Overview

The open capital network for outcome markets.

Market, risk, clearing, and capital-allocation infrastructure for outcome-linked assets, and for any short-maturity claim that resolves against a contractual source and pays out after the fact.

Prediction markets now move tens of billions of dollars a year, and credit against their positions has started to appear. But that credit lives in closed systems: internally approved markets, proprietary risk parameters, application-specific liquidity, and independent liquidation infrastructure. There is no shared standard to compare, fund, or clear outcome exposure against. CUSP builds the common system that fills that gap.

The Problem

A prediction-market claim can be bought, held, sold, or redeemed when the market resolves. Credit against it now exists in a few applications, but each one decides internally which markets it supports, how much credit it offers, and how unhealthy collateral is liquidated. There is still no shared standard an outside lender could underwrite against, no common liquidation venue built for how these assets actually behave, and no way to move exposure between systems.

This is unusual. Every comparable on-chain asset class picked up the same open apparatus within months of reaching scale: lending markets, money-market yield, a metadata standard, liquidation venues. Spot tokens did. Staked assets did. Liquidity positions did. Event contracts are years past that point and remain the exception.

The reason is not neglect. It is the collateral.

Why Event Collateral Is Different

Overcollateralized lending rests on a few quiet assumptions: prices move in steps small enough to react to, you can sell into the market when you need to, the borrower does not know more than you about the collateral, and a bad position still leaves something to recover. Event positions break all four.

• It jumps: a position lives between 0 and 1 and reprices in jumps, not drifts. A contract at 70 cents can settle to zero in a single block the moment a ruling, a count, or a print lands. No liquidation that reacts after the move can catch it.
• Liquidity leaves with the news: the event that moves the price is the same event that clears the order book, so depth is thinnest exactly when a lender needs to sell.
• The payoff is binary: the claim terminates at a fixed value. Collateral that looked well covered an hour earlier can settle to nothing, with no partial recovery to fall back on.
• The borrower may know more than you: whoever wants leverage against a specific outcome often has the sharpest read on that outcome. Adverse selection is baked into the demand.

Point a conventional lending market at collateral like this and you do not get a credit market. You get an insolvency machine with extra steps.

The Design Principle

For collateral that gaps and goes illiquid on the same news, a shortfall cannot be fixed after it appears. By the time anyone reacts, the position has settled and the book is gone.

Solvency has to be arranged in advance, not recovered later. That single constraint explains every choice CUSP makes:

• Mark collateral at what it would actually sell for, the worst of several prices under stress, never the last print on the screen.
• Take trade direction from the venue's own record, because public display feeds get it wrong on a large share of activity.
• Reprice credit from current market state at every rollover, instead of reading it off one utilization curve.
• Treat settlement advances as their own market type. A resolved claim carries no price risk and no informed counterparty, so it is priced differently from credit against a live position.
• Cap total credit by first-loss capital at launch, so senior depositors are protected by arithmetic while the track record is short, and grow only as fast as that record justifies.

The Network

CUSP is built as three core protocol layers plus one capital-allocation layer. Every layer reads from CUSP Risk; everything the network does is published through the transparency rail.

Market types live under CUSP Markets: standard credit lines, settlement advances against resolved claims, and maker facilities. The network's shared public record is documented in Calibration and Transparency.

Every market moves through the same lifecycle: a builder or curator creates it, CUSP Risk underwrites it and publishes its Outcome Risk Object, lenders or vaults allocate capital to it, borrowers draw against it, terms roll at fixed boundaries, CUSP Clear unwinds anything unhealthy, and settlement proceeds repay outstanding debt automatically.

Supported Structures

CUSP is not a binary-only system. The engine recognizes five payoff structures and changes treatment for each, because how a claim pays decides how it behaves as collateral.

These distinctions are not cosmetic. Letting a full set of outcomes cancel out can raise borrowing power on a balanced book many times over, compared with marking each claim on its own, and scalar claims earn better terms because they cannot suddenly collapse to zero.

The scope is wider than today's venues, too. The same machinery fits any short-maturity claim that resolves against a contractual source and pays out after the fact, and CUSP is built for that wider class of outcome-contingent assets, not for one contract shape on one kind of venue.

Core Mechanisms

CUSP Risk

CUSP Risk is the measurement and valuation layer. Its core rule: a position is never valued at the price shown on screen; it is valued at stressed recoverable value.

A YES position trading at 70 cents is not treated as a 70% truth about the world. It is a market price, and prices carry liquidity premia, stale books, favorite-longshot bias, and flow pressure. The engine asks a different question: what can this position recover under stress?

It marks collateral at the most pessimistic of a trailing authoritative average, the executable depth-walked exit price for full size, and a reliable cross-venue reference when one exists. The last trade is never used. It then applies four multiplicative haircuts for liquidity, toxicity, resolution-source risk, and route risk:

$$V_{\text{liq}} = Q \cdot P_{\text{depth}}(Q) \cdot H_{\text{liq}} \cdot H_{\text{tox}} \cdot H_{\text{res}} \cdot H_{\text{route}}$$

Worked example: a 10,000 YES position shows a 0.62 mid, a displayed value of $6,200. Walking the book for full size gives 0.595; haircuts of 0.85, 0.90, 0.95, and 0.90 take the stressed value to roughly $3,892. That gap is intentional. The engine marks what it can defend on an actual sale.

Markets that cannot support a defensible number are simply not supported: eligibility gates cover resolution proximity, disputes, depth, toxicity, route health, structure checks, data quality, and exposure caps. Treatment varies by payoff structure (see Supported Structures), and concentration caps prevent a collection of individually acceptable positions from becoming one correlated risk surface.

Outcome Risk Object

One published, versioned object carries everything an underwriter needs: identity, the eligibility verdict and its reason, the valuation the engine will defend, and the limits in force. A vault reads it to decide what to finance, a liquidator to price a lot, an outside lender to underwrite, a builder to integrate, none of them rebuilding the valuation themselves.

Three fields are enough to act safely: read the verdict, read the stress value, read the limits, and inherit the engine's gates by reference. Every value the object has ever carried is checked against the outcome that realized, and the full history is kept. The object is not asking to be trusted; it is offering a record to verify.

Settlement Advances

Between a market resolving and the venue paying out, a winning claim is decided but not yet paid: the value is certain, the cash is not there. A settlement advance closes that gap. Borrowers see it as Instant Redeem: CUSP pays for the resolved claim at a small discount now and collects face value at settlement:

$$\text{holder receives } (1-d)\,V \text{ now}, \qquad \text{annualized return} \approx \frac{N\,d}{1-d}$$

The discount stays small on purpose: the economics run on speed of capital reuse across many short cycles, not on the size of any single spread.

This is deliberately its own market type, not credit against a live position. The outcome is already known, so there is no price risk and no informed counterparty. The one remaining question is whether the venue pays, and measured failure rates are inflated conservatively before anything is priced. Late settlements are carried at face while the delay looks ordinary and written down smoothly as distress builds.

CUSP Vaults

Most depositors will not evaluate every market individually, so independent curators select eligible markets, cap exposure, and allocate vault capital across them. Vault capital splits into two tranches with a fixed order of seniority, and that order is the whole design. Losses move one way:

$$E_J' = \max(E_J - L,\ 0), \qquad E_S' = E_S - \max(L - E_J,\ 0)$$

Junior absorbs losses first and in full; senior is reduced only once junior is gone. Income runs the opposite way: senior's claim is met first, and junior keeps the levered residual, which is what pays it for standing in front. Idle balances earn a base money-market rate from the first block.

At launch, total credit is capped by junior capital:

$$\sum_i B_i \le E_J \quad \Longrightarrow \quad \text{senior capital cannot be impaired}$$

Even if every loan lost everything in the same moment, the loss could not reach senior depositors. No model is involved. A senior depositor's protection rests on a sum being smaller than another sum, and the protocol scales past this bound only as fast as its published calibration record supports.

CUSP Markets

Each CUSP Market is an isolated credit market with its own collateral asset, parameters, and liquidation route. Within a market, credit is written in short epochs. At each rollover CUSP Risk reprices the collateral from current market state, and the loan either continues on fresh terms or unwinds because the position no longer qualifies. Loan health uses the stressed value, never the displayed price:

$$\mathrm{HF} = \frac{\mathrm{LT} \cdot V_{\text{liq}}}{D}$$

Below 1, the loan is open to liquidation. Borrowing capacity is not constant across a position's life either: it is full while resolution is far off, decays inside a safety horizon,

$$\lambda(\mathrm{TTR}) = \lambda_{\text{base}} \cdot \min\!\left(1,\ \frac{\mathrm{TTR}}{T_{\text{safe}}}\right),$$

and the origination gate stops new credit entirely just before resolution. You cannot open a fresh loan the morning the market is about to decide, which is exactly the window where the collateral can gap to zero. Hard exposure caps bound total borrowing per market on top of all this.

The reason for the trouble: event-position risk is mild for most of the contract's life and then concentrates sharply into the moment of resolution. Repricing per state, per epoch, and pulling capacity before the event is what keeps the credit solvent through that concentration.

CUSP Clear

Liquidation is where most lending designs quietly fail on this collateral. A keeper bot is built to sell instantly into a continuous market, and event collateral denies it both halves: the book thins out exactly when a position needs clearing, and the bot has no view on the resolution, so whatever it misprices the protocol inherits.

CUSP Clear works down a ladder of exits from cheapest to most forceful, from repayment and offset up through venue execution, and clears what remains through descending-price auctions among bonded specialists:

1. The lot opens. When a health factor falls below 1, the position is offered with its full risk vector from the engine, so specialists price on real numbers.
2. The price descends. A clock opens at the conservative mark and falls toward a reserve covering debt, interest, fee, and a buffer:

$$\pi(\tau) = \max\bigl(\pi_{\text{res}},\ \pi_0 - \kappa\,\tau\bigr), \qquad \pi_{\text{res}} = D + I + f_{\text{liq}} + b$$

3. First acceptance settles atomically. Any surplus above debt and costs returns to the borrower, so liquidation takes what it must and nothing more.

The reserve is the part that protects the protocol: the clock never falls below the debt plus its costs. If no specialist clears a lot, a backstop ladder resolves it rather than leaving it open, and every auction, cleared or not, is written to the public liquidation log.

Calibration and Transparency

Every decision the network makes is published, and every published number can be checked against what actually happened: full score history next to realized outcomes, engine diagnostics, parameter changes with recorded reasons, and the complete liquidation log.

This is not reporting added after the fact. At launch, senior protection is arithmetic; past that bound, the protocol can only scale as fast as its calibration history justifies. The published record is the actual constraint on how big CUSP can get, which is why publishing a clean, honest record is the protocol's own growth incentive.

Who Uses CUSP

The Market

The numbers moved fast. Aggregate prediction-market volume ran around $3B in 2023, roughly $16B in 2024, and more than $60B in 2025, with early-2026 monthly volume pointing to an annual run rate several times higher again. Published sell-side projections put the sector near $1 trillion in annual volume by 2030.

Capital has tracked the volume. The two largest venues carry private valuations near $9B and $11B, and the operator of the New York Stock Exchange has committed up to $2B to the sector.

Volume at this level leaves a large standing inventory of open positions that does nothing but wait for resolution. The trading layer exists and is compounding; the capital network that should sit around it exists only in closed, disconnected pieces. CUSP is that network.

Security and Risk

CUSP manages risk. It does not pretend to remove it.

• Resolution risk: a market can resolve against a financed position faster than any reaction. Response: conservative valuation, capacity decay, and the origination gate, so nothing is freshly financed through the window where it can gap to zero.
• Liquidity risk: depth can vanish at the moment of clearing. Response: the conservative mark values collateral at what current bids would really pay, and liquidation runs through bonded specialists rather than bots selling into an empty book.
• Oracle and venue risk: CUSP depends on the venue's authoritative record and on it paying out. Inputs come from that record rather than display feeds, and settlement exposure is priced with conservatively inflated failure assumptions.
• Model risk: any valuation can be wrong. Response: the launch bound caps total credit by first-loss capital so senior protection is arithmetic while the record is short, and every score is published for anyone to check.
• Smart-contract risk: shared with every on-chain system; addressed through review and the public transparency record. Audits will be listed as they complete.

Resources

• Whitepaper: CUSP v4.1: the formal treatment, with models, bounds, mechanism analysis, and the reproducible simulation evidence layer.
• Documentation: the /docs pages: a high-level guide to each layer, including the glossary of every term used here.
• Contact: research@cusp.fi

Disclaimer

This document describes protocol design. Nothing here is investment, legal, or tax advice. Market figures are compiled from venue disclosures and public reporting; any forward number cited is a third-party projection, not a CUSP forecast.