Punch: Outcome-Weighted Perpetual Markets with Isolated Counterparty Classes

1.1 Counterparty capital is the scarce input

A perpetual market can attract directional demand before it attracts sufficient counterparty capital. Conventional pooled-liquidity systems solve the problem by asking LPs to warehouse trader PnL and market risk. This can work for mature assets, but it creates a cold-start loop for a new venue: liquidity waits for volume, volume waits for open interest, and open interest waits for liquidity.

Emerging onchain assets make the loop harder. Their spot liquidity may be thin, their price history short, and their venue topology unstable. A single undifferentiated pool must either reject those markets or force conservative LPs to share a balance sheet with them.

1.2 Incentives usually reward activity, not economic contribution

Flat volume mining pays the same unit reward to a trade that adds counterparty cash and a trade that removes it. That symmetry is convenient but economically incomplete. In a counterparty system, realized losses, realized profits, and liquidations have different effects on available settlement capital. A useful reward schedule may therefore weight outcomes differently—but only if the maximum reward value remains below the guaranteed cost of manufacturing the rewarded outcome.

1.3 One interface need not imply one balance sheet

Punch addresses these constraints by splitting the product at the settlement boundary. A common position engine supplies consistent arithmetic and order semantics. Each counterparty class supplies a distinct promise about who bears risk, when profit is paid, how new exposure is bounded, and whether LP shares exist. The design target is not maximum composability. It is legible heterogeneity without financial contagion.

2.1 Position state

A position i is identified by account, market, counterparty class, and direction. Let:

• M_i be escrowed margin;
• N_i be notional size;
• ℓ_i = N_i/M_i be leverage;
• s_i ∈ {−1,+1} denote short or long;
• p_0,i and p_t,i be entry and settlement prices; and
• F_i be position-level fees paid from the position’s own economic domain.

The position rule computes the magnitude using the GMX-derived delta identity, with direction determining whether the delta is profit or loss:

Executions use a trader-adverse price bound. Given p⁻ ≤ p ≤ p⁺, a long opens at the upper leg and closes at the lower leg; a short does the reverse. This makes spread and oracle uncertainty part of the position’s execution economics rather than an unpriced externality.

2.2 Capped lifetime profit

Let ḡ_i be the snapshotted collateral-relative profit cap and b^rem_i the position’s remaining lifetime profit budget. Gross realizable profit is:

A profitable partial decrease consumes the corresponding budget permanently. The same collateral base cannot be reused across repeated partial closes. Unused capacity is released only when the position fully closes.

2.3 Margin precedes profit

Margin custody is segregated from counterparty capital. Following a realized loss L_i and fees, the surviving margin amount is:

On a full close, R^M_i is returned before any profit-settlement path executes. Counterparty illiquidity can delay class-specific profit; it cannot silently convert surviving trader margin into counterparty capital.

2.4 Total-liquidation boundary

Liquidation is a total position exit, not a partial deleveraging rule. Let m^mark_i,t be collateral remaining after adverse marked PnL and position-level fees, f^liq_i the liquidation fee, and ℓ̄_i the position's snapshotted maximum leverage. With leverage at zero collateral defined as infinite, liquidation is admissible when:

Once liquidated, the entire remaining collateral is removed from the position. The keeper receives no more than the available amount; the residual is class-local counterparty inflow. No liquidation value is borrowed from another class:

Liquidation remains callable while new exposure is paused. This preserves a risk-reducing path through risk-off states; it does not guarantee keeper participation, oracle liveness, or profitable execution.

2.5 Economic assumptions

The model is deliberately non-stationary and conditional. It does not infer safety from average trader behavior, assume a uniquely true oracle price, or infer product safety from a mathematical identity. The following assumptions delimit what the equations can and cannot establish.

A class is an economic domain, not a UI mode. It owns or references a unique settlement module, margin-custody domain, counterparty pool, risk policy, market set, fee waterfall, and optional emissions budget. The shared engine includes the class identifier in position identity and routes settlement to that class only.

3.1 State isolation

Define the economically relevant state of class c at time t as:

where E is escrowed margin, C is counterparty cash, Q is senior profit debt, J is junior fee liability, OI is open interest, and B is the class reward budget state. For any settlement transition T_c in class c, the required isolation property is:

3.2 Lifecycle asymmetry

The Core Pool is permanent: it may move between active and opens-paused states but cannot be converted into an LP class. Modular KLP classes pass through proposal, staging, activation, close-only, and retirement states. New exposure can be stopped quickly; resuming exposure requires delayed governance. Reductions, liquidations, and eligible exits remain routable through risk-off states.

4.1 Endogenous capital and cold start

Core Pool has no LP shares and no public deposit function. Initial cash may be zero or may include separately accounted donated seed capital. Thereafter, realized trader losses, liquidation residuals, and eligible retained inflows can add cash; delivered trader profits remove it. A donation is not reclassified as realized trader loss and therefore does not enlarge any loss-indexed incentive basis.

Here L_t is realized loss inflow, I_t is eligible retained inflow, and W_t is total delivered profit in the period—current-period wins paid immediately plus any repayment of older FIFO debt. Write W_t = W^cur_t + R^Q_t, where W^cur_t is profit delivered against current-period gross and R^Q_t is senior-queue repayment. Rewards do not appear in Equation 10 because they are issued from an independent, capped token budget; they are not paid from settlement cash.

The rational trader proposition is a choice among explicit frontiers. Core Pool can support qualified markets that an LP constituency is unwilling to underwrite and can offer its own leverage, fee, and outcome-weighted reward schedule. In exchange, profit may become an uncollateralized senior FIFO claim of uncertain duration. A trader who places a high cost on delay should prefer an adequately capitalized immediate-settlement class when one is available.

4.2 Senior FIFO profit claims

If no older profit debt exists, available cash pays as much net profit as possible. Any remainder becomes an immutable senior claim. If older debt exists, a new profit claim joins behind it rather than jumping the queue because cash happened to arrive in the same transaction. Claim order is first-in, first-out; repayment may be partial; administrators cannot reorder principal.

H_t is the profit-impact haircut. Equation 11 uses current-period delivered profit W^cur_t so queue repayment R^Q_t is not subtracted twice; Equation 10 uses total delivered W_t = W^cur_t + R^Q_t so FIFO repayments still reduce pool cash. Junior fee routing is subordinate to outstanding FIFO debt. The public interface must present pool cash, queued debt, net equity, and claim age separately; “pool balance” alone is not an adequate solvency disclosure. Queue-age percentiles and realized repayment throughput over stated windows provide an additional disclosure surface without promising a settlement date.

NE_t may be negative by design. A queued profit is a disclosed settlement mode, not an assertion that the claim is presently cash-covered.

4.3 Capital available for new risk

Cash already owed to senior profit claims or recorded as junior revenue cannot be recycled into new risk capacity:

Open-interest limits operate in an absolute cold-start regime and a capital-relative regime. In both, the system separately reserves every position’s remaining maximum profit:

This bound complements gross OI, net OI, aggregate directional exposure, per-position collateral, and leverage limits. It prevents many small accounts or repeated partial wins from manufacturing an unrecorded promise.

4.4 Directional inventory without a funding transfer

Core Pool does not use a recurring funding or borrow transfer. Each side pays the class-local position fee snapshotted when exposure is admitted. Directional imbalance is therefore rationed through capacity rather than dynamically subsidized through a funding rate.

Net, gross, aggregate directional, and reserved-profit ceilings are complements. A fee can price access, but it cannot substitute for a hard bound on the loss Core Pool could owe along a one-sided path.

4.5 Profit claims survive delivery failure

Settlement state distinguishes an unpaid FIFO claim from cash already removed from the pool and irrevocably funded for its current claim owner. A rejected direct transfer therefore changes the delivery path, not the economic owner or the amount owed. Transferable claim ownership, funded fallback escrow, and unallocated pool cash remain separate accounting objects.

This distinction is economically material. Receiver-specific token restrictions should not force a valid position close to revert, allow junior claims to advance, or make a funded obligation appear available for new risk. Public solvency views must therefore reconcile direct payment, funded claim escrow, and still-unfunded FIFO principal separately.

Because ownership may be transferable, a third party could independently price a claim below face value as a signal of perceived delay and solvency risk. Punch neither operates nor endorses such a secondary market, and an external price would not alter claim principal, FIFO rank, or the protocol's repayment obligation.

4.6 Queue pressure is not a single-number oracle

Queue depth and total promised-profit utilization answer different questions. Debt relative to cash measures current settlement pressure; reserved and queued liability relative to its live ceiling measures remaining admission capacity. The design enters hard risk-off only when both dimensions are stressed. That condition is evaluated synchronously on a proposed increase rather than depending on an external actor to update a pause flag first.

Recovery uses lower, separately reviewed thresholds. A class can recover through cash and repayment improvement or through release of reserved liability, while decreases, liquidations, exact margin return, and queue service remain available throughout. Numerical thresholds are policy parameters and remain outside this paper.

5.1 One module, independent class instances

A KLP class is a share-based stable-asset vault integrated with the same settlement interface as the Core Pool. Reuse occurs at the mechanism level, not the balance-sheet level. Each class has its own vault, margin escrow, risk manager, market set, fee routing, NAV reporters, and lifecycle.

The named classes are dKLP for qualified emerging-asset markets and KLP for major-asset markets. Neither is required for the Core Pool to operate. Each admits exposure only when its own capital, priceability, governance, and demand conditions are sufficient.

5.2 Epoch NAV and share integrity

Let C_e be vault cash at epoch e, J_e encumbered junior fees,Π^open_e quorum-reported net open trader PnL, and N^KLP_e share supply. A simplified checkpointed share value is:

Positive trader PnL reduces vault NAV; negative trader PnL increases it. q_e may be negative when open trader profit exceeds unencumbered cash; insolvent NAV closes priced share actions until a fresh quorum checkpoint restores a non-negative mark. Deposits and asynchronous redemptions use a fixed epoch checkpoint. If a realized position outcome makes the prior checkpoint stale, priced share actions likewise close until cash and open PnL are reconciled. This avoids minting into known losses or redeeming against a pre-settlement mark.

5.3 Immediate-settlement invariant

KLP classes have no payout queue. A winning position must be payable immediately; therefore the promise is enforced at admission, not improvised at close. If A_t is liability-backing vault capital and ρ_c the class payout ratio, then:

Admission also applies class-wide and market-level gross OI, absolute net OI, collateral, leverage, and reserved-profit limits. In this reduced-form notation, ρ_cA_t corresponds to the class's live reserved-profit ceiling, while market and aggregate ceilings can bind more tightly. LP withdrawal requests are asynchronous and remain junior to valid trader-profit reserves.

5.4 Why modularity matters economically

The architecture allows different risk-bearing constituencies to self-select. A conservative major-asset LP need not underwrite young-asset PnL. A dKLP LP can price elevated volatility and market-quality risk without importing that risk into KLP. The Core Pool remains available to traders who accept deferred-profit risk in exchange for a different leverage and reward frontier.

5.5 Share actions require current, reconciled NAV

NAV reporting uses a governance-appointed, permissioned reporter set and a configured threshold. Reporter votes bind a specific vault, epoch, reporter generation, snapshot block, and open-PnL value. A membership or threshold change advances the generation and invalidates unfinished votes from the prior configuration. Disagreement or non-quorum closes priced share actions; it does not grant one reporter authority to reprice the vault.

A position mutation cannot be priced through a snapshot that predates it, and a realized outcome closes deposits and matured withdrawals until cash and open PnL are checkpointed again.

Direct asset transfers are reconciled before any priced share action. At genesis, unowned assets receive matching permanently locked shares so the first depositor cannot appropriate them. After genesis, a donation belongs proportionally to the existing share base; an unexplained deficit closes share actions. These rules distinguish an economic contribution from an accounting surprise.

5.6 LP exit is asynchronous and trader-senior

An exit request escrows its shares and fixes its receiver before a bounded, utilization-sensitive cooldown. Final payment uses the latest finalized epoch and cannot consume accrued protocol fees or capital reserved for maximum trader profit. The delay is an LP liquidity-control mechanism, not a trader payout queue: KLP trader profits remain synchronous.

Retirement is correspondingly redundant. Registry position count, margin custody, risk exposure and profit reservation, and a final quorum-checkpointed cash/NAV state must all agree that the class is empty. No single stale ledger can authorize an irreversible retirement.

6.1 PUNCH supply is capped; release is earned

PUNCH is the protocol's finite incentive and coordination asset. Its supply has a hard cap of one billion PUNCH and no inflation beyond that ceiling. The supply map separates protocol-user incentives, locked and vesting contributors, the public PUNCH20 voucher reserve, and ecosystem formation:

The 725M user allocation is a stock, not a promise to emit. Punch converts that finite inventory into bounded flows: immutable aggregate ceilings, class lifetime budgets, class-wide epoch release caps, address-level friction, and a single terminal reward record per position. Unused capacity remains unreleased. Exhaustion clamps an incentive without changing margin return, PnL, or the counterparty's settlement obligation.

6.2 PUNCH20 is a bounded redemption mechanism

Each redemption burns 20 PUNCH20 for one PUNCH against the dedicated 50M PUNCH reserve. For voucher balance V_20,u, the redeemable amount is:

Redeemed PUNCH may be deposited into sPUNCH and locked before a later position opens. Its duration-weighted value can then enter that position's bounded boost calculation. PUNCH obtained, staked, or locked after the position opens cannot alter its snapshotted multiplier.

The same sPUNCH shares represent a pro-rata claim on PUNCH held by the staking vault. Fee-funded donations add backing without minting competing shares, so any resulting change in backing is allocated pro rata across the existing share base. Redemption does not guarantee a boost, donation, fee flow, token value, liquidity, or return.

6.3 Lose-to-earn reward object

Punch treats PUNCH as a capped incentive rail, not settlement capital and not loss insurance. Only a terminal full close or liquidation creates a reward-bearing outcome. Partial decreases realize ordinary PnL and fees but do not reuse the reward basis.

For terminal outcome y ∈ {win, loss, liquidation}, define:

• A_i: the class-configured eligible economic basis;
• w_c,y: outcome weight;
• μ_c,m,e: optional market multiplier;
• β_i: position-open lock boost, snapshotted for the life of the position; and
• r_c(I_c): class rate as a function of monotonic class inflow.

Actual accrual is the raw amount bounded by the remaining per-address, class-epoch, class-lifetime, and global budgets:

Budget exhaustion clamps rewards; it cannot revert position settlement. Economic changes are announced for the next epoch rather than repricing activity mid-epoch. Each class owns an isolated sub-budget under one immutable global ceiling.

6.4 The anti-manufacture condition

Let P̄ be the conservative PUNCH price used for validation, r̄ the maximum possible curve rate,w̄ the largest outcome weight,μ̄ the largest market multiplier,β̄ the hard boost ceiling equal to max_c β̄_c across class-level ceilings, and κ the guaranteed round-trip cost per reward-basis dollar. Every configuration must satisfy:

The condition does not claim to solve Sybil identity. Address caps add friction; the class-wide epoch cap is the aggregate release backstop when activity is distributed across addresses. These limits bound issuance; they do not infer identity or prevent coordinated activity.

6.5 Why lose-to-earn may weight losses more heavily

In the Core Pool, a realized trader loss increases counterparty cash while a realized profit consumes it. Outcome weighting recognizes that asymmetric capital effect. Lose-to-earn therefore means that an eligible terminal loss may receive a larger PUNCH weight than a win—not that the loss is reimbursed. The trader's economic loss remains real. Rationally manufactured loss remains negative under Equation 23; organic losing activity receives a larger share of a precommitted, finite incentive budget.

6.6 Bounded PUNCH and sPUNCH feedback

The reward and staking rails create an intertemporal feedback loop, not a settlement loop. Once claims are separately activated and inventory covers every token still issuable under the larger applicable committed budget, a trader may claim PUNCH plainly or optionally claim-and-lock it through sPUNCH. The lock adapter must move the exact claim into the vault, mint proportional shares, and lock exactly those shares atomically; a failed lock restores the claim ledger. Locked value can affect only the boost snapshotted for a later position.

Each counterparty class has a source-bound fee waterfall. After the source has honored senior obligations, the junior amount is partitioned among its backstop, the shared sPUNCH buyback rail, operations, and pool retention. Integer remainder stays with the source pool. The shared rail may accumulate settlement assets while FIFO debt exists, but it cannot spend them until that debt is zero. Purchased PUNCH is split between a bounded burn destination and an exact vault donation; the donation mints no shares.

PUNCH, sPUNCH, reward inventory, and buyback assets are not margin or counterparty capital. A failed reward callback, exhausted budget, disabled claim path, or unavailable buyback must not block position settlement. The size and runway of this feedback are bounded policy variables. Equations 48–56 formalize its custody, timing, stock-flow, and resource-cost relationships.

6.7 Aggregate release rate and terminal uniqueness

Address caps are not identities. The economically meaningful rate limit is therefore class-wide: every reward-bearing record in an epoch consumes the same aggregate class release budget, as well as the remaining class lifetime and global ceilings. Splitting activity across addresses cannot expand that envelope.

The reward object is also terminal rather than transaction-count based. A partial decrease may realize PnL and fees, but it creates no reward record. The surviving position can produce at most one later full-close or liquidation record. Equations 44–45 formalize these two mechanism claims without publishing any operating budget.

7.1 Listing is a qualification predicate

A market is not admitted merely because a token is popular or a venue is familiar. The engine market is permanently bound to one asset identity. A class may open new exposure only while identity, price-source health, assigned trust tier, live asset facts, and class risk capacity all agree:

I denotes immutable identity binding, O oracle health, τ the live asset trust assessment, T_c the tiers accepted by a class, and K available class risk capacity. Oracle health is multidimensional: applicable predicates include freshness, publisher and schema validity, confidence or spread, TWAP observation coverage, spot–TWAP divergence, active in-range depth, liquidity permanence, and range coverage. A market fails closed when a required dimension is unavailable or outside its configured bound.

7.2 Two price-source families

7.3 Trust tiers are per asset

Venue trust is a ceiling, not a blanket endorsement. Major signed-feed assets occupy a distinct tier. Emerging assets earn stronger tiers only when their own live facts justify them. dKLP admission requires persistent active in-range depth, sufficient observation history, wide-range or otherwise durable locked liquidity, bounded divergence, and healthy source routing—not token origin or a venue label alone. LP classes accept only their configured stronger tiers; probationary assets may be restricted to Core Pool, where no LP principal exists to drain and exposure is still bounded.

Promotion requires delayed governance and fresh qualification. A persistent deterioration in depth, lock status, range coverage, or source health may only reduce trust permissionlessly; it cannot promote. Lost qualification stops new exposure while existing decreases and liquidations remain available under the class’s conservative price path.

Assets with protocol-verifiable liquidity permanence can produce stronger admission evidence than otherwise similar assets whose liquidity may disappear without notice, but this is an evidentiary advantage rather than automatic trust. The same published predicates apply to external venues. See the dKLP admission architecture note for the product-level mapping.

7.4 Signed confidence bounds and provider pinning

A reviewed signed-data market may select Chainlink Data Streams or paid Pyth Pro reports behind one market router. The provider is pinned per market. A failure does not invite an automatic change in trust semantics, and a migration must target an independently healthy source.

For Pyth Pro, a verified median and confidence amount define a lower and upper execution bound. The action-specific engine selects the conservative side of that interval, and execution requires a report accepted in the current block. Confidence is an uncertainty input, not a guarantee that a latent “true” price lies inside the band. Equations 46–47 state only the enforceable interval and routing claims.

8.1 Fast risk reduction, slow risk expansion

A guardian may pause new class or market exposure when public health conditions fail. Resuming exposure, promoting an asset, relaxing risk, changing economic curves, or activating a new class requires delayed governance. This asymmetry makes emergency action conservative by construction.

8.2 Existing positions retain admitted terms

Leverage, profit caps, per-side position fees, and reward boosts are snapshotted when exposure is admitted. A later governance change applies to new exposure rather than retroactively making an existing position liquidatable or repricing a completed decision. Stale-term positions may reduce risk or add margin, but must close and re-enter before increasing size.

The rule is symmetric: governance cannot worsen an admitted trader's terms, and the trader cannot retroactively import a later, more favorable fee, leverage, profit-cap, or boost configuration into existing exposure.

8.3 Risk containment matrix

These controls reduce specific failure modes; they do not eliminate smart-contract, oracle, governance, token, bridge, chain, keeper, or economic risk. Bounded actions and isolated custody limit exposure; they do not make failure impossible.

9.1 Class choice creates a transparent settlement frontier

Let trader utility from class c be:

Traders with a high cost of settlement delay δ_i should prefer an adequately capitalized KLP class, all else equal. Traders who accept deferred-profit risk may prefer the Core Pool’s leverage, market access, fee, or reward frontier. The class picker makes this tradeoff explicit rather than hiding it inside a blended pool.

9.2 LP pricing improves when risk domains are narrower

Let the required expected fee return for an LP class be an increasing function of trader-PnL variance, oracle uncertainty, liquidity mismatch, and governance risk:

Separating major and emerging-asset classes narrows the risk distribution an LP must price. This does not guarantee lower required returns, but it prevents unrelated risk from being imposed through balance-sheet aggregation.

Pairwise correlation estimates are not treated as solvency permissions. They may inform stress analysis or a coherent risk measure within a class, but deterministic gross, net, aggregate, and reserved-liability ceilings remain binding when correlations are unstable or tail dependence dominates.

9.3 Incentive expense is bounded independently of settlement

For classes c = 1…n, epochs e, and immutable global budget B̄_global (the same global ceiling used in Equations 22 and 44):

A domain budget is itself subordinate to the finite protocol-user allocation. For authorized incentive domains h, aggregate hard budgets cannot create a claim on more PUNCH than that allocation:

Because settlement does not depend on successful reward accrual, an exhausted or unavailable incentive budget reduces issuance rather than creating a counterparty default.

9.4 Endogenous capital is path-dependent

The Core Pool’s long-run cash drift depends on the realized distribution of losses, delivered wins, and retained inflow:

Positive expected drift is not guaranteed. The mechanism changes how capital can form; it does not assume traders lose at a fixed rate. Profit caps, liability reservations, open interest limits, and transparent FIFO debt are necessary precisely because realized paths can be hostile.

9.5 FIFO debt is a reflected queue

Let Y_t be newly queued net profit and R^Q_t delivered repayment during interval t. Away from the zero boundary, the conditional expected queue drift is:

This is a Lindley-style reflected process: debt cannot become negative, and a favorable long-run mean does not erase clustered winning paths. If repayment arrives at a stable effective rate λ_Q, a deliberately rough fluid approximation for a claim with principal ahead q is:

9.6 The reward-safety feasibility surface

Rearranging Equation 23 gives a public upper surface for the curve rate. It is not a parameter recommendation; it shows the direction in which every reward control moves the anti-manufacture margin:

9.7 Class isolation trades diversification for containment

If two class PnL processes were pooled, their one-period variance would include a covariance term:

When correlation is reliably low or negative, mutualization can reduce the capital required for a target aggregate risk level. Punch does not claim otherwise. It chooses class isolation because young-asset tail dependence, oracle failure, governance scope, and liquidity regimes are difficult to estimate and can become correlated precisely during stress. The economic purchase is containment, auditable attribution, and participant choice—not free diversification.

9.8 Token feedback is cohort-delayed and budget-bounded

Let V^L_i,open be the conservative locked value observed when position i opens, and K_i,open the class-configured value required for a full boost. The snapshotted boost can be represented as:

Let ΔE^boost be the incremental token accrual permitted by positive snapshotted boosts during a budget interval. Remaining class and global budgets bound that increment:

9.9 LP exit headroom is residual, not nominal cash

Let R_t be the KLP class's remaining reserved trader-profit liability. The capital available to an LP exit excludes both that senior reserve and accrued junior fees:

For a matured request holding x escrowed shares at finalized epoch value q_e, payment and cooldown obey:

9.10 Unsolicited assets do not belong to the next depositor

Let D be a positive unowned asset transfer and q₀ the genesis accounting unit. If no beneficial shares exist, the vault assigns matching permanently locked shares before accepting a priced deposit:

Once beneficial shares exist, reconciliation incorporates a donation into NAV before computing the next depositor's share issue. The donation then accrues to the prior share base rather than creating a known stale-price transfer.

9.11 Queue recovery is two-dimensional

For positive pool cash, define queue pressure and total liability utilization as:

A zero-cash state with positive debt is treated as maximal queue pressure. Symbolic hard-pause and recovery predicates are:

9.12 Profit ownership is conserved across delivery states

For a realized net-profit claim V^claim, let p^direct be cumulative direct payment, e^funded funded owner escrow, and q^fifo still-unfunded FIFO principal. At every transition:

9.13 Aggregate release limits dominate address splitting

Let 𝓘_c,e be the set of terminal reward records admitted for class c in epoch e. Let Ē_c,e be the class-wide epoch release cap and B^used cumulative issuance before that epoch. The epoch's total accrual obeys:

9.14 Position fragmentation cannot multiply reward records

Index every size decrease of position i by s. A nonterminal decrease has zero reward accrual, while the position lifecycle admits at most one terminal reward record:

9.15 Signed-oracle uncertainty is explicit and source-local

For a verified signed report, let p̃_m,t be the reported median and c_m,t > 0 its accepted confidence amount. The action-conservative selector a(x) ∈ {−1,+1} uses:

Let s(m) denote the single signed provider pinned to market m, and O^k_m,t the health predicate reported by source k. Routing and migration obey:

PUNCH economics are a sequence of bounded stocks and exact flows: finite supply, terminal incentive accrual, funded claims, optional staking, junior fee conversion, and later- cohort boosts. The identities below describe that public product loop without fixing operating parameter values.

10.1 The PUNCH/sPUNCH loop is a stock-flow system

The public model treats fee routing, reward inventory, claims, staking, and buybacks as separate ledgers joined by exact transitions. Let F_c,t be the gross junior fee amount presented by the source bound to class c. With basis-point shares α^B_c, α^U_c, and α^O_c whose sum is at most 10,000:

Claim activation is governed by inventory, not merely by already-accrued balances. Let B^active_t be the sum of active class budgets, B^next_t the already-published next-epoch total when one exists, C^P_t cumulative claims, and I^P_t PUNCH held by the controller:

For a claimant with exactly a_u,t accrued across all class ledgers, the controller exposes two mutually exclusive destinations:

Let A^S_t be PUNCH assets in the sPUNCH vault, N^S_t outstanding shares, D exact deposits, G authorized buyback donations, U unsolicited direct transfers, W redemptions, M minted shares, and X burned shares over an observation interval:

The vault uses one virtual asset and one virtual share. Define its real-valued accounting index q̃_t and the displayed, floor-rounded 18-decimal value q_t:

For one successful buyback, let Z be settlement assets spent, P^buy newly purchased PUNCH, P^pre PUNCH already present on the rail, P^burn the bounded burn slice, and P^don the vault donation:

Execution is permissionless but condition-bounded. Writing H^$_t for settlement-token health, H^p_t for fresh confidence-bearing spot and TWAP availability, and Δt^exec for time since the preceding execution:

A lock's boost basis depends on shares, vault backing, duration weight, and a usable PUNCH price. For active lock j of user u, let m_j be its basis-point multiplier and d_P PUNCH decimals:

Position i freezes the resulting bounded boost at admission. A later donation or claim-and-lock may change V^L for a later cohort, but cannot reprice position i. The economic feedback is therefore a lagged sequence—fees, junior rail accumulation, gated buyback, donation, later-position boost, terminal outcome, then optional claim-and-lock—not a same-position multiplier.

Accounting closure does not by itself make the loop economically productive. Let ΔB^use denote the useful product benefit attributable to the loop, net of transfers among included parties. Its net resource balance subtracts swap, operating, risk, and alternative-use costs:

1. No profitability premise. The design does not assume aggregate traders will lose. A sustained winning path can produce FIFO debt in the Core Pool and losses for a KLP.
2. No insurance claim. PUNCH rewards are capped incentives whose value may be volatile or zero. They do not reimburse losses or guarantee liquidity.
3. No Sybil solution. Per-address limits do not establish identity. Aggregate class and epoch limits bound issuance; surveillance and future identity mechanisms remain separate questions.
4. No oracle certainty. Signed data, confidence bounds, TWAPs, and conservative exits reduce specific failure modes but cannot produce a uniquely true price during fragmented or discontinuous markets.
5. No automatic demand for KLP. Modular KLP architecture does not create demand. A KLP class is economically viable only when trader demand and risk-adjusted capital supply coexist.
6. No LP redemption-time guarantee. A matured request remains limited by fresh NAV, trader-senior reserve, and available class cash. Asynchronous design controls priority; it does not manufacture liquidity.
7. No reporter-liveness premise. Quorum accounting can close share actions when checkpoint data is stale or disputed. A later valid checkpoint can recover pricing, but its arrival time is an operational variable.
8. No free-subsidy premise. Token issuance is a bounded transfer with opportunity cost and behavioral effects, not automatic social surplus or a substitute for product-market fit.
9. No automatic flywheel premise. Fee routing, buyback, burn, donation, and assets-per-share appreciation can reconcile exactly while producing no useful incremental demand. Loop closure is an accounting result; positive product value is a separate economic condition.
10. No stable-risk premise. Market, oracle, liquidity, and trader regimes can change abruptly. Risk estimates may justify tighter limits but never relax deterministic solvency ceilings.
11. No provider-liveness theorem. Explicit source pinning prevents silent fallback but does not make a failed provider available. An unhealthy signed market must stop new risk until its selected source recovers or a healthy migration completes.

Punch separates what perpetual venues usually conflate: position arithmetic, counterparty identity, settlement promise, and incentive policy. The Core Pool is an endogenous, non-depositor counterparty with explicit deferred profit risk. Modular KLPs are externally capitalized counterparties whose immediate-payout promise is bounded before exposure is accepted. Both use shared execution logic; neither shares solvency. Core Pool directional imbalance is constrained by capacity rather than a recurring funding transfer. Within each domain, realized profit remains conserved across direct payment, funded owner escrow, and outstanding principal; LP ownership changes remain subordinate to fresh valuation and admitted trader claims.

Outcome-weighted rewards add a second layer of economic design. They recognize that realized outcomes affect counterparty capital differently while remaining subordinate to a strict cost floor, terminal-only recording, class epoch and lifetime caps, and an immutable global issuance ceiling. Market admission adds a third: an asset must be demonstrably priceable for the selected class, not merely visible. Signed markets pin a reviewed provider, expose confidence as an action-conservative execution wedge, and fail closed rather than silently changing source semantics.

The PUNCH/sPUNCH loop is correspondingly explicit rather than circular by assertion. Source-bound class fees reach a shared, FIFO-junior rail; a gated buyback reconciles settlement assets to PUNCH bought, burned, and donated; donations add vault backing without minting shares; and locks can affect only later-position reward cohorts. Those are bounded stock-flow relationships. Their economic value depends on whether useful product benefits exceed execution, operation, risk, and alternative fee-use costs.

PUNCH20 is a finite fixed-ratio redemption path. Redeemed PUNCH may be deposited into sPUNCH and duration-locked before a later position is admitted; the resulting shares receive any later vault donation pro rata with the existing share base. Redemption guarantees neither a boost nor any donation, token value, liquidity, or return.

The intended result is a venue where risk is not made safe by being hidden in a larger pool. It is made legible through explicit class choice, bounded admission, isolated custody, conservative execution, and closed accounting.

1. I-01

   Margin conservation. Surviving margin is returned exactly before profit settlement.

2. I-02

   Domain isolation. No class action changes another class’s custody, cash, debt, risk, or reward ledger.

3. I-03

   FIFO priority. Core Pool profit principal cannot be administratively reordered or subordinated to junior fees.

4. I-04

   Finite profit promise. Every position has a consumable lifetime profit budget reserved at admission.

5. I-05

   KLP instant settlement. A KLP class admits no profit promise it cannot settle under its configured payout bound.

6. I-06

   Reward ceiling. Class accrual cannot exceed its epoch or lifetime budget; aggregate accrual cannot exceed the global ceiling.

7. I-07

   Terminal reward uniqueness. A position produces at most one reward-bearing terminal outcome.

8. I-08

   Non-profitable manufacture. Worst-case reward value remains below guaranteed outcome-production cost.

9. I-09

   Risk-off liveness. Open pauses do not disable valid decreases, liquidations, or margin return.

10. I-10

    Identity permanence. An engine market cannot be reinterpreted as a different asset beneath open exposure.

11. I-11

    Monotone demotion. Permissionless market-quality updates may reduce, but never increase, trust.

12. I-12

    Snapshot fairness. Later governance, price, share, or lock changes do not retroactively reprice admitted position terms.

13. I-13

    Cohort-delayed boost. A terminal outcome cannot use its own reward, claim, or lock action to increase its snapshotted multiplier.

14. I-14

    Reward independence. Reward recording, inventory, claims, staking, or buybacks cannot block or fund position settlement.

15. I-15

    Buyback seniority. The shared buyback rail cannot spend while the Core Pool reports senior FIFO debt.

16. I-16

    Profit-claim conservation. Every realized net win remains exactly paid, funded for its owner, or outstanding as FIFO principal.

17. I-17

    NAV freshness. A realized class cash mutation closes priced LP share actions until a valid current-generation checkpoint reconciles cash and open PnL.

18. I-18

    Genesis donation neutrality. Unowned assets present before the first deposit cannot become redeemable value for that depositor.

19. I-19

    Redemption seniority. A matured LP exit cannot consume accrued protocol fees or cash reserved for maximum trader profit.

20. I-20

    Retirement completeness. A class cannot retire while positions, active margin, risk exposure, reserved profit, or an unreconciled final NAV remains.

21. I-21

    Bounded recovery. Joint queue and liability stress closes increases without closing valid reductions, settlement, liquidation, or margin return.

22. I-22

    Signed-report binding. An accepted signed report matches its configured market identity and schema, satisfies publisher, confidence, and time predicates, and cannot conflict with an already accepted timestamp.

23. I-23

    Current-block signed execution. A signed execution price is usable only from a report accepted in the current block; stored history cannot extend execution freshness.

24. I-24

    Confidence-bound execution. The action-aware signed execution price is the configured conservative endpoint of the accepted median-confidence interval.

25. I-25

    Provider pinning. Each signed market resolves through one selected source, and rebinding requires a healthy replacement rather than automatic fallback.

26. I-26

    Fee-waterfall conservation. Every source-bound gross class fee equals its backstop, shared-rail, operations, and retained-pool allocations; integer remainder belongs to pool retention.

27. I-27

    Claim inventory sufficiency. Claims cannot be enabled unless controller inventory covers every token still issuable under the larger applicable active or already-published next-epoch commitment.

28. I-28

    Claim-and-lock atomicity. A lock claim either consumes every class ledger, transfers exact assets, mints and locks exact shares, and leaves no adapter custody—or reverts every delta; plain claiming remains independently available.

29. I-29

    sPUNCH asset closure. Vault assets plus cumulative withdrawals equal exact deposits, authorized donations, reconciled unsolicited transfers, and initial assets; share supply and each active lock remain fully backed.

30. I-30

    Donation non-dilution. Only the bound rail may donate through the authorized path, an empty vault rejects donation, and a successful donation increases assets without minting shares.

31. I-31

    Buyback stock-flow conservation. Settlement assets spent reconcile to the bounded execution amount; newly bought plus pre-existing rail PUNCH equals burned plus donated PUNCH; no residual PUNCH or approval remains.

32. I-32

    Boost fail-soft isolation. Active locks cannot transfer or withdraw before expiry, and unusable PUNCH price data reduces boost value to zero after its bounded grace rather than blocking margin return or profit settlement.

This paper is the public economic design for Punch on Robinhood Chain: one shared position engine with class-isolated counterparties (Core Pool, dKLP, and KLP). It does not publish operating thresholds, privileged procedures, or security-sensitive implementation detail.

A separate Flow EVM deployment with a live basket-backed KLP is outside this paper's formal model.

1. Shiller, R. J. (1993). “Measuring Asset Values for Cash Settlement in Derivative Markets: Hedonic Repeated Measures Indices and Perpetual Futures.” Journal of Finance, 48(3), 911–931. NBER t0131.
2. Kyle, A. S. (1985). “Continuous Auctions and Insider Trading.” Econometrica, 53(6), 1315–1335. doi:10.2307/1913210.
3. Lindley, D. V. (1952). “The Theory of Queues with a Single Server.” Proceedings of the Cambridge Philosophical Society, 48(2), 277–289. doi:10.1017/S0305004100027638.
4. Artzner, P., Delbaen, F., Eber, J.-M., and Heath, D. (1999). “Coherent Measures of Risk.” Mathematical Finance, 9(3), 203–228. doi:10.1111/1467-9965.00068.
5. Angeris, G., and Chitra, T. (2020). “Improved Price Oracles: Constant Function Market Makers.” arXiv:2003.10001.
6. Adams, H., Zinsmeister, N., and Robinson, D. (2020). “Uniswap v2 Core.” Protocol whitepaper. Retrieved 27 July 2026.
7. GMX. “Positions and order types: oracle prices and trader-adverse execution.” Protocol documentation. Retrieved 27 July 2026.
8. Chainlink. “Data Streams architecture.” Technical documentation. Retrieved 27 July 2026.
9. Pyth Network. “Pyth Pro: understanding price data” and “EVM consumer integration.” Price-data documentation. Retrieved 27 July 2026.
10. Punch. “Architecture” and “Risk & Disclosures.” Public documentation. Retrieved 27 July 2026.