Each pool is an ERC-4626 vault with one extra rule: it knows exactly which of its tokens are spoken for.

The pool checks after every action that its token balance covers the four buckets. If it ever did not, the pool would refuse to move tokens rather than pay from the wrong bucket.

Share value is the pool's economic value divided by the number of shares:

1value = token balance − funded claims − expected payout of open positions

Funded claims belong to winners, so they are subtracted. Open positions are marked at their current expected payout using the same volatility model that priced them, so the share value moves with the market before settlement makes it final.

The expected payout is computed as a range rather than a point, because fixed-point arithmetic rounds. Deposits use the low end of the range, so a new depositor cannot be given too many shares. Withdrawals use the high end, so a departing depositor cannot take too much. The difference is small and always in favour of the depositors who stay.

Every pool also holds a small permanently locked seed deposit, made at deployment, which defends the share price against manipulation by the first depositor.

Premium enters the unearned bucket at open and moves to idle at a constant rate until the position's settlement hour. The pool keeps a single aggregate rate and a schedule of rate decreases at each settlement hour, so accruing to the present is one calculation however many positions are open. Every deposit, withdrawal, and open brings accrual up to date first.

For a long, the reserve is the most the capped payoff can pay in the market's asset. For a short, it is the most the put can pay in USDC.

For every position at the settlement hour, the winning payout moves from reserved to funded claims and the remainder returns to idle. From that moment the pool's available balance is up, its utilisation is down, and the winners' money is in a bucket nobody else can reach.

A pause stops new risk and nothing else. A wind-down is permanent: no new positions and no new deposits, while everything already open settles and every depositor withdraws as collateral frees.

In any mode, if the pool cannot value its open positions because the price feed is unsafe, deposits and withdrawals wait until it can. Settlement does not depend on the live feed and continues.

A pool can hold a bounded number of distinct series, where a series is one direction, strike, and settlement hour, and a smaller bounded number at any one settlement hour. The two limits bound the work a settlement transaction can ever have to do. A new position that would need a new series past the limit is refused with This direction is at capacity; one that joins an existing series is not.