Why nobody gets liquidated
Margined venues stay solvent with a price feed and a liquidation engine. Split has neither in its collateral path. Every position is funded for its maximum payout before it exists.
Buyer
Max loss is the premium, paid up front. No maintenance margin, no liquidation price. A wick through your strike and back does nothing.
Writer
The writer posts the full maximum payout:
| Mode | Locked per contract |
|---|---|
| Cash-settled band | The width W, in USDG |
| Physical call | One underlying token |
| Physical put | The strike, in stablecoin |
The worst case for the writer is paying that out. It is a loss, not a liquidation, and it can't exceed what is already locked.
Where liquidation can come back
A writer that delta-hedges on perps can be liquidated on the hedge. Split's pools do not hedge on perps.
Compared
| Split | Margined options and perps | Perp-hedged option vaults | |
|---|---|---|---|
| Solvency | Collateral posted up front | Price feed and liquidator | Collateral plus perp hedge |
| Buyer downside | Premium | Margin | Premium |
| Writer downside | Locked collateral | Margin, liquidatable | Liquidatable hedge, funding |
| Price feed in collateral | No | Yes | Yes |
| Failure mode | Pool stops selling when full | Bad debt in a gap | Hedge loss, funding bleed |
The cost is capital: one dollar of writer collateral backs at most one dollar of payout.
Proof
For the physical vaults, "the pool cannot pay out more than it holds" is proved in Lean 4. For the cash-settled pools it follows from construction (Up + Down = W, and W is locked at sale) and is checked by an invariant test suite. See Verification.