Everything that can go wrong

The keeper writes the call and lists it. If nobody lifts the offer before the book closes on Friday, the week's premium is zero and the vault's unsold options are worthless after Saturday expiry. If nothing is assigned to the vault either, the collateral comes back when the week closes. This is the most likely outcome on a thin book, and the order book for weekly calls on a tokenised stock is thin.

Costs you: the week's premium, which is zero, and the time. The protocol fee is a share of the premium harvested, so an unfilled week also collects no fee. An unsold listing does not protect the collateral from assignment: see the next entry.

What the system does. Nothing, and there is nothing to do. An empty book is a market fact, not an error state, so it is published as a row reading "unfilled, 0" alongside the weeks that filled. The one thing that is defended is visibility: if Overcall's listings API rejects the order, the signed Seaport payload is published in the app so a buyer can fill it directly. An invisible listing is an unfilled week.

The option the vault writes is not private to it. It is one of the NVDA option series Overcall registers for the week, and anyone else who writes that option writes into the same series. Valorem assigns exercises across all writers of a series, by bucket, not to whoever sold the exercised call. So if buyers of calls that other writers sold exercise, part or all of the vault's position can be assigned even though its own listing never filled.

Costs you: both at once. The week's premium is zero, and the assigned tokens leave at the strike. The vault receives the strike in USDG, credited to depositors with no fee, and the upside above the strike is gone for that week. v1 does not buy the tokens back.

What the system does. Nothing. The vault cannot choose which writers Valorem assigns, and holding its own unsold options does not shield its collateral; those options are worthless after expiry. When the week closes the vault redeems its claim and gets back whatever collateral was not assigned, plus the strike USDG for what was. Deposits stay closed while assignment proceeds sit unredeemed in the claim, so nobody can buy shares into that gap.

Anyone holding a call of the series the vault wrote may exercise it inside the exercise window, and Valorem can assign that exercise to the vault whether or not the call was bought from the vault. Valorem takes the collateral at the strike and leaves the strike proceeds in USDG, which are credited to depositors in full: the protocol fee is charged on premium, never on them. The strike is the nearest Overcall rung inside a 3–12% out-of-the-money band, so it takes a move, but not an enormous one.

Costs you: every cent of upside above the strike for that week, and the position itself. The vault can end the week underweight NVDA, holding USDG where it used to hold tokens. If NVDA gaps up and keeps going, you sold the move for a week's premium.

What the system does. v1 does not buy the token back. That is v2, and it is not in the v1 contracts — an automated market buy is its own risk, and shipping one badly is worse than holding USDG. The vault does defend the accounting around assignment: deposits close at the cycle's exercise timestamp, whether or not the keeper is alive, so nobody can mint shares into a position whose collateral has already left.

Valorem assigns by bucket, not perfectly pro rata. The vault can be assigned on some of the contracts it wrote and not on others, so the usual outcome of an exercised week is a mixture rather than a clean swap.

Costs you: predictability. A redemption is never a promise of a fixed number of tokens — part of what comes back can be USDG at the strike, and the split is not known until the week closes.

What the system does. Nothing. Which contracts get assigned is the clearinghouse's decision, not the vault's, and there is no call that makes it fairer. The vault pools the result: every depositor gets the same blend, nobody is singled out for the assigned half.

Stock Tokens are debt securities issued by Robinhood Assets (Jersey) Limited. Not shares: no vote, no claim on the underlying company, and issuer credit risk on that entity. The issuer can freeze or restrict transfers and can upgrade the token proxy; the token can pause its own price oracle. The two are different. A freeze can stop anything that moves the token: writing a call, closing the week with rollClose, deposits, and redemptions that pay out tokens. An oracle pause stops the vault writing and listing new calls, and nothing else; settlement never reads the oracle, so an open week still closes.

Costs you: in the mild case, weeks of nothing: no new calls under either event, and under a freeze an open week that cannot close and redemptions that cannot pay out tokens until it lifts. In the severe case, the instrument itself — if the issuer fails, the token does not survive independently of it. See the legal page for the full legal form.

What the system does. There is no technical mitigation, and pretending otherwise would be the dishonest part. That is the asset: a Stock Token is a claim on its issuer. What the contracts do ensure is that a freeze never traps you procedurally — queueing a redemption and claiming USDG keep working while token transfers are stopped, and the vault refuses to write against a paused oracle rather than writing blind.

Valorem Clear can charge 15 bps of notional, levied on top of the collateral. It is off at Overcall launch, and the switch belongs to a third party. On a weekly out-of-the-money call that number is not small change: the policy floor for a listing is 0.40% of spot, so 15 bps of notional can be a large share of a good week and more than the whole of a thin one.

Costs you: nothing directly, because the vault refuses to write. The cost is weeks of zero until governance decides whether the fee is worth paying.

What the system does. The vault stops writing rather than writing at a loss. While the engine reports fees enabled and governance has not explicitly accepted them, opening a week reverts. Turning that acceptance on is an Admin Safe decision, taken in the open, not something a keeper can do on a Friday afternoon.

Robinhood Chain runs a centralised sequencer with no uptime feed, and an outage surfaces here as a stale price. Overcall's listings API is a third-party service that can reject or drop an order. Either one, in the hours before the book closes, means there is no live listing when buyers are looking.

Costs you: the week's premium. Same outcome as no buyer, arrived at for an operational reason instead of an economic one.

What the system does. The keeper retries with backoff, and refuses to write at all if it cannot list — a written call with no listing is all of the risk and none of the premium, which is strictly worse than doing nothing. A stale oracle reading blocks writes for the same reason. Both failures resolve to a skipped week, which is the safe direction.

The Callhouse contracts have not been audited. An internal adversarial review across thirteen surfaces raised 72 findings, of which 51 survived refutation; all of those are fixed and carry regression tests. That is a review by the people who wrote the code. It is not an audit, and it does not substitute for one.

Valorem Clear was audited by Zellic in 2022–2023 under its former name, OptionSettlementEngine. That audit covers Valorem. It says nothing about this vault. Seaport, USDG and the Stock Token are third-party code with their own upgrade keys, outside anyone's control here.

Costs you: in the worst case, all of it.

What the system does. The deposit cap is the real statement of confidence: 20 NVDA at launch, not an open door, and only the Admin Safe can raise it. There is no proxy and no upgrade key, so a bug means a v2 and a migration announced in advance rather than a silent patch. An external audit is on the plan and has not happened.

The keeper is one hot key running a weekly state machine against a third-party cycle. It can crash, run out of gas money, or be looking the wrong way when the window opens.

Costs you: a skipped week if it dies before the write. Nothing, beyond delay, if it dies after.

What the system does. A dead keeper cannot strand collateral past the week. The keeper can close the week from expiry, and closing becomes permissionless one hour after expiry, so anyone can redeem the claim, settle the queue and release the collateral. The Guardian cannot close a week; it can only halt writes and cancel or invalidate listings. Halting writes never blocks a redemption, a USDG claim, or the close of a week — it blocks writing new calls and authorising new listings, nothing else.

Assume the keeper key is stolen outright. The attacker can propose a strike, a size and an order, and can cancel listings. Every one of those goes through a contract that checks the proposal before acting on it.

Costs you: a wasted week and some gas. A fully compromised keeper cannot take a token out of the vault.

What the system does. No off-chain component can move money. The vault is the Valorem writer and the Seaport offerer, it authorises each listing by hash on chain, and it re-validates every field the keeper proposes against caps compiled into the bytecode: the out-of-the-money band, the premium floor, the utilization ceiling, the contract cap, and a 21-day ceiling on cycle length. The Admin Safe can move those knobs inside the caps and never outside them.

The Admin Safe sets policy within the compiled caps: the out-of-the-money band, the premium floor, the utilization ceiling, the protocol fee, the deposit cap, the fee recipient, and whether the Valorem engine fee is accepted. The Guardian can halt writes and invalidate listings, and can do nothing else.

Costs you: a band set too tight means weeks where no rung qualifies and the vault simply holds spot. A band set too loose means assignment becomes routine. Both are legal moves inside the caps.

What the system does. The bounds are enforced on chain, which rules out the worst version — nobody can quietly sell at the money, set the protocol fee above 20% of premium, or take a fee from strike proceeds. It does not rule out bad settings inside them, and there is no timelock in v1. You are trusting the judgment of a named 2-of-3 multisig, and the deposit cap is the honest size of that trust.

A redemption settles instantly only while the vault is flat, meaning idle with nothing written. Once a call is open the collateral is locked in Valorem until expiry, so an exit started mid-week completes after the week closes on Saturday, not before.

Costs you: the option to leave at a moment of your choosing. cNVDA is not listed anywhere, so there is no secondary market to sell into instead, and what the queue returns is a mix of collateral and USDG rather than a fixed token count.

What the system does. The queue is the mechanism, not a discretionary gate: shares are escrowed and tagged with an epoch, the epoch settles when the week closes, and you draw a pro-rata share of the collateral plus the USDG your own queued shares earned. No Callhouse key can jump the queue or stop it — the close is permissionless an hour after expiry — though a Stock Token issuer freeze can hold up the close until it lifts. Deposits close at the cycle's exercise timestamp for the same structural reason.

Plenty of products make an empty week look survivable by paying it in their own token. This one has no token to pay with. Depositors keep the net premium after Overcall's cut and the stated protocol fee, and that is the entire return path.

Costs you: the cushion. There is no emission to offset an assigned week, and no airdrop to compensate for a run of empty ones.

What the system does. Nothing, deliberately. There is no protocol token, no points programme and no airdrop at launch, so there is no emission quietly topping up a week that earned nothing. A zero week is displayed as zero because there is nothing available to paper over it.