Revenue pool
The staging balance that holds the insurance fund's cut of protocol income until it settles, what flows into it, and the two things that can draw it down.
Every spot market carries a revenue pool, a claim against that market's vault. It holds the insurance fund's share of protocol income until a capped, timed settlement moves it into the insurance fund vault. It is not where the protocol's own share of fees lands, and it is not a general-purpose treasury.
Why income is staged rather than swept
Sending the insurance fund its cut the moment it is taken fails on three counts. Interest accrues on nearly every spot instruction, so it would attach a token movement to almost every deposit, withdrawal, borrow, and repayment. Those tokens back lender withdrawals, so pulling them out at an arbitrary moment competes with a depositor trying to exit. And the fund is share-priced, so a large inflow arriving in one block accrues entirely to whoever happened to be staked in that block.
Staging fixes all three. The cut is booked as a claim inside the same vault, no tokens move, and a permissionless instruction settles a bounded amount on a timer. Value earned but not yet settled is still there, counted as the market's rather than the fund's.
What flows in
Four things credit the revenue pool.
The insurance fund's carveout from lending. This is taken from the deposit-interest gain, the amount lenders would otherwise have received, not from the interest borrowers pay. Each interval's deposit interest is divided three ways: a share to the revenue pool, a share to the protocol's own pool, and the remainder to lenders. Borrowers pay the same amount either way.
The carveout does not come out of borrow interest. Both cuts apply to deposit interest and by construction sum to no more than the gain, so the lender share can never go negative.
The insurance fund's cut of perpetual trading fees. This does not arrive at fill time. The fee split books it as a pending counter on the market, and a later sweep moves it into the quote spot market's revenue pool. Both split numerators are admin-set per market, and while the insurance share is zero this source contributes nothing. See Trading fees.
The insurance fund's cut of liquidations. Perp and spot liquidations both take an insurance fund liquidation fee from the liquidatee and credit it to the liability market's revenue pool, alongside a protocol liquidation fee that goes to the protocol pool. See Liquidations.
Direct deposits. Anyone can send tokens straight into a market's revenue pool, so the protocol or a third party can recapitalize a market's insurance backing without going through the fee machinery.
Where protocol fees go: revenue pool versus protocol fee pool
What flows out
Only two things draw the pool down, and neither is a perpetual market top-up.
Settlement to the insurance fund vault. Settlement is permissionless and runs on a timer, which markets are created with at 3,600 seconds. Every dollar that lands accrues to stakers as share-price appreciation; there are no protocol-owned shares and no administrative withdrawal from the vault.
Spot bankruptcy resolution. When a bad borrow is written off, the revenue pool is the first tranche consumed, before the staker-owned vault and before any socialized loss. Unlike the periodic settlement, this draw is neither timer-gated nor rate-capped. In a bankruptcy the pool is first-loss capital. See Liquidation and bankruptcy.
There is no path from the revenue pool to a perpetual market's AMM, and the protocol does not draw on the revenue pool to cover funding shortfalls. The only draw that tops a perpetual market up takes tokens from the insurance fund vault and credits the market's P&L pool, and it covers a P&L deficit, not funding.
The settlement cap
A settlement is bounded three times over, and the binding constraint in ordinary conditions is usually the third.
- Free liquidity. If the revenue pool is larger than the market's free liquidity, meaning deposits minus borrows, the settlement is capped at half of that free liquidity, so a highly utilized market does not settle revenue out from under a lender trying to withdraw.
- One tenth per call. When the fund has stakers, no more than one tenth of the revenue pool may settle in a single call.
- 1,000% annualized. Pro-rated to the settle period and applied to the smaller of the live vault balance and the lowest balance the vault held since the last settlement, so nobody can transfer tokens in immediately before a settlement to lift the ceiling.
On an hourly period, a pool holding $40,000 against a vault that has held $1,000,000 all period is capped at the lesser of $4,000 and $1,141, so $1,141 moves. A pool that accumulates faster than the fund it feeds trickles in over many periods rather than arriving at once.
When the fund has no stakers, both the one-tenth and the rate caps are skipped entirely. The free-liquidity check still applies, and so does the timer.
The perpetual market's insurance claim
Each perpetual market carries limits on how much it may ever draw from the insurance fund to cover a P&L deficit.
| Limit | What it bounds |
|---|---|
| Per-period withdrawal | The maximum insurance fund draw in one settle period, and how much of it this period has used |
| Lifetime ceiling | The total insurance this market may ever draw, and how much is already spent |
| Unrealized P&L imbalance | The net user P&L the market may carry before a draw is permitted at all, and above which positive unrealized P&L is discounted for initial margin |
A draw requires all of these to line up: the AMM must be underwater, the P&L pool must be smaller than net user P&L, net unsettled P&L must exceed the imbalance limit, and both ceilings must have room. What moves is the smallest of those bounds. The lifetime ceiling is set by the market's contract tier, and for Speculative, Highly Speculative, and Isolated markets it is zero.
Once the lifetime ceiling is reached or the vault is empty, the market falls back to its own AMM fee pool as a clawback of last resort, and anything still uncovered is socialized across that market's traders.
Where this sits relative to everything else
The protocol's own cut of trading fees, liquidation fees, and lending yield never touches the revenue pool. It goes directly to each market's protocol fee pool, which is separately withdrawable to a recipient-locked address. See Where the money sits.
Spot markets have no orderbook and charge no swap fee, so a spot market's revenue pool is fed by lending carveouts and liquidations only.