down one of its three exits, and shows the ledger consistent after every step and both vaults empty at the end. `proof_exercise_and_reclaim_windows_partition_time` is the second invariant over every pair of timestamps.