Inflexion

Providing liquidity on Uniswap v3 looks like earning fees. Economically it's selling volatility: a concentrated LP position is short gamma, and the cost of that exposure — impermanent loss — is large, recurring, and estimated at >$1B/year across DeFi, with no trustless, non-inflationary way to hedge it. Inflexion is the first market that makes that risk transferable, priceable, and fully collateralized on-chain.

An LP brings a specific in-range v3 position (its NFT), picks a duration, and pays a fixed upfront premium. At expiry the protocol pays the LP their realized IL — capped at MaxIL — trustlessly, from collateral an underwriter locked up front. It is precisely an in-range convexity hedge, not "IL insurance": the cap is load-bearing, not cosmetic.

The three counterparties :

1 · LP — buys protection (Protect). Hedges the in-range IL of a Uniswap v3 position. Pays one number up front, receives min(realized_IL, MaxIL) at expiry from pre-locked collateral. The NFT is held in custody and returned at settlement; the LP keeps fee accrual throughout.

2 · Depositor — passive underwriter (Earn). Deposits USDC into the pooled ConvexityVault and earns the volatility-risk premium for taking the IL risk LPs shed. The vault is dual-tranche from launch:

- Junior — first-loss vol-seller. Absorbs underwriting losses first, buffers senior, earns the larger premium share. High-APY, high-variance.

- Senior — a "convexity savings account." Structurally protected from underwriting loss while the junior buffer holds (invariant totalLocked ≤ juniorAssets), earns a smaller, smoother share. Exposed only to the systemic tail.

3 · Market maker — active underwriter (Underwrite). Streams firm EIP-712 signed quotes (no last-look), posts its own collateral, and wins a fill only by strictly beating the pool.

Sophisticated MMs run their own vol models and hedge short gamma off-system (Deribit / Panoptic), exporting risk out of the protocol rather than just relocating it. Optional and additive — every MM that arrives only lowers the LP's price.

How it works — two rails, one settlement core

Both rails price off the same on-chain published fair value, then fan into a single, rail-agnostic settlement core:

- Path A — the cvAMM (floor of liquidity). A pooled, always-on, signature-free underwriter (createSwapPathA) backed by the dual-tranche vault. It always quotes a code-capped price, so there's no cold-start — the protocol is complete and solvent on Path A alone.

- Path B — MM competition (ceiling of price). Firm signed quotes (createSwap) from market makers, collateralized per-MM. An MM wins only by beating the pool.

- createSwapRouted prices both off one FairPremium and gives the LP the cheaper of {pool, best MM quote}. A bad MM quote (absent, stale, out-of-band, over-capacity) is evaluated through a read-only mirror that never reverts — it silently falls back to the pool, so the LP is never worse off than going straight to Path A.

The pool price is self-correcting. The cvAMM doesn't quote raw fair value — it adds a transparent, on-chain load: a base volatility-risk premium plus two inventory skews. A utilization skew rises convexly as the pool fills (locked ÷ total), and a dispersion skew rises as outstanding coverage concentrates in one corner of the width × moneyness × duration grid (a Herfindahl measure). Both lift the pool's quote — hard-capped in code at FairPremium·(1 + maxLoad) (invariant I10) and never above MaxIL.

Crucially, that lift is exactly the headroom a market maker needs to undercut and still profit. So when the pool is stretched (full or concentrated), its skews raise the price, MMs win those fills and take the marginal exposure off the pool, utilization and concentration fall, the skews relax, and the quote arbitrages back toward fair value. The skews do double duty: they price scarcity and concentration before the pool over-commits (the dominant depositor-drawdown lever) and they are the incentive that pulls hedged MM liquidity in precisely when the pool needs relief.

Lifecycle: registerMarket (owner) → LP creates (pin entry price to Chainlink, enforce in-range Pa ≤ P0 ≤ Pb, compute MaxIL + FairPremium, lock collateral = MaxIL, take NFT) → ACTIVE (no monitoring needed — in FULL mode liquidation is mathematically impossible) → settle (anyone, at expiry: pin the Chainlink round at T, recompute IL with the liquidity stored at creation, pay min(IL, MaxIL), return the residual to the underwriter and the NFT to the LP). Strict checks-effects-interactions: status is set to SETTLED before any external call, so a swap can never be settled twice.

The math IL is convex. Holding is affine in price; the in-range

LP value V_lp(P) = L·(2√P − √Pa − P/√Pb) is strictly concave

(d²V_lp/dP² = −¼·L·P^(−3/2) < 0).

So IL = V_hold − V_lp = affine − concave is convex, and realized_IL = max(0, V_hold − V_lp) — guarded, never an unchecked subtraction.

MaxIL is the cap and the unit. A convex function on [Pa, Pb] attains its max at a boundary, so MaxIL = max(IL(Pa), IL(Pb)) — the maximum in-range IL, pure geometry, frozen at creation. Because the payoff is capped and collateral = MaxIL ≥ payout = min(realized_IL, MaxIL) by construction, FULL mode cannot produce bad debt under any price path. (Beyond the range, IL is unbounded — which is exactly why only in-range IL can be fully collateralized, and why the cap is the guarantee, not a defect.)

Fair price is an exact closed form, published on-chain. FairPremium = fairRate · MaxIL, where fairRate = E_Q[min(IL, MaxIL)] / MaxIL is the risk-neutral value of the capped payoff as a fraction of MaxIL — an S-curve in σ²·T. The factorization is the key insight: fairRate carries all the vol/time dependence; MaxIL carries none — so one position has three duration prices on one collateral, and MM quotes are per-market, not per-NFT. The capped v3 payoff is piecewise in terminal price, and each arm integrated against the lognormal density is an interval moment in the normal CDF Φ — so the whole expectation collapses to a finite Φ-sum (~6–10 terms, Black–Scholes class). No Monte Carlo, no lookup table, no calibrated coefficients; σ_ref (conservative realized vol) is the only stochastic input.

Why Arbitrum + Stylus The Φ-sum is compute-heavy (it leans on erf), and Solidity's Abramowitz–Stegun erf (~1.5e-7) amplifies through MaxIL to an error large enough to be picked off on a published price. So the production FairValueOracle is written in Arbitrum Stylus (Rust/WASM) with integer fixed-point — Stylus bans WASM floats at activation, making it deterministic and machine-precise (matches a 50-digit reference to ≤1e-12 on fairRate). That precision is why the on-chain price can be trusted as fair value rather than a loose estimate. Arbitrum also has the deepest Uniswap v3 liquidity (the LPs are here) and fully-deployed Chainlink feeds (settlement price + the realized-vol oracle).

Theory anchors: LVR (Milionis–Moallemi–Roughgarden, 2022 — short-gamma cost is closed-form) and static replication (Lipton–Lucic–Sepp, 2025 — the IL claim is a strip of vanillas, hence priceable and hedgeable).

A full platform — SDK, API, subgraph, docs

Inflexion ships as a complete, integration-ready stack around the contracts:

- TypeScript SDK (@inflexion/sdk) — one typed access layer over the live deployment, with five surfaces (LP · depositor · MM · data · analytics). For market makers it provides everything needed to price and hedge: the live "pool load to beat," firm EIP-712 quote signing with the I10 / below-pool guards built in, and a greeks + hedge engine — δ / γ / vega / θ finite-differenced off the protocol's own deployed math (no parallel pricing model), plus a concrete three-leg hedge suggestion (a Breeden–Litzenberger replication strip + an on-chain inverse long-gamma range on Panoptic/GammaSwap + a residual delta overlay). Every read degrades to a typed envelope instead of throwing, and the SDK never reimplements the on-chain pricer.

- Public REST API — a keyless, read-only, cached facade (no wallet, signer, or RPC key required) over RPC + subgraph + telemetry, self-documented with OpenAPI 3.1 and Swagger UI.

- Subgraph (The Graph) — deployed and indexing the full per-fill lifecycle (create → quote → price → settle), powering the first public dataset of this market's microstructure — the DeFi LP volatility-risk-premium surface (the "data moat"), which matures as competing MMs and volume arrive.

- Documentation — a comprehensive Mintlify site (90+ pages: the math, protocol, security model, SDK, and API) that links the whole stack together.

Two claims, always kept separate:

1. LPs are always paid — no bad debt in FULL, code-enforced (invariant I1); exact under capped payoff + solvent USDC + oracle/settlement liveness.

2. Depositors and MMs can lose principal — they are volatility sellers; capital is not guaranteed (junior is first-loss; senior is shielded from underwriting loss only, never the systemic tail).

Not Bancor (mints nothing — pays from pre-locked USDC), not GammaSwap (no active management), not Panoptic (the LP pays one number), not "insurance" (it's a collateralized derivative).

Links

- REST API + Swagger UI: https://inflexion-backend.onrender.com/docs

- Subgraph (GraphQL): https://api.studio.thegraph.com/query/1754692/inflexion-arb-sepolia/version/latest

- Contracts: Arbitrum Sepolia (chainId 421614)

- Live app: https://inflexion-ten.vercel.app/

- Documentation: inflexion.mintlify.app

- Repository: https://github.com/frytegg/inflexion