The vault
PegVault is one contract per coin. It claims the creator fee, compares the coin's market capitalisation to the skin it tracks, and trades against the curve when the gap is wide enough to be worth paying for. Nothing else. It cannot be upgraded, paused or drained.
The target
The vault does not track a token price. It tracks a market capitalisation, because that is the quantity a constant-product curve actually determines and the one a trade can move predictably.
target = skinPrice × skinsPerSupplyskinPrice comes from the oracle with eight decimals; skinsPerSupply is the immutable multiplier chosen at deployment so the coin opens at peg. On chain the same line is a single mulDiv against the quote unit, which keeps the whole calculation in integers without an intermediate that can overflow.
The band
Below 1.5% of drift the vault stands down. This is not caution, it is arithmetic: closing a small gap on a constant-product curve costs roughly half the gap in reserves, and the fee paid on that trade is itself a cost. Defending a 0.3% deviation burns money to achieve nothing, and the war chest is the one resource the coin cannot replace on demand.
| Parameter | Value | Meaning |
|---|---|---|
| Band | 150 bps | Gap below which nothing happens |
| Max spend | 5,000 bps | Share of the war chest any single order may use |
| Oracle decimals | 8 | Precision of the reference price |
| Staleness | Enforced by the oracle | A stale price makes defend() revert |
Sizing the order
Price on a constant-product curve is the ratio of the two reserves, and their product is invariant. Reaching a target price therefore means moving the quote reserve to vQ·√(p*/p), and the cost is the difference:
vQ* = √(p* · vQ · vT)
cost = |vQ* − vQ|One consequence is worth internalising, because it is the reason this whole design is modest rather than confident: closing a 10% gap costs about 5% of the reserves. Not 10%, but not a rounding error either.
Why the defence is symmetric
A vault that only ever holds quote currency can defend in one direction. When the coin trades rich it has nothing to sell — the gap covertskins admits to in its own documentation. Seeding the vault with token inventory at launch closes it, so the vault can push in both directions from the first block.
The post-condition
After any trade the vault re-reads the reserves and requires that the new gap is strictly smaller than the old one. If it is not, the transaction reverts and nothing was spent.
A bug this caught
The first version ran that check unconditionally, including on the path where the vault decided not to trade at all. A legitimate no-op reverted. The fix was to have the defence helpers return whether they traded, and to only assert the post-condition when they did — which is the difference between a safety check and a liveness bug.
What the money can actually do
The simulator below is a port of the contract, checked against the Foundry suite, so it cannot show a number the chain would contradict. Drag the war chest down to see the normal state of a thinly traded coin.
The war chest fills at 0.70% of traded volume. Drag it down and watch coverage collapse — the normal state of a thinly traded coin.
143× the cost of the correction. That ratio is the structural limit of the model and it applies to everyone, us included — a coin without volume has nothing to defend itself with, and no contract changes that.
The next page takes the worst case seriously rather than leaving it to a slider.
What it cannot do
- Be withdrawn from. There is no function, so there is no key that unlocks one.
- Be repointed.
setCurve()reverts on a second call. - Trade on a stale or flagged price. The oracle refuses and the call reverts.
- Spend more than half the war chest on one order, however large the gap.
Snapshot data last refreshed Sep 23, 2026 UTC.