Security and trust

What cannot change after launch

Feeds, strike ticks, volatility floors, the pricing model, the fee, the burn pool rules and every time window are compiled constants. The only launch-time setting is Config (the TAPER mint and its pool), which only the program's upgrade authority can set, once.

Covered only

buy_call checks that calls sold across all five strikes plus the new quantity stay within cover, every share in the vault when the day was listed. Deposits and withdrawals are refused while a day is live, so cover cannot shrink under sold calls.

The settlement price

Settling "at the latest price at 4 pm" from a feed that updates on deviation lands minutes away from the close and can be seen in advance. TAPER does not do that. settle_day takes the xStock's Raydium pool mean price over the 15 minutes before the bell, from the pool's own on-chain history: moving it 1% means holding a multi-million pool 1% off its price for 15 minutes against arbitrage. The thin AAPLx pool is the weak spot and its vault starts small.

Every list, buy and settle passes the market's pool and its observation ring; the program reads the price itself and refuses any other account.

If no such update is posted, nobody can settle with a different one. After an hour void_day refunds every buyer what they paid, premium and fee.

Prices for sales

A sale is priced at the higher of the pool's price now and its 10-minute mean, so dipping the pool right before a buy cannot cheapen the call. Sales stop ten minutes before the close, when a call is almost all intrinsic value and a buyer holding a slightly older signed price could pick the vault off.

Vault shares

Share prices come from total_assets, the vault's own accounting, never from its token balance. Tokens sent to the vault directly do not change what a share is worth.

The burn crank

Anyone can call burn. One call spends at most 1,000 USDC and at most 0.1% of the pool's USDC side, and must get back at least 98% of what the pool's own 30-minute TWAP promises. The 98% leaves room for an honest crank (the pool fee, price impact and TWAP noise cost about 0.95% on a 1,000 USDC call), while moving the pool 2% to sandwich it costs more in pool fees than the crank can give up.

What holders carry

A covered call gives away the rise above the strike. On a day the stock jumps past a strike, holders deliver part of their shares to buyers and keep the premium. They never owe more shares than they deposited.

Status

The program is tested on a local validator with mainnet clones of the xStock mints, the three Raydium pools and their observation rings. It has not had an external audit. It is deployed on Solana mainnet as GvkhWyGwq6CBNV3aEt18voh3bj4dah8uQFHWqA7b3AM2; the upgrade authority is held by the operator, with a multisig planned.