One position, one margin,
both sides funded before the fill.

3.1 Purpose

A basket trade — long one set of assets against another — normally means several perpetual positions, several funding rates and several liquidation prices. The desk collapses that into one contract call: a basket is a list of up to ten legs with signed weights, and a position is one direction, one notional, one margin and one funding rate against that basket.

Prices come from public oracle prints. Notional and margin are WETH; leg prices are USD. P&L is quanto: the position pays the basket's percentage return multiplied by the WETH notional, with no FX conversion.

The contract has no owner. The feed allow-list is fixed in the constructor, basket definitions are permissionless, and every state transition is callable by its rightful party — the trader, or, for oracle-dependent steps, anyone willing to submit the print and collect a bounty.

3.2 Position model

Baskets

A basket is an ordered array of Leg { bytes32 id; int16 weightBps; uint8 source }. source is 0 for a Chainlink aggregator (the id is the feed address) or 1 for a Pyth price ID. Validation in BasketIndex.validateLegs requires:

• 1 to 10 legs, sorted by source then id, no zero weights.
• Absolute weights sum to exactly 10_000 bps. Negative weights are short legs; +5000 NVDA / −5000 AAPL is a valid pair.
• Every Chainlink feed reports 8 decimals; every feed or price ID is on the desk's allow-list.

The basket id is keccak256(abi.encode(legs)), so the same recipe has one id regardless of who defines it. defineBasket is permissionless and idempotent.

Positions

open(id, direction, notional, margin, capMultipleWad, receiver) takes a direction of +1 or −1 — which flips the whole basket — and three WETH figures:

Basket return is the weighted sum of per-leg percentage moves from the fill prices: Σ weightBps_i / 10_000 × (price_i − base_i) / base_i. Position P&L is direction × notional × return. Equity is margin + pnl − funding, floored at zero and capped at margin + cap.

3.3 Pre-funding: why nothing is liquidated

A liquidation engine exists to stop a position's loss from exceeding the collateral behind it. The desk removes the need by bounding both sides at open and holding the bound in WETH before the fill:

• The trader's maximum loss is the margin, transferred in by open(). Equity is floored at zero; a position can never owe the desk.
• The desk's maximum loss is the cap. open() adds cap to reserved, and reserved capital cannot be withdrawn by sDESK holders.

Because margin + cap is on the desk's balance sheet from the moment the request is made, the position can always be paid at any price. When the mark crosses a bound, anyone calls settle() and the position closes at that bound.

Three desk-level limits, checked only at open, keep any single position and the aggregate reserve small relative to equity: notional at most 10 % of desk equity, cap at most 10 % of desk equity, and total reserved at most 50 % of desk equity.

3.4 Execution: fills at the next oracle print

No transaction in the desk is priced at the print that is already on chain. A request records where the oracles stand, and the fill uses the first print that arrives afterwards. This removes the ability to open or close against a stale mark.

• Chainlink legs. open() and close() store latestRoundData().roundId for each feed. The fill reads round pinned + 1 and requires its updatedAt ≥ requestedAt; if the feed has rolled to a new phase, round 1 of the current phase is used instead. A round with a non-positive answer or answeredInRound < roundId is rejected.
• Pyth legs. The fill time is T = max(requestedAt + 5 s, latest Chainlink updatedAt among the legs). The caller supplies signed Pyth updates whose publishTime lies in [T, T + 10 s]; the desk pays the Pyth update fee from msg.value and refunds the excess. Confidence must be at most 2 % of price.

When the print never comes

• cancelOpen() — the owner may withdraw a pending open 3 days after the request. Refund is margin − funding accrued; the open fee is not returned.
• voidOpen() / reopen() — if no valid print lands within the Pyth window, anyone may void a pending open or return a pending close to OPEN once T + 10 s + 24 h has passed.
• abandon() — if a Chainlink leg has not updated for 30 days (or the feed reverts), anyone may abandon the position for margin − funding. If the basket has a Pyth leg, the owner may abandon 180 days after open regardless.

3.5 Funding and fees

Fees

If a position ends by settle(), cancelOpen(), voidOpen() or abandon(), the unpaid keeper share of the open fee is released to desk equity rather than paid out. No close fee is charged on a settled position.

Funding

Each position is quoted a funding rate at open() and keeps it for life. The rate is stored as bps/day × 10⁴; in bps per day:

rate = 2 + 10 × utilization + 3 × (capMultiple − 1)

utilization = reserved / deskEquity      (0 … 0.5 at open)
capMultiple = cap / margin               (1 … 3)

A 1× cap on an idle desk pays 2 bps/day; a 3× cap on a desk at the 50 % reserve limit pays 13 bps/day. Funding accrues continuously from requestedAt — including while a request is pending — as ceil(notional × rate × elapsed / 864e10), and is deducted from equity at every valuation, close, settle and refund.

3.6 Oracle sources

The desk accepts two kinds of feed, allow-listed at deployment: 45 Chainlink aggregators and 30 Pyth price IDs. Four assets (BTC, ETH, LINK, ENA) appear in both lists, giving 71 unique assets. The interface lists 65 of them; six wrapped-BTC and staked-ETH variants remain resolvable for existing baskets but are not offered in the composer.

Chainlink prices are scaled from 8 to 18 decimals; Pyth prices are scaled from their exponent to 18 decimals. Every stale, non-positive or malformed answer reverts the call — a position is never marked against a print the contract cannot trust.

3.7 The sDESK vault

The desk is itself an ERC-20: StockYield Basket Desk, symbol sDESK. Depositing WETH mints shares; shares are the claim on desk equity, which is the WETH balance net of trader margin and unpaid keeper bounties. The desk's own accounting splits its balance as follows.

sDESK holders are the counterparty to every basket. They earn fees and funding, and they pay the cap on positions that finish in profit. Because MAX_RESERVED_BPS limits total reserve to half of equity at open, at least half of desk equity is always outside any live position's reach.

3.8 Risks

• Oracle dependence. Every fill, mark and settlement is a Chainlink round or a Pyth update. A wrong print that passes the freshness and confidence gates is a valid print to the contract. A feed that stops updating stalls fills until the dead-feed exit (30 days) or the Pyth exit (180 days).
• Capped, quanto exposure. A position is not a perpetual. Profit stops at the cap, loss stops at the margin, and P&L is percentage return on a WETH notional rather than a USD-denominated claim. Both ends are settleable by third parties the moment they are crossed.
• Funding while pending. Funding runs from the request, not the fill. A request placed before a long market closure pays funding for the closure.
• Depositor risk. sDESK equity falls when traders win. Reserve is capped at 50 % of equity at open, but a run of capped wins on many positions can consume that half. Withdrawals are limited to free capital and gated by the 24-hour lock.
• Immutability. There is no admin to pause a bad feed, extend a window or refund a mistake. The recovery paths above — cancel, void, reopen, abandon — are the only ones.
• Collateral is WETH. Positions do not touch Stock Tokens; issuer controls on Stock Tokens do not affect the desk. Positions are exposed to WETH's own value against USD, since notional and margin are denominated in it.

3.9 Key parameters