Fully collateralised calls and puts on Stock Tokens.

5.1 Purpose

Two positions are offered per series. A long call is the right, not the obligation, to buy the Stock Token at the strike during the exercise window. A long put is the right to sell it at the strike. In both cases the most a holder can lose is what they paid for the claim: the premium. There is no margin, no mark-to-market, no liquidation and no assignment. If the holder does nothing, the claim simply expires.

Every long claim exists only because a writer escrowed the full obligation up front. A call writer deposits the exact amount of Stock Token that exercise would deliver; a put writer deposits the exact strike value in the settlement asset. The series contract cannot become undercollateralised, and every state-changing call re-checks that its token balances still cover its accounted pools before proceeding.

5.2 Series definition

StockOptionFactory.createSeries() is permissionless. Any account may deploy any previously unused parameter set; the parameters are hashed into a CREATE2 salt, so each parameter set has exactly one canonical address, computable in advance with predictSeries(). The factory records isSeries[address] = true, which the quote book and router use to reject impostor series.

Collateral and pools

collateralFor(amount) returns the escrow for a lot-aligned amount: for a call it is amount of the underlying; for a put it is (amount / lotSize) × strikePerLot of the settlement asset, where strikePerLot = strikeWad × lotSize / 1e18. The series keeps two counters, underlyingPool and settlementPool, and every transfer in or out is balance-checked on both sides (_pullExact, _pushExact) so a fee-on-transfer or blocked Stock Token transfer reverts rather than silently under-delivering.

After exerciseEnd the pools hold a mix: unexercised collateral plus whatever exercise paid in. redeemShort() pays each short its pro-rata share of both pools; the final redeemer receives the exact remainder. Exercise is not subject to the eligibility policy, and burns are never gated, so an address later marked ineligible can always exit.

5.3 Quote book

OptionQuoteBook is permissionless settlement for maker-signed offers to sell long claims. A maker who already holds long tokens (from writing, or from buying) signs a Quote offchain; any buyer can fill it onchain, in whole or in parts, until the deadline, the lot cap or a cancellation stops it. The contract never custodies anything: premium moves buyer → maker and long tokens move maker → receiver in the same call.

fill(quote, lots, receiver, signature) checks, in order: non-zero receiver that is neither the maker nor the book; non-zero lots; deadline; nonce floor; digest not cancelled; signature; series has code and is registered; premium token has code; series terms (non-zero lotSize, exercise not ended, long token backlink, series solvency); fill cap. It then reserves the fill, transfers lots × premiumPerLot from msg.sender to the maker and lots × lotSize long tokens from the maker to the receiver, verifying exact balance deltas on both legs. Any failure reverts the whole fill, including the reservation.

5.4 Atomic router

AtomicStockOptionRouter buys spot and option together. The caller sends ETH equal to spotAmountIn + premium; the router wraps the premium, fills the quote through the book, then swaps the spot input through a Router02-compatible swap router. Both legs land in one transaction or neither does. The contract holds no custody and has no administration surface: it is bound at construction to one swap router, one WETH, one Stock Token, one quote book, one series factory, one pool fee and the chain ID it was deployed on.

Before spending anything the router checks: current chain equals deploymentChainId; receiver is non-zero and not the router; spot input, minimum stock out and option lots are non-zero; sqrtPriceLimitX96 is zero; transaction and quote deadlines have not passed; the quote's premium token is WETH; the quote's series is registered with the factory and has code; the series' underlying is the bound Stock Token and its settlement asset is WETH. It then computes the premium via quoteBook.premiumFor and requires msg.value to equal it plus the spot input exactly.

The spot leg goes through exactInputSingle with tokenIn = WETH, tokenOut = stockToken, the bound fee tier, and the caller's minimumStockOut. The router verifies the swap router's native balance did not change, that the receiver's Stock Token balance rose by at least the minimum, and that the reported output equals the observed delta. The struct passed in is PairParams { spotAmountIn, minimumStockOut, sqrtPriceLimitX96, transactionDeadline, quote, optionLots, receiver }.

5.5 Payoff at expiry

Because the long claim is a right with no further obligation, its P&L at expiry is bounded below by the premium. The break-even is the strike plus the premium for a call, the strike minus the premium for a put. Upside for a call is uncapped; upside for a put is capped at strike minus premium, reached only if the Stock Token goes to zero.

The short side is the mirror: it keeps the premium if the claim expires out of the money and otherwise delivers the escrowed asset at the strike. Its loss is bounded by the collateral it already posted, which is why no liquidation path exists.

5.6 Treasury writer

ProtocolOptionTreasury is an owner-operated (Ownable2Step) vault that writes protocol-owned options and accumulates Stock Tokens. It is the one contract in the stack with an administrator.

Because the treasury receives both claim legs, writing does not by itself create a market position; the treasury becomes a maker by signing quotes on the long tokens it holds, or it closes the pair. The treasury and the token-launch plan that would fund it are not deployed; see $SYIELD token & fees.

5.7 Current status

What the Pair Lab does today is arithmetic: it takes a Stock Token entry price, a strike and a premium the user types, and draws the modeled P&L of the pair against a stock-only benchmark, labelling the floor Modeled max loss. It signs nothing, approves nothing and submits nothing. Any figure it shows is a scenario, not a quote, and no series exists to fill one.

5.8 Risks

• Not deployed. Everything above describes source that has only been exercised locally. Behaviour on chain, gas, and interaction with the live Stock Tokens have not been observed in production.
• Voluntary exercise. There is no oracle and no auto-exercise. A long holder who misses [expiry, exerciseEnd) forfeits an in-the-money claim; its collateral is redeemed by the shorts.
• Issuer controls. The underlying is an issuer-controlled Stock Token that can be paused, blocked, burned or upgraded. A blocked transfer makes write, close, exercise and redeemShort revert through the exact-transfer checks; escrowed collateral stays in the series until transfers succeed again.
• Eligibility. Writing and every non-burn claim transfer are gated by an IEligibilityPolicy chosen at series creation. If it is an owner-managed policy, the owner decides who can enter; exits (burns) are never gated.
• Mixed pools at settlement. Shorts redeem a pro-rata share of both the underlying and settlement pools, so a short's payout is a blend of unexercised collateral and paid-in strike, not a fixed asset.
• Maker signatures. A signed quote is live until it expires, is cancelled, or the maker raises the nonce floor. A maker who loses key control must call invalidateNoncesBefore from that key.
• Treasury owner. The treasury writer is owner-operated; its owner can direct collateral into series, buy spot, and route WETH to the distributor it sets.
• Native only. The router accepts only ETH value and only series settled in WETH on the Stock Token it was bound to; other pairs need another router deployment.