Governance
Governance changes how Skew grows — fees, listings, incentives, treasury. It can never change the math that protects your funds.
A governance mistake can misallocate the treasury or mis-tier an asset — it can never create bad debt or unfund a claim. Aave and Maker let governance change the risk math; Skew puts that math beyond the vote.
- Future fee policy (new versions)
- Asset-tier metadata
- Listing bonds & incentives
- Treasury spend & grants
- Integrations & launch sequencing
- Risk-cap defaults
- Halt a market → close-only
- Disable a reference source (fail-closed)
- Tighten caps / OI
- Staged-rollout limits
- Security reserves
- Future factory admission
- Settlement & WCL math
- Clamp-then-snap rounding
- Receipt finality
- Backed-profit rule
- Existing fee-policy interpretation
- Custody invariants & withdrawal path
Anyone bonds a proposal — fees, listings, incentives, treasury.
Touches settlement / WCL / rounding / receipts / custody? Auto-rejected — never reaches a vote.
hard wallConditional markets price each outcome (MetaDAO-style futarchy).
Time-weighted pass-market price decides; resists last-minute manipulation.
Delay + a user-exit window before an Expand action takes effect.
The program applies it — to growth surfaces only, never the kernel.
Growth proposals only. The kernel boundary is enforced on-chain by the program — a proposal that would touch a math-locked surface cannot be formed, let alone pass.
Separation of Powers
Power to make the protocol safer is fast and broad. Power to expand risk is slow, timelocked, and always preceded by a user-exit window.
- Halt a market → close-only
- Disable a reference source (fail-closed)
- Tighten caps & open-interest limits
- Staged-rollout limits
- Enable a new reference source
- Raise caps & open-interest limits
- Admit a new permissionless factory
- Loosen staged-rollout limits
A fee policy is content-addressed (fee_policy_hash). A change creates a new version for future formation only — existing positions, contracts and receipts keep their original hash forever. Governance can approve a new version; it can never rewrite a live one, and fees are segregated from payoff conservation (Σ payoffs = 0, fee pool ≥ 0).
Segregated from escrow — fees enter the pool only after they are no longer user liabilities; the treasury can be misallocated by a bad vote, but it can never reach a funded claim.
Constitution - Immutable Parameters
Governance cannot override- Settlement mathImmutable
How a contract pays out at settlement is fixed in code — no vote changes a payoff.
- WCL mathImmutable
The worst-case-loss / escrow computation — the solvency inequality — is immutable.
- Clamp-then-snap roundingImmutable
Reference clamping + lattice rounding is fixed: loss ceil, winner credit floor.
- Receipt finalityImmutable
A settlement receipt is final and deterministically replayable; never re-opened.
- Backed-profit ruleImmutable
Only realized, fund-backed profit is ever withdrawable.
- Existing fee-policy interpretationImmutable
A live position keeps its original fee_policy_hash forever; a fee change is future-only.
- Custody-accounting invariantsImmutable
Integer conservation holds every transition: funded claims ≤ funded sources.
- Immutable withdrawal pathImmutable
Withdrawals can never be paused, frozen, or vetoed by governance.
Honest scope
What you give up for solvencySkew is solvent by construction: each side escrows at least its worst-case loss, payoffs sum to zero, and the realized reference is clamped into the declared collar before payoff — so the vault is provably non-negative for any payoff, any asset, any volatility. That guarantee has an honest price, stated plainly:
Every position prepays its full worst-case loss up front (the WCC path). There are no margin calls and no liquidation engine — the cost is capital efficiency, paid honestly instead of risked.
Each instrument declares a finite settlement range. A real move past the collar settles at the collar — disclosed up front, never hidden. Truly unbounded payoffs are excluded by design, not mispriced.
Payoffs too high-dimensional to soundly collateralize are rejected at registration, not silently admitted. If it cannot be proven bounded, it does not list.
Pricing is oracleless and derived entirely on-chain (batch-clearing tick / spot-pool TWAP behind a nine-guard firewall). A stale, bad, or manipulated reference can at most redistribute funds already escrowed between the two counterparties — it can never mint withdrawable profit or reach protocol funds. The reference is not a solvency primitive.
Spot-Source Allow-List
Oracleless markets reference on-chain spot TWAPs from protocol-admitted venues.
- EnabledOrcaConcentrated-liquidity TWAP
- EnabledRaydiumAMM + CLOB hybrid TWAP
- EnabledMeteoraDynamic-vault TWAP
Trust Tiers
A market's tier governs cross-margin eligibility and risk params. Promotion never requires a discretionary vote.
| Tier | Cross-margin | Risk params | Markets |
|---|---|---|---|
T0Provisional | Isolated only | Tightest OI cap - low leverage | 1 |
T1Established | Isolated only | Raised OI cap - moderate leverage | 6 |
T2Trusted | Cross-eligible (same tier) | High OI cap - high leverage | 4 |
T3Blue-chip | Full cross-margin | Max OI cap - max leverage | 3 |
Promotion granted automatically when measurable on-chain thresholds (depth, age, uptime) are met. No vote, no discretion.
No vote requiredSeveral independent stake-weighted verifiers must independently agree. Disagreement blocks promotion - it cannot force one through.
Stake-weighted quorumBounded Residual Risks
Explicitly bounded- Genesis trust
Initial tier assignments expire into objective merit; nothing stays trusted by fiat.
- Upgrade authority
Restrict-only fast path; every expansion is timelocked with a user-exit window.
- External price-source integrity
Multi-venue TWAP, confidence bands, fail-closed disabling on divergence.
- Sustained participation
Lazy keeper-free settlement - solvency does not depend on a liveness committee.
- Host-chain liveness
Forced-inclusion orders are censorship-resistant; state resumes on chain recovery.
Collateral flow
WCL/WCC audit trailTrack how worst-case collateral moves from reservation to escrow, release, and settlement.