Roster Finance

Stock leverage without margin liquidation. Fully collateralized options on tokenized stocks, settled in the stock token itself. Pay once, pick your expiry, and the most you can lose is the premium.

The problem

A US stock trades 19% of the week; its token trades all of it, mostly while the exchange is shut. Every leveraged position you can open today has a price where it is taken from you, often on a Saturday wick no exchange printed. Nothing sells you a floor.

Perps on tokenized equities did $376B against $7.5B of spot last year (CoinGecko, Sep 2026). The demand is leverage. The supply is leverage that liquidates.

On the record: Decentralised.co on off-hours volume and concentrating options on one asset, The Block and Pantera on unhedgeable pre-IPO exposure, Pyth on overnight pricing that liquidates at untradeable prices, Alpaca on limit orders controlling price, not fill.

What it is

Four products on one engine, live on 14 tokenized stocks:

• Gap. Buy a call. Leveraged upside, loss capped at the premium, no liquidation price, no funding.
• Floor. Buy a put. A funded exit at a price you choose, exercisable any time before expiry, including Saturday.
• Earn. Deposit NVDAx or USDC into a vault that writes these contracts and pays premium weekly. Paid risk, not yield.
• First Print. Floor on PreStocks pre-IPO tokens, the assets with no exit until an unscheduled redemption. Mints and rights from the PreStocks API.

A holder can also sell back to the vault at its bid and take profit without paying the strike.

Why nobody can be liquidated

Nobody borrowed. The buyer prepays the premium and the writer locks the asset. Both sides have already handed over everything they can lose, so there is no maintenance margin and nothing to close early.

How it works

A series is one strike, one expiry, one side. It owns collateral, settlement and premium vaults and a Token-2022 position mint. Buyers hold position tokens, fungible within the series and freely transferable.

Quantities are six-decimal lots, a fixed raw amount of the underlying, with the strike stored per lot. xStocks never change a raw balance, so contracts survive dividends and splits with no oracle read.

Writers occupy 32 inline slots in the series' zero-copy account, so buy touches a fixed account set. It walks the ask book cheapest-first, at most 8 asks per transaction, never above the caller's limit. A full book evicts the worst ask; a zero fill returns QuoteMoved and the app re-quotes.

Assignment uses a running product: a writer is assigned only for exercises after they sold, so equal size over the same period means the same outcome.

Oracle-free settlement

Pyth prices the entry. Nothing prices the exit. exercise is a fixed swap between two escrows: position tokens burn, strike in, underlying out. It reads no price account, and neither do settle, release or close_series. The only instruction that reads Pyth is the auto-exercise crank, which verifies age and confidence on a posted update, opt-in per holder through a revocable delegate.

A feed outage can stop the protocol quoting. It cannot stop a holder leaving.

The vault

The protocol's vault is a writer, using the same book functions as anyone, no special-casing. Pricing is realised vol from Pyth Benchmarks, times the vault's own utilization, times a session multiplier from 1.0 in regular hours to 2.2 when the market is shut. Breakers pull asks on stale feeds, a basis breach or a paused mint. Deposits and withdrawals queue at weekly epochs with a published share price, losing weeks included.

Safety

USDC owed rounds up, USDC paid rounds down, dust is swept at close. Settlement never pays more than a vault holds; a random-sequence test checks invariants after every transaction. Fees are taken at buy only and the keeper fee comes from the fee vault, so maximum loss is exactly the premium plus fees. If an issuer pause spans expiry, settlement waits a day while exercise stays open. A halt can never trap a holder.

Why Solana

Token-2022 carries corporate actions in the mint, so a split never touches a contract. Pyth publishes both the share and the token feed, so the basis between them is a live risk surface. Settlement costs a fraction of a cent, so weekly expiries on small positions work.

What is live

14 markets. Program, quoter, keeper, indexer and app in the repo. The app builds every transaction and asks the wallet only to sign, so one build runs on fork, devnet or mainnet.

Next: mainnet seeding, then open it up. Writers post into the same book the vault uses, so any trader or market maker can quote from day one. A quote and buy API lets wallets, terminals and agents embed Gap and Floor with a referrer cut. Position tokens are standard SPL, so they can be listed, lent against and built on anywhere. The roster shows every quote at size and the collateral behind it, so builders can verify depth before they route.