Lending

Lending against real-world assets creates a fundamental tension. On one hand, you want to unlock capital efficiency—collectors shouldn't need to sell their watches to access liquidity, dealers shouldn't need to tie up cash in inventory they're holding for clients, and long-term holders shouldn't be forced out of positions by temporary cash needs. On the other hand, you're lending against assets that trade in thin, local on-chain markets and settle into slow, off-chain physical markets.

We're not missing a price feed. The protocol has a price oracle: its own spot markets (CLAMMs) and mark-to-truth auctions. The challenge is that these prices can be noisy, manipulable, and only loosely coupled (in the short run) to the physical market, while liquidations and leverage are happening in real time on-chain.

Get this wrong and you end up with one of two failure modes. Be too aggressive with leverage and you create death spirals—price drops slightly, liquidations cascade, CLAMM depth evaporates, more liquidations, reflexive collapse. Be too conservative and nobody uses the product—why lock up a $10k watch for a $2k loan at 15% APY when you could just sell the token on spot and buy back later?

The answer isn't to pick one extreme. It's to offer two distinct products with radically different risk/UX trade-offs, both of which derive truth from the protocol's own markets rather than external oracles. Option A is continuous margin lending—dynamic rates from utilization curves, mark-to-market every block, liquidations when positions go underwater—for DeFi-native users who want leverage and understand liquidation risk. Option B is matched-term credit—fixed-rate, fixed-maturity loans matched between lenders and borrowers through intent-based matching. On-chain prices only set conservative LTVs at origination; lenders decide to enter based on whether they believe the real asset will be worth at least the lent amount at term.

This page explains how both work, why they don't use external price feeds, and how they integrate with the protocol's mark-to-truth auctions and pot-based fee distribution.

Key Mental Model

Traditional DeFi lending assumes "truth = Chainlink price" and "liquidation = instantly dump into a deep global market." Here:

• The oracle is internal: the CLAMM and mark-to-truth auctions.
• Liquidity is real but local: you can always dump RWA tokens on the protocol's own spot markets, but depth is finite and reflexive.
• There is a slow but real external anchor: physical custody and eventual off-chain liquidation set a long-run floor, even if on-chain prices are temporarily manipulated.

The design is: aggregate internal prices from CLAMMs and mark-to-truth, apply conservative haircuts, use utilization curves to make reflexive leverage expensive, and add backstops (floor-bid vaults, term loans) that absorb liquidation flow without nuking the CLAMM.

It's not "trustless DeFi lending with Chainlink." It's capital-based lending with no external price oracles, anchored in real-world assets held in custody.

---

The problem: price discovery for one-of-a-kind assets

Traditional DeFi lending is straightforward when you have deep, fungible assets and reliable external price feeds. Lend USDC against ETH collateral? Check Chainlink every block, liquidate if LTV crosses 80%, done. The oracle is your source of truth; liquidation bots provide exit liquidity into massive secondary markets.

Tokenized RWAs look similar on-chain—you have a spot market and an observable price—but they behave very differently:

No reliable external feeds: Appraisals are subjective and stale. Two experts can value the same Patek Philippe 30% apart. Appraisals are done once, maybe annually. Markets move daily. Shipping an appraisal into Chainlink doesn't magically make it objective or up-to-date, so the protocol deliberately avoids external price oracles.

Thin and local on-chain liquidity: You can dump RWA tokens instantly on the protocol's CLAMMs—no need to sell the physical watch first. But those pools are local and depth-constrained. Selling 10% of a collection's supply into a $5M pool is not the same as selling 10% of ETH into global CEX+DEX liquidity.

Manipulation surface: If you lean too hard on the CLAMM mid price, moving that price can be cheaper than actually acquiring or dumping the underlying economic exposure. A bad actor who wants to trigger liquidations or avoid them can try to pump or crash the local pool instead of buying/selling watches in the real world.

Reflexivity risk: Thin liquidity means that liquidation itself moves the market. Sell 10% of a watch collection into the pool to cover a liquidation → price drops 15% → more positions become underwater → more liquidations → further price impact. Leveraged positions and the spot pool end up reinforcing each other.

Bridge risk to the physical market: Unlike ETH, these tokens correspond to real assets in custody. In the long run, token price must line up with physical auction prices, insurance valuations, and mark-to-truth auctions backed by real capital. In the short run, on-chain price can deviate significantly from that "real-world" value—both up and down.

The core challenge: You need a lending system that:

• Treats the protocol's own spot markets as the primary price signal,
• Recognizes that those prices are noisy and manipulable in the short run,
• Uses capital-based mechanisms (depth, auctions, haircuts) to filter that noise, and
• Leans on the physical market and custody as a slow, hard anchor that eventually drags on-chain prices back toward reality.

The advantage vs pure-crypto lending is that there is an external anchor: if on-chain prices get too cheap, eventually someone is happy to buy the tokens, redeem, and own the watches; if they get too rich, new supply can be minted against real inventory and sold down. Mark-to-truth auctions and physical liquidation connect those worlds.

---

How it works: capital-based pricing and two products

The protocol solves this through three components: internal pricing derived from its own markets, two distinct lending products with different risk profiles, and integration with mark-to-truth to handle discrete repricing events and reconnection to the physical floor.

Internal pricing: no external price oracles

For each collateral collection (e.g., FP Journe Chronomètre Bleu, FPJ-CB), the protocol computes an internal credit price using only its own on-chain markets. The CLAMM and mark-to-truth auctions are the oracle; there is no Chainlink or off-chain appraisal feed.

Three inputs:

• $P_{\text{twap}}$: time-weighted CLAMM mid price over window $T$ (typically 15–60 minutes). Smooths out single-trade noise and prevents flash-crash manipulation.
• $P_{\text{depth}}(q_{\text{ref}})$: depth-aware execution price for selling a reference quantity $q_{\text{ref}}$ into the CLAMM right now. Captures "what price can we actually realize on liquidation size?".
• $P_{\text{mt}}$: mark-to-truth clearing price from the most recent mark-to-truth auction, if any. Represents what real bidders with real capital actually paid for randomly sampled assets from custody.

The lending system uses a conservative internal mark:

$$P_{\text{internal}} = \min\!\big(P_{\text{twap}},\, P_{\text{depth}}(q_{\text{ref}}),\, P_{\text{mt}}\big)$$

If no mark-to-truth auction has ever run for a collection, $P_{\text{mt}}$ is treated as $+\infty$ and drops out of the minimum until the first auction clears.

$P_{\text{twap}}$: time-weighted average price

$$P_{\text{twap}} = \frac{1}{T} \int_{t-T}^{t} P_{\text{mid}}(\tau)\,d\tau$$

where $P_{\text{mid}}(\tau)$ is the CLAMM mid price at time $\tau$.

TWAP window trade-off: A longer TWAP window makes manipulation harder (attackers must hold a distorted price for longer) but also makes the system slower to react to genuine repricings. A shorter window reacts faster but is more sensitive to short-lived spikes. In practice, the window $T$ is chosen conservatively (tens of minutes) and combined with depth-aware pricing and mark-to-truth, so no single parameter shoulders all the risk.

$P_{\text{depth}}(q)$: depth-aware execution price

$$P_{\text{depth}}(q) = \frac{1}{q} \int_0^{q} P_{\text{sell}}(x)\,dx$$

where $P_{\text{sell}}(x)$ is the marginal execution price for the $x$-th unit sold into the pool, accounting for slippage across the range. Intuitively: "if the protocol tried to liquidate $q$ tokens right now via the CLAMM, what average price would it actually get?"

$P_{\text{mt}}$: mark-to-truth price

$P_{\text{mt}}$ is the clearing price from the most recent mark-to-truth auction for that collection: randomly sampled tokens from custody are auctioned to real bidders. This connects on-chain pricing to the physical market and sets a hard reference point: if the CLAMM drifts too far from where people are willing to commit real capital for real watches, mark-to-truth pulls the internal mark back.

Why the minimum?

Conservative by design. The protocol only trusts prices that are:

• Sustained over time (TWAP catches transient pumps),
• Realizable at liquidation scale (depth catches thin liquidity), and
• Validated by auction capital (mark-to-truth catches stale or locally manipulated CLAMM prices).

If any source suggests the asset is worth less than the others, that's the price the lending system uses. Better to be conservative than to over-collateralize based on fake depth or a single manipulated trade.

Game theory

An attacker who wants to inflate prices to borrow more must:

1. Maintain elevated CLAMM prices for the entire TWAP window (expensive, requires continuous capital),
2. Provide enough liquidity that $P_{\text{depth}}(q_{\text{ref}})$ stays high (locks up capital as LP),
3. Either avoid mark-to-truth being triggered or win those auctions at inflated prices (requires buying actual assets at those inflated bids).

All three simultaneously. That's not a cheap attack. And even if they do it, they still face additional haircuts and conservative LTVs in the lending layer.

Critically: winning mark-to-truth auctions at inflated prices just means the attacker is buying real watches above fundamental value with real djinUSD. Any attempt to manipulate $P_{\text{mt}}$ is economically equivalent to subsidizing other participants; they're paying real money to move the mark.

---

Option A: Continuous Credit (Margin Lending)

What it is: Standard over-collateralized crypto lending (Aave/Compound-style) adapted to RWAs. Users borrow djinUSD against collateral with variable rates and continuous mark-to-market. The only differences vs classic DeFi lending are:

• Prices come from the protocol's own CLAMM + mark-to-truth (internal oracle) instead of Chainlink, and
• There are extra safety rails (haircuts, caps, circuit breakers, floor-bid vault) to handle thin liquidity and reflexivity.

Who it's for: DeFi-native users who want leverage, understand liquidation risk, and are comfortable with dynamic rates. LPs who want to borrow against their LP positions to deploy capital elsewhere. Users building derivatives or structured products on top.

Overview: How continuous credit works

In plain English:

You pledge watch tokens (e.g., FPJ-CB) as collateral. The protocol continuously monitors three price signals from its own markets—TWAP from the CLAMM, depth-aware execution price, and mark-to-truth clearing prices—and takes the minimum as a conservative internal price. It then applies a price haircut to account for model risk and illiquidity, giving you a credit value for your collateral. You can borrow up to a conservative percentage (advance rate, or LTV_max) of that credit value. Your debt accrues interest at a rate that depends on how much of the system's total credit capacity is being used. If your debt grows (via interest) or your collateral value drops (via price changes) such that your debt exceeds a liquidation threshold (LLTV), the protocol liquidates your position—selling your collateral to cover the debt. This is continuous, dynamic, mark-to-market lending.

Mathematically:

1. Internal price (defined earlier):

$$P_{\text{internal}} = \min\!\big(P_{\text{twap}},\, P_{\text{depth}}(q_{\text{ref}}),\, P_{\text{mt}}\big)$$

2. Credit price (after price haircut $h_{\text{price}}$):

$$P_{\text{credit}} = (1 - h_{\text{price}}) \times P_{\text{internal}}$$

3. Collateral value (for $n$ tokens pledged):

$$C = n \times P_{\text{credit}}$$

4. Maximum borrow (advance rate $\text{LTV}_{\max}$):

$$B_{\max} = \text{LTV}_{\max} \times C$$

5. Liquidation condition (when debt $D$ exceeds liquidation threshold):

$$D \geq \text{LLTV} \times C$$

where LLTV (Liquidation Loan-to-Value) is the threshold at which a position becomes liquidatable. It's always higher than LTV_max to give borrowers a buffer: typically $\text{LLTV} = 1.1 \text{–} 1.2 \times \text{LTV}_{\max}$.

Example: If LTV_max = 30%, you might set LLTV = 36%. This means you can borrow up to 30% of your collateral value, but you won't be liquidated until your debt reaches 36% of collateral value—giving you a 20% safety buffer.

6. Interest accrual: Debt $D$ grows continuously based on utilization-driven interest rates.

The system continuously re-evaluates $P_{\text{internal}}$, recalculates $C$, and checks if $D \geq \text{LLTV} \times C$. If yes → liquidate. If no → position remains open.

---

Design

Now let's break down each component in detail.

Haircuts and collateral value

Internal pricing gives you $P_{\text{internal}}$, but that's not your credit value—it's just the best estimate of what the market thinks assets are worth right now. To account for model risk (maybe your internal pricing is still wrong), illiquidity (selling takes time, prices can move), and volatility (watches don't move 2% per day like ETH, but they can move 10-20% over weeks), the protocol applies a price haircut:

$$P_{\text{credit}} = (1 - h_{\text{price}}) \times P_{\text{internal}}$$

where $h_{\text{price}} \in [0, 1)$ is asset-specific.

Haircut sizing:

• Liquid, deep collections (hypothetical: high-volume RWA with $50M+ daily trading): 5–10%
• Moderate liquidity (established watch collections with consistent depth): 15–25%
• Illiquid, unique assets (rare collectibles, one-of-a-kind items): 30–50%

Dynamic haircuts can adjust based on on-chain conditions:

• CLAMM depth drops below threshold → increase haircut
• Mark-to-truth is stale (no auction in 30+ days) → increase haircut
• Recent volatility spikes → increase haircut
• Consistent depth and volume → decrease haircut gradually

All adjustments are mechanical, based on observable on-chain metrics. No discretion.

Collateral value:

$$C = P_{\text{credit}} \times \text{amount}$$

where "amount" is the number of tokens pledged.

Advance rate (LTV) and liquidation threshold

You've got a credit value $C$, but the protocol doesn't lend you 100% of that—it keeps an equity cushion. The advance rate (also called LTV_max) defines the maximum loan-to-value ratio:

$$B_{\max} = \text{LTV}_{\max} \times C$$

Typical advance rates for watches: 25–40%. You pledge $10k in credit value, you can borrow$2.5k–$4k.

Why so conservative? Because liquidation takes time and moves markets. If prices drop 20% and you lent 80% LTV, you're underwater before you can liquidate. At 30% LTV, you have a 70% equity buffer—prices can fall 70% before the protocol loses money.

Liquidation happens when debt $D$ exceeds the liquidation threshold:

$$D \geq \text{LLTV} \times C$$

where $\text{LLTV} > \text{LTV}_{\max}$ (typically $\text{LLTV} = 1.1 \text{–} 1.2 \times \text{LTV}_{\max}$).

Example: LTV_max = 30%, LLTV = 36%.

• You pledge 2 FPJ-CB tokens.
• $P_{\text{internal}} = 5000$, haircut = 20% → $P_{\text{credit}} = 4000$
• $C = 2 \times 4000 = 8000$
• $B_{\max} = 0.30 \times 8000 = 2400$
• Liquidation threshold: $D_{\text{liq}} = 0.36 \times 8000 = 2880$

You can borrow up to $2,400 djinUSD. If your debt (including accrued interest) reaches$2,880, you get liquidated. That gives you a 20% buffer ($2,880 /$2,400 = 1.20$) between max borrow and liquidation.

Interest rates and utilization

Each collateral type has its own utilization-based interest curve. Utilization $u$ is:

$$u = \frac{\text{Total borrowed}}{\text{Total credit capacity}}$$

Interest rate formula (kinked model, similar to Aave):

$$r_{\text{borrow}}(u) = \begin{cases} r_0 + u \cdot \frac{r^* - r_0}{u^*} & \text{if } u \leq u^* \\ r^* + (u - u^*) \cdot \frac{r_{\max} - r^*}{1 - u^*} & \text{if } u > u^* \end{cases}$$

where:

• $r_0$: Base rate (e.g., 4%)
• $r^*$: Rate at target utilization $u^*$ (e.g., 8% at $u^* = 0.50$)
• $r_{\max}$: Maximum rate at $u = 1$ (e.g., 50%)

Why kinked? Below $u^*$, rates are moderate—you want to encourage borrowing. Above $u^*$, rates spike—you want to discourage more borrowing and encourage repayment to prevent over-utilization.

Target utilization for illiquid collateral: Much lower than liquid DeFi (typically u* = 0.30–0.50 for watches vs. u* = 0.80 for ETH). Why? Because you need spare capacity for liquidations. If utilization is at 80% and you need to liquidate 20% of collateral, you're dumping into a thin market. At $u^* = 40\%$, you have room to breathe.

Spread (borrower rate - lender rate): Flows to the lending pot, distributed as:

• 40% → Protocol treasury (liquidation infrastructure, monitoring, development)
• 30% → Collection cost pot (custody/insurance for the collateral)
• 30% → Lending insurance fund (covers shortfalls if liquidations don't fully cover debt)

This matches the Lending pot split described in Fees & Yield Routing, which provides the canonical specification for all protocol fee distributions.

Safety caps and circuit breakers

To prevent runaway leverage and manipulation, the protocol enforces hard caps:

Per-asset debt caps: Maximum aggregate djinUSD that can be borrowed against a given collection.

$$D_{\text{cap}} = \min\left(\alpha_{\text{TVL}} \times \text{TVL}_{\text{CLAMM}}, \beta_{\text{volume}} \times \text{Vol}_{30d}, D_{\text{gov}}\right)$$

where:

• α_TVL ≈ 0.15–0.30 (debt cap as fraction of CLAMM TVL)
• β_volume ≈ 0.50–1.0 (debt cap as fraction of 30-day rolling volume)
• D_gov: Governance-set absolute cap

Example: FPJ-CB has $20M CLAMM TVL and $12M monthly volume.

• TVL-based cap: 0.20 × $20M = $4M
• Volume-based cap: 0.75 × $12M = $9M
• Governance cap: $5M
• Effective cap: min($4M, $9M, $5M) = $4M

Once $4M djinUSD has been borrowed against FPJ-CB, no more loans until repayments happen.

Per-position caps: Maximum notional and conservative LTVs per account. Prevents whale concentration.

CLAMM health gates: Lending is enabled for a collection only if:

• $\text{TVL}_{\text{CLAMM}} \geq \text{TVL}_{\min}$ (e.g., $5M)
• Depth within ±2% of mid $\geq$ depth threshold (e.g., $500k per side)
• 7-day rolling volume $\geq$ volume threshold (e.g., $1M)

If any gate fails, new borrowing halts (existing positions remain open, can repay or get liquidated normally).

Volatility circuit breakers: If CLAMM price moves >$X$% over $T$ minutes, or depth drops >$Y$%, the protocol:

• Halts new borrowing against that collateral
• Optionally triggers an automatic mark-to-truth auction
• Resumes borrowing after cooldown + stability check

Example parameters: If price moves >8% in 30 minutes, or depth drops >50% in 15 minutes → circuit breaker. Cooldown: 6 hours. Stability check: price stays within ±3% of post-shock level for 24 hours.

Mark-to-truth and liquidations

Mark-to-truth auctions provide discrete, explicit repricing events. See Mark-to-Truth Auctions for complete mechanics.

Integration with lending:

1. Price feeds into $P_{\text{mt}}$: After a mark-to-truth auction clears, the clearing price becomes $P_{\text{mt}}$ in the internal pricing formula. If $P_{\text{mt}}$ is significantly below $P_{\text{twap}}$ or $P_{\text{depth}}$, it drags down $P_{\text{internal}} = \min(\ldots)$ immediately.

2. Collateral revaluation: All positions get revalued at the new $P_{\text{credit}} = (1 - h_{\text{price}}) \times P_{\text{internal}}$. Positions that were healthy before might cross the liquidation threshold.

3. Controlled liquidation: Liquidations happen through a priority waterfall:

   • Primary: Liquidation auctions (similar to mark-to-truth but specifically for undercollateralized positions)
   • Secondary: Floor-bid vault (if configured, see below)
   • Tertiary: CLAMM sales in controlled tranches (max 5-10% of pool depth per day)

4. No cascades: Because liquidations are routed through auctions and vaults first, they don't dump into the CLAMM all at once. This breaks reflexive loops.

Liquidation waterfall example:

• Position becomes underwater (D = \3,000$,$C = $2,800$).
• Protocol triggers liquidation:
  1. Post collateral to liquidation auction (48-hour sealed bids).
  2. If auction clears above debt → surplus returned to borrower, debt cleared.
  3. If auction fails (insufficient bids) → offer to floor-bid vault at preset discount.
  4. If vault passes → sell into CLAMM gradually (5% per day max).
• Most liquidations clear in step 1 or 2. Step 3-4 is rare.

Floor-bid vault: optional liquidation backstop

This is not a separate lending product—it's an optional buyer of liquidation inventory in the margin-lending waterfall. The vault does not change user loan terms in Option A; it only affects how liquidations are executed once a position is already underwater.

For collections where liquidation risk is significant, the protocol can deploy a floor-bid vault—a dedicated pool of djinUSD that exists specifically to buy distressed collateral at predefined floors.

How it works:

• Users deposit djinUSD into the vault to earn a share of liquidation profits (buy below market, hold or resell at recovery).
• Vault defines a floor price curve: e.g., $P_{\text{floor}} = \max(0.70 \times P_{\text{mt}}, P_{\text{absolute}})$ where $P_{\text{absolute}}$ is a governance-set floor (e.g., $3,500 for FPJ-CB).
• When a liquidation is triggered, the protocol checks:
  • If liquidation size $\leq$ vault capacity, and
  • If CLAMM volatility > threshold or depth is insufficient
  • → Offer collateral to vault at $P_{\text{floor}} \times (1 - \phi_{\text{discount}})$ where $\phi_{\text{discount}} \approx 5\text{–}10\%$
• Vault buys the collateral using its djinUSD. The djinUSD goes to repaying the debt.
• Vault now owns the collateral and can:
  • Hold it,
  • Resell gradually on CLAMM when liquidity improves,
  • Warehouse for off-chain disposition (auction house, private sale).

Example:

• Vault has $500k djinUSD capacity.
• Vault floor: 0.70 × $4,500 = $3,150 with discount $\phi = 8\%$ → effective buy price $2,898.
• Position with 2 tokens ($9,000 collateral value at old price) becomes underwater.
• Mark-to-truth reprices to $4,500 → $C_{\text{new}} = 2 \times (0.80 \times 4500) = 7200$. Debt is $8,000. Underwater by $800.
• Liquidation triggers. Vault buys 2 tokens at $2,898 each = $5,796.
• Debt of $8,000 is only partially covered. Shortfall: $8,000 − $5,796 = $2,204 goes to lending insurance fund.
• (In practice, liquidation should trigger before debt reaches 100% of collateral value, so shortfalls are rare.)

Why this helps:

• Absorbs liquidation pressure without dumping into CLAMM all at once
• Provides price floor that makes liquidations more predictable
• Creates yield opportunity for users willing to buy distressed assets
• Stabilizes main lending market by separating liquidation flow from spot trading flow

Very similar to Kujira's ORCA liquidation marketplace, adapted for RWA context.

---

Option B: Matched-Term Credit

Lenders and borrowers are matched at specific rates and maturities through an intent-based system. On-chain prices are used once at origination to set conservative LTVs—then lenders underwrite based on their belief in the physical asset's value at maturity. Markets set rates through matching, not utilization curves.

What it is: Fixed-term, fixed-rate loans where:

• Borrowers lock RWA collateral (e.g., FPJ-CB) and submit borrow intents
• Lenders supply djinUSD through credit vaults with specific lending policies
• A matching engine pairs borrowers and lenders at mutually agreeable rates
• On-chain internal price is used once to set LTV at origination (via a long TWAP/RWAP view)
• The economic backing is the physical watch in custody: lenders only lend if they believe that, at term, the real asset will be worth ≥ the loan (net of fees)

No utilization curve, no "protocol picks the rate"—rates are discovered by market matching.

Who it's for: Lenders and borrowers who care about fundamental value at term, not intraday PnL. Think of dealers, credit funds, or collectors who are happy to run "I'll lend 40 against a watch currently marked 100 because I think the watch will still clear >40 net of costs in 12 months."

Overview: How matching works

In plain English:

The system uses an intent-based matching architecture:

• Borrowers submit borrow intents: asset (FPJ-CB), collateral amount ($n$ tokens), term bucket (3/6/12 months), max rate they're willing to pay ($r_{\max}$)
• Lenders supply djinUSD into credit vaults with policies: which assets to lend against, which terms, minimum acceptable rate ($r_{\min}$), max LTV they're comfortable with
• Matching engine pairs compatible intents: same asset + same term bucket, where $r_{\min} \leq r_{\text{fixed}} \leq r_{\max}$
• Result: actual loan with principal $B$, fixed rate $r_{\text{fixed}}$, maturity $T$, and collateral locked in the vault

Rates are set by markets, not by a utilization curve.

Implementation: We expect to build this on top of Morpho V2's infrastructure (MetaMorpho vaults + intent matching), adapting it for RWA-specific requirements like long TWAP/RWAP pricing and physical-value underwriting.

Mathematically:

At origination, for $n$ tokens pledged:

$$C_{\text{term}} = n \times P_{\text{term}}$$ $$B_{\max} = \text{LTV}_{\text{term}} \times C_{\text{term}}$$

where:

• $P_{\text{term}}$ is a slow, conservative view of price (long TWAP/RWAP + stricter haircuts)
• $\text{LTV}_{\text{term}} \approx 30\text{–}40\%$ for illiquid RWAs

Example: At internal mark of $100 per token with 30% LTV, lending $40 per token means the lender believes the real watch will be worth ≥$40 net of costs at maturity.

---

Design

Pricing and LTV: internal price only sets the advance rate

Option B still uses the same internal oracle as Option A, but much more sparsely.

At origination, the system computes a term credit price $P_{\text{term}}$:

• Based on the same $P_{\text{internal}} = \min(P_{\text{twap}}, P_{\text{depth}}, P_{\text{mt}})$ framework
• But with a longer TWAP/RWAP window (hours to days, not minutes) since these assets move slowly
• And stricter haircuts to account for term uncertainty

This gives a conservative collateral value:

$$C_{\text{term}} = n \times P_{\text{term}}$$

The vault/lender policy then applies an advance rate $\text{LTV}_{\text{term}}$ (typically 30–40%) to determine maximum principal:

$$B_{\max} = \text{LTV}_{\text{term}} \times C_{\text{term}}$$

Critically: Price is only used at origination to size the loan. We're not doing high-frequency "mark-to-market every block"—that's Option A's job.

Example:

• FPJ-CB internal price: $P_{\text{term}} = 5000$ (after long TWAP + haircuts)
• Borrower wants to pledge 2 tokens → $C_{\text{term}} = 10000$
• Vault policy: $\text{LTV}_{\text{term}} = 0.35$ → $B_{\max} = 3500$
• Intent matching finds a lender at 10% APY for 6 months
• Loan created: $3,500 principal, 10% fixed rate, 6-month term, 2 tokens locked

Loan semantics and risk

Each matched loan is:

• Fixed principal $B$
• Fixed rate $r_{\text{fixed}}$ for specific term $T$
• Backed by collateral locked for the term

The protocol can support two flavors (depending on vault policy):

1. Pure term + non-recourse (credit fund style):

• No mid-term liquidations
• At maturity, borrower either:
  • Repays $B \times (1 + r_{\text{fixed}} \times T/365)$ and gets collateral back, or
  • Defaults, in which case collateral is sold/assigned to lenders
• Lenders are saying: "At an on-chain mark of 100 and 40% LTV, I'm lending 40. I'm comfortable the real watch will still clear ≥40 net of costs at term."

2. Term + gentle margining (for conservative lenders):

• Same matching, fixed rate and term
• But additionally enforce a slow LLTV using $P_{\text{term}}$:
  • If credit value collapses (e.g., brand disaster), loan can be liquidated early via auction/floor-bid vault
  • This is "slow-motion Option A": margin calls exist, but only on big, sustained moves, not every small wiggle

Different vaults can choose different profiles and charge spreads accordingly.

Lender perspective: betting on real value at term

From a lender's POV, every filled intent is a simple bet:

"If I lend $40 now against 1 watch marked $100 and the rate is 10% for 12 months, will the real watch be worth at least $40–$45 net of liquidation costs in a year?"

• If yes → the deal is attractive
• If no → demand a higher rate or refuse to lend

The on-chain price path between origination and maturity is secondary:

• It can influence whether you stay in the vault/pool
• But it doesn't need to drive continuous liquidations as in Option A

The pool's job is to:

• Trust the internal price enough at origination
• Exit or increase demanded rates if the CLAMM or mark-to-truth feed looks wrong
• Rely on custody + off-chain liquidation for ultimate recovery

Interaction with internal pricing and physical market

Option B still uses:

• The internal oracle ($P_{\text{internal}}$) to define $P_{\text{term}}$ and term LTVs
• Mark-to-truth auctions as slow, discrete sanity checks (if MTTs start clearing way below CLAMM, new LTVs shrink or new lending halts)

But cause and effect is different vs Option A:

• In Option A, a bad mark immediately changes everyone's collateral value and can trigger liquidations
• In Option B, a bad mark mostly affects new deals:
  • New loans are sized conservatively or not originated
  • Existing term loans don't get whipsawed by every move; they're priced to withstand short-term noise

Over the full term, lenders are relying on:

• Custody + physical liquidation as the anchor: even if the CLAMM is off, you can always redeem, sell the watch, and recover some value
• The fact that watches move slowly enough that long TWAP/RWAP plus periodic MTT is a decent proxy for "what this is worth, roughly"

Relation to Option A

Both options can coexist in the same protocol:

Feature	Option A (Continuous Credit)	Option B (Matched-Term Credit)
Pricing	Continuous $P_{\text{internal}}$ (TWAP, depth, MTT)	$P_{\text{term}}$ at origination only (long TWAP/RWAP); lenders bet on physical value at term
Rate discovery	Utilization curve (protocol-set)	Intent matching (market-set)
Liquidations	Yes (LLTV threshold, auction/CLAMM, optional floor-bid vault)	None (pure term) or slow LLTV (depending on vault policy)
Interest rate	Variable (changes with utilization)	Fixed (matched at origination)
Term	Open-ended (repay anytime)	Fixed maturity (3–12 months)
UX complexity	High (monitor collateral ratio, rates)	Low (set and forget until maturity)
Capital efficiency	Higher (dynamic LTVs adjust with price)	Lower (conservative LTVs set at origination)
Liquidation risk	High (mid-term margin calls)	None (or very slow, depending on vault)
Protocol risk	Moderate (liquidation machinery must work)	Higher (relies on physical value at term)
Natural use case	Leverage, trading, derivatives	Credit funds, dealers betting on physical value at maturity
Integration with markets	Tight (mark-to-truth immediately affects all positions)	Loose (mark-to-truth only affects new loan sizing)
Underwriting basis	On-chain price movements	Physical asset value at term (custody + liquidation)

Key distinction: The fundamental difference is what "price" means and when it matters:

• Option A (Continuous Credit): Standard crypto lending. On-chain price drives everything continuously—your collateral value, liquidation risk, and borrowing capacity all update every block. If price drops, you get margin-called.

• Option B (Matched-Term Credit): Price only matters at two points: (1) origination, to set a conservative LTV, and (2) maturity, when the lender finds out if the physical watch was actually worth what they bet on. In between, on-chain price movements don't trigger anything—lenders are making a fundamental value bet, not trading on-chain volatility.

Think of it as: Option A = trading collateral value. Option B = underwriting physical assets.

Funding: Both draw from the same underlying stablecoin (djinUSD). Lenders who supply djinUSD can choose to allocate to:

• Option A pool (higher yield, liquidation-backed, more volatile utilization)
• Option B pool (moderate yield, default risk, more stable utilization)
• Split between both

Fee routing: Both flow into the lending pot, distributed as:

• 40% → Protocol treasury
• 30% → Lending insurance fund (shared or separate by option)
• 30% → Collection cost pot

See Fees & Yield Routing for complete distribution mechanics.

---

Worked example: FPJ-CB lending (Option A)

Let's walk through a realistic scenario with concrete numbers.

Setup

Collection: FP Journe Chronomètre Bleu (FPJ-CB)

CLAMM state:

• TVL: $20M (50/50 stables/tokens)
• Circulating supply: 2,000 tokens
• Mid price: $5,000
• Depth within ±2%: $800k per side

Mark-to-truth: Last auction 2 weeks ago cleared at $4,850 for 5 randomly sampled tokens.

Lending parameters:

• Price haircut: 20% (moderately liquid collection)
• Advance rate: LTV_max = 30%
• Liquidation threshold: LLTV = 36%
• Utilization target: $u^* = 0.40$
• Rates: $r_0 = 4\%$, $r^* = 8\%$ at $u^* = 0.40$, $r_{\max} = 50\%$
• Debt cap: min(0.20 × $20M, 0.75 × $12M monthly vol, $5M gov) = $4M

Alice borrows

Step 1: Compute internal price

• $P_{\text{twap}}$ (15-minute): $5,020
• $P_{\text{depth}}(100 \text{ tokens})$ (5% of supply): $4,880 (accounting for slippage)
• $P_{\text{mt}}$: $4,850 (from last auction)
• $P_{\text{internal}} = \min(5020, 4880, 4850) = 4850$

Step 2: Apply haircut

$$P_{\text{credit}} = (1 - 0.20) \times 4850 = 3880$$

Step 3: Compute collateral value

Alice pledges 5 FPJ-CB tokens:

$$C = 5 \times 3880 = 19400$$

Step 4: Max borrow

$$B_{\max} = 0.30 \times 19400 = 5820$$

Alice borrows $5,500 djinUSD (slightly below max).

Step 5: Interest accrual

Current utilization across all FPJ-CB loans: $u = 0.35$ (below $u^* = 0.40$).

$$r_{\text{borrow}} = 4\% + 0.35 \times \frac{8\% - 4\%}{0.40} = 4\% + 3.5\% = 7.5\% \text{ APY}$$

Alice's debt grows at 7.5% APY: ~$1.13/day in interest.

30 days later: price drops

New CLAMM state:

• Legitimate repricing event (external watch market sentiment weakens)
• CLAMM mid drops to $4,500 over a week (not a flash crash, sustained)
• $P_{\text{twap}}$ now: $4,480
• $P_{\text{depth}}(100)$ now: $4,350 (thinner depth due to some LPs exiting)
• Mark-to-truth triggered (because $P_{\text{twap}}$ diverged >5% from last $P_{\text{mt}}$): clears at $4,400

Recompute internal price:

$$P_{\text{internal}} = \min(4480, 4350, 4400) = 4350$$ $$P_{\text{credit}} = (1 - 0.20) \times 4350 = 3480$$

Alice's new collateral value:

$$C_{\text{new}} = 5 \times 3480 = 17400$$

Alice's debt (after 30 days at 7.5% APY):

$$D = 5500 \times (1 + 0.075 \times 30/365) = 5500 \times 1.00616 = 5534$$

Health check:

• Liquidation threshold: $\text{LLTV} \times C = 0.36 \times 17400 = 6264$
• Alice's debt: $5,534
• Status: Healthy ($5,534 < $6,264). Alice has $6,264 − $5,534 = $730 cushion (~13% buffer).

If prices fall another ~13%, Alice crosses liquidation threshold.

60 days: Alice repays

Alice decides to repay before risking liquidation.

Debt after 60 days:

$$D = 5500 \times (1 + 0.075 \times 60/365) = 5568$$

Alice pays $5,568 djinUSD, gets her 5 FPJ-CB tokens back.

Spread distribution (assuming $r_{\text{lend}} = 6\%$, spread = 1.5%):

• Interest paid by Alice: $5,568 − $5,500 = $68
• Interest earned by lenders: $5,500 × 0.06 × 60/365 = $54.25
• Spread: $68 − $54.25 = $13.75

Spread distribution (from lending pot):

• Protocol: $13.75 × 0.40 = $5.50
• Collection cost pot: $13.75 × 0.30 = $4.13
• Insurance fund: $13.75 × 0.30 = $4.12

Check: $5.50 + $4.13 + $4.12 = $13.75 ✓

---

Worked example: FPJ-CB matched-term credit (Option B)

Same collection, different product—now with intent matching.

Setup

Collection: FP Journe Chronomètre Bleu (FPJ-CB)

Current market state:

• CLAMM mid: $5,000 (stable over past weeks)
• Long TWAP (24-hour): $4,950
• Recent mark-to-truth: $4,850
• $P_{\text{term}} = \min(4950, 4850) \times 0.80 = 3880$ (after 20% haircut for term uncertainty)

Credit vault policy (example vault):

• Assets: FPJ-CB only
• Terms: 6-month bucket
• Max LTV: 35%
• Min rate: 9% APY
• Underwriting: Believes physical watches will hold ≥$4,000 value at term (net of liquidation costs)

Bob submits a borrow intent

Bob wants to borrow against 3 FPJ-CB tokens for 6 months.

Step 1: Calculate max borrow at current $P_{\text{term}}$:

$$C_{\text{term}} = 3 \times 3880 = 11640$$ $$B_{\max} = 0.35 \times 11640 = 4074$$

Step 2: Bob submits intent:

• Asset: FPJ-CB
• Collateral: 3 tokens
• Term: 6 months
• Amount requested: $4,000
• Max rate willing to pay: 12% APY

Intent gets matched

The matching engine finds the credit vault (which requires min 9% APY).

Matched loan:

• Principal: $4,000
• Rate: 10% APY (market-cleared rate between 9% min and 12% max)
• Term: 6 months
• Collateral: 3 FPJ-CB tokens (locked)

Debt at maturity:

$$D_{\text{maturity}} = 4000 \times (1 + 0.10 \times 0.5) = 4200$$

Bob owes $4,200 in 6 months. During the 6 months, on-chain price fluctuations don't trigger any margin calls.

6 months later: decision time

Scenario A: Prices recovered

CLAMM price is now $5,500 per token. Bob's 3 tokens are worth $16,500.

Bob repays $4,200, gets 3 tokens back. Net: still owns $16,500 in tokens, spent $4,200 to borrow $4,000 (net cost: $200 interest).

Scenario B: Prices collapsed

CLAMM price is now $1,200 per token (black swan event, brand reputation collapsed). Bob's 3 tokens are worth $3,600.

Bob walks away. Keeps the $4,000 he borrowed. Protocol keeps 3 tokens worth $3,600 → loss of $4,200 - $3,600 = $600.

Shortfall coverage: Lending insurance fund covers the $600. If insurance fund is depleted, socialized among Option B lenders (not Option A).

Interest distribution

Bob paid $200 interest over 6 months. If lender rate is 8% APY:

• Lenders earn: $4,000 × 0.08 × 0.5 = $160
• Spread: $200 − $160 = $40

Spread distribution (lending pot):

• Protocol: $40 × 0.40 = $16
• Collection cost pot: $40 × 0.30 = $12
• Insurance fund: $40 × 0.30 = $12

Check: $16 + $12 + $12 = $40 ✓

---

Comparison to traditional asset-backed lending

How does this compare to real-world lending against watches, art, or other collectibles?

Feature	Rarity Protocol (Option A)	Rarity Protocol (Option B)	Traditional Asset-Based Loan
Pricing	Internal (TWAP + depth + MTT)	Internal at origination only (long TWAP/RWAP)	Appraisal (subjective, stale)
Rate discovery	Utilization curve (protocol)	Intent matching (market-set)	Negotiated (bilateral)
Collateral monitoring	Continuous (every block)	None (price only at origination + maturity)	Periodic (quarterly or on-demand)
Liquidation	Auction-first, CLAMM-secondary	Physical liquidation at term if default	Private sale or auction house
Interest rate	4–15% APY (utilization-based)	8–12% APY (matched intent, fixed)	High single-digit to low double-digit APY (typical, deal-dependent)
Term	Open-ended	3–12 months (fixed)	6–24 months (negotiated)
LTV	25–40%	30–40%	Roughly 30–50% (deal-dependent, varies by quality)
Transparency	On-chain, auditable (prices, fees, liquidations)	On-chain, auditable (matches, rates)	Opaque (private agreements)
Speed	Instant (approve + borrow in one transaction)	Instant (once matched)	Days to weeks (paperwork, appraisal)
Geographic restrictions	None (global, permissionless)	None	Yes (jurisdiction-specific)
Custody	Protocol custodian (Brinks, Malca-Amit)	Protocol custodian	Lender's vault or specialized facility
Default process	Automatic liquidation	Physical asset liquidation (custody → auction)	Legal action, repo, auction
Underwriting	On-chain price movements	Physical asset value at term	Appraisal + borrower creditworthiness
Total cost (typical)	~1.0–1.5% spread + 4–15% interest = 5–17% all-in	~1–2% spread + 8–12% interest (matched) = 9–14% all-in	10–20% interest + fees = 12–25%

Key advantages:

• Speed: Instant vs. weeks
• Transparency: All pricing and fees on-chain vs. opaque negotiations
• Global: Permissionless vs. geography-restricted
• Composability: Can use borrowed djinUSD in other DeFi protocols vs. siloed

Key trade-offs:

• Pricing risk: Relies on internal markets vs. professional appraisers (but appraisers are subjective and stale)
• Liquidation complexity: Need auction infrastructure vs. just sell to an auction house (but auction houses are slow and expensive)
• Custody: Still requires trusted custodians (same as traditional)

---

Implementation roadmap

V1: Option A (continuous credit)

Scope:

• Internal pricing ($P_{\text{twap}}$, $P_{\text{depth}}$, $P_{\text{mt}}$)
• Dynamic haircuts and utilization curves
• Liquidation auctions (sealed bid, 24–48 hour window)
• CLAMM safety gates and circuit breakers
• Mark-to-truth integration

Goal: Enable leverage and capital efficiency for DeFi-native users. Validate that internal pricing and liquidation machinery work reliably. Build the core infrastructure that all lending products will depend on.

V2: Option B (matched-term credit)

Scope:

• Intent-based matching system for lenders and borrowers
• Credit vaults with flexible lending policies (asset selection, terms, min rates, max LTV)
• $P_{\text{term}}$ calculation (long TWAP/RWAP for origination LTV)
• 3, 6, 12-month term buckets
• Market-discovered rates through intent matching
• Pure term (no mid-term liquidation) and slow-LLTV vault options

Implementation: Build on Morpho V2 infrastructure, adapted for RWA-specific requirements.

Goal: Provide credit fund and dealer-focused product where lenders underwrite physical value at term. Learn default rates, build liquidity for matched-term RWA credit markets.

V3: Floor-bid vault and advanced features

Scope:

• Floor-bid vault for liquidation backstop
• Cross-collection lending (borrow djinUSD against portfolio of multiple collections)
• Yield-bearing collateral (LP positions as collateral, earn LP fees + stable yield while borrowed)
• Automated amortization for yield-generating RWAs

Goal: Scale to handle $50M+ in loans, support sophisticated use cases, minimize liquidation impact on CLAMM.

---

Risks and mitigations

Reflexivity risk (Option A)

Risk: Liquidations push CLAMM price down → more liquidations → death spiral.

Mitigations:

• Conservative LTVs (25–40% instead of 80% like ETH lending)
• Liquidation waterfall (auction-first, not CLAMM-first)
• Circuit breakers (halt borrowing if volatility spikes)
• Floor-bid vault absorbs liquidation pressure
• Mark-to-truth provides discrete repricing instead of continuous cascade

Residual risk: Severe black swan (e.g., brand collapses, legal issues) could still cause cascades. Insurance fund + governance intervention as last resort.

Default risk (Option B)

Risk: Borrowers walk away at maturity, collateral is worth less than debt.

Mitigations:

• Conservative floors (20th percentile of historical auctions, not median)
• Low LTV (35% instead of 50%)
• Insurance fund covers shortfalls
• Non-recourse is priced in (fixed rates are higher to compensate)

Residual risk: If floors are systematically too high (governance misjudges long-term value), default rates exceed expectations. Insurance fund can be depleted. Governance can lower floors for new loans and increase insurance fund allocation.

Pricing risk (both options)

Risk: Internal pricing (our on-chain "oracle") is manipulated or systematically wrong.

Mitigations:

• TWAP smooths short-term manipulation
• $P_{\text{depth}}$ ensures prices are realizable at scale
• Mark-to-truth provides capital-based validation
• Multiple sources (min of three) prevents single-point failure
• Circuit breakers halt lending if pricing looks suspicious

Residual risk: Sophisticated attacker with deep pockets could manipulate all three sources simultaneously for short periods. Expensive to sustain. Governance can trigger emergency halt if detected.

Custody risk (both options)

Risk: Physical assets are stolen, damaged, or lost.

Mitigations:

• Professional custodians (Brinks, Malca-Amit, etc.)
• Insurance coverage for theft and damage
• Periodic audits (on-chain supply matches physical inventory)
• Diversified custody (multiple vaults for large collections)

Residual risk: Catastrophic custodian failure (e.g., vault fire, bankruptcy). Insurance should cover, but if insurance also fails, collateral is lost and loans become unsecured. This would be a protocol-wide crisis requiring governance intervention.

---

Related reading

Core mechanisms

• Fees & Yield Routing — How lending spread flows through the lending pot
• Mark-to-Truth Auctions — Capital-based price discovery for $P_{\text{mt}}$
• Spot Trading (CL AMM) — Where $P_{\text{twap}}$ and $P_{\text{depth}}$ come from
• Stablecoin — djinUSD as the lending unit

Integration points

• Minting — How new supply creation affects lending caps
• Collections — What defines a collection and how collateral eligibility is determined

Design rationale

• Pricing — Why TWAP/RWAP are manipulation-resistant but can't catch sustained mispricings

---

Summary: capital-based lending without oracles

Lending against illiquid, unique real-world assets is fundamentally different from lending against ETH. You can't use Chainlink. You can't liquidate instantly. You can't ignore reflexivity.

The Rarity approach is to derive all truth from capital deployed in the protocol's own markets:

• Internal pricing from TWAP (smoothed spot), depth (realizable prices), and mark-to-truth (validated by auction capital)
• Two products with different risk/UX profiles: continuous margin lending (Option A) for leverage seekers, term lending (Option B) for simple borrowing
• Backstop mechanisms (floor-bid vault, insurance fund, circuit breakers) that prevent reflexive cascades
• Integration with pots for transparent, verifiable fee distribution

The result: capital-efficient lending that doesn't depend on external oracles, doesn't blow up the CLAMM during liquidations, and offers predictable UX for both DeFi-native traders and traditional collectors.

Option A (margin lending) gives you leverage and capital efficiency at the cost of complexity and liquidation risk.

Option B (term loans) gives you simplicity and predictability at the cost of lower LTVs and fixed terms.

Both work because the protocol has multiple sources of capital-based truth (CLAMM, mark-to-truth, floor-bid vault) that cross-validate each other. No single source can be wrong for long without other sources catching it. And when all sources agree, you can lend with confidence—even against one-of-a-kind watches that have no Chainlink feed.

That's not just a lending product. That's infrastructure for capital markets on illiquid real-world assets.