Breakwater — Defined outcomes for tokenised stocks

Tokenised stocks went mainstream.

Protection stayed behind the wall.

wallets hold tokenised equities on Solana — supply hit an all-time high of $684M in September 2026, up 47% in three weeks

sits in TradFi buffer / defined-outcome ETFs, growing at a projected 29–35% CAGR toward $334B by 2030

Every one of those 900K wallets carries the full downside.

The defined-outcome layer was never built onchain.

✓ Buffer ETFs absorb the first 9–30% of losses

✓ OCC-cleared FLEX options do the engineering

✗ US brokerage account required

✗ Market hours only

✗ ~0.79%/yr wrapper fee

✗ Share sits idle — no DeFi collateral use

✓ Self-custody, 24/7, global

✓ Composable SPL token

✓ T+0 settlement

✗ No buffer. No cap. No defined outcome.

✗ When the market turns: eat it, or sell.

Breakwater is the third option: stay invested, on defined terms.

Deposit USDC, pick a tokenised stock. The note absorbs the first band of losses for a capped upside; the operator hedges it with listed, OCC-cleared options. Your Cover Note resolves in USDC.

THE BUFFER — first 9 / 15 / 30% of losses absorbed; beyond it, losses pass through

THE CAP — attested at hedge execution, never below the minimum cap set at creation

THE DATE — 3–12 month outcome period, fixed at creation

THE COVER NOTE — transferable SPL claim on the payout

THE FEE — proposed 0.50% setup + 0.35%/yr, in the onchain terms

The operator hedges with CBOE FLEX options — listed, European-style, custom-struck, OCC-cleared. No exotic machinery.

LAYER 01

EXPOSURE

LAYER 02

THE BUFFER

LAYER 03

THE CAP

The first B% of losses is absorbed; beyond −B, losses pass through one for one. Upside capped. No floor.

Maximum loss B (B = 0: no loss of par) at resolution, before fees. Losses down to B are borne in full. Upside capped.

Both suites cap the upside. Which suite carries the higher cap depends on volatility and skew.

1 · TAKE COVER

USDC or xStock escrowed in a series PDA. Cover Notes mint.

6 · RESOLUTION

Solvency-checked payout. Burn Cover Note → USDC. Published on the Wall.

2 · REDEEM

xStock → USD at NAV (collateral series)

3 · HEDGE

3-leg FLEX package @ CBOE

4 · CLEAR

OCC-cleared, cash-settled

5 · RETURN

USD → USDC on-ramp

BOND-GATED ONE-SHOT WITHDRAWAL

— LOGGED ONCHAIN

WATCH SIGNS · SQUADS 2-OF-3,

INDEPENDENT MAJORITY

EXECUTION + CLEARING — OFFCHAIN

ATTESTATION — THE WATCH

SETTLEMENT — ONCHAIN (SOLANA)

CHOOSE — Buffer or Floor Vault, level and period; indicative cap solved live

TAKE COVER — deposit, mint Cover Notes

RESOLVE — simulate any expiry, settle to USDC

THE WALL — every resolution, in public

▸ PDA-owned escrow, settlement, fee and bond vaults

▸ One-shot hedge withdrawal, only once the bond is posted; logged by event

▸ Per-series deadlines: missed → refund or default

▸ Solvency check: no settlement unless the vault covers total Cover Notes × payout

▸ Payout computed onchain in integers from the terms and checked prices

▸ The hedge — offchain; fills stay private, only an evidence hash goes onchain

▸ Prices — attested by the Watch, accepted only within a tolerance of Chainlink Data Streams

▸ Operator custody after withdrawal — the bond and default path give partial recourse

▸ Upgradeable, not immutable — authority moves to a Squads multisig before mainnet

The hedge is offchain, so the program cannot see fills. These onchain rails limit what an operator or attester can do; if the operator fails, holders have partial recourse.

ADMIN-GATED SERIES — only the protocol admin creates a series; its terms, operator and attester are fixed at creation

OPERATOR BOND — must be posted before the one-shot hedge withdrawal can run. Partial recourse, not a guarantee

PERMISSIONLESS DEFAULT — if the operator fails, anyone can trigger it; holders claim pro rata, capped at the defined payoff, and receipts share later recoveries

CHAINLINK CROSS-CHECK — attested prices must sit within a tolerance of Chainlink Data Streams, xStocks' official oracle; after a grace period, anyone can settle from a recorded report

REFUND VALVE — if the escrow was never withdrawn, holders take it back pro rata after the hedge deadline, setup fee included

INTERNAL ADVERSARIAL REVIEW 1

44 confirmed: the critical one + 12 fixed; the rest superseded by v1 or accepted

INTERNAL ADVERSARIAL REVIEW 2 — V1

65 findings fixed, superseded or disclosed; review 3 (oracle): all fixed

EXTERNAL AUDIT — NEXT

Independent audit before mainnet

Composability is the structural reason: a Cover Note is an SPL token, so a defined-outcome position can serve as DeFi collateral once a lending market lists it — something an ETF share cannot do onchain.

The timing is the other reason: Nasdaq's March 2026 tokenised-equity framework links directly to Solana DeFi, and issuer-direct rails (Superstate, Backpack, Galaxy) are bringing regulated primary issuance onchain.

The hedge itself is zero-cost by construction — the short cap call finances the downside legs.

Fees cover what is real: execution, redemption, the Watch, the operator bond's capital, and the protocol's margin.

Every fee is a line item onchain, not a page-40 footnote.

The TradFi category does $87B at 0.79%. Under half the running fee, globally, is the business.

DONE — V1 PROGRAM IMPLEMENTED, THREE INTERNAL ADVERSARIAL REVIEWS

Buffer + Floor Vaults, cash + xStock series, bond + permissionless default, Chainlink Data Streams oracle

NEXT — DEVNET V1 DEPLOYMENT

Suite green + Chainlink testnet access: demo series for both suites, full lifecycle rehearsal incl. default

THEN — EXTERNAL AUDIT

Freeze and tag v1; independent audit, fixes re-reviewed

THEN — MAINNET

After the audit, with Chainlink Data Streams and hedging partners; authority to Squads; capped first series

NOW — LADDER VAULTS FOR DEVNET

One perpetual share over staggered vintages — being built for devnet now; mainnet after its own audit

LATER — BONDED OPERATORS + MULTICHAIN

Third-party bonded operators; EVM deployment at $500M supply / 200K wallets — Cover Notes never bridge

ONE SHARE — perpetual, over staggered vintages of v1 vaults; matured vintages roll into new ones

IN-KIND EXIT — take your pro-rata slice of every vintage at any time, no NAV needed

ENTRY — deposits priced at the next final NAV, with flows capped per NAV

NO LADDER FEE — nothing on top of the vintages; designated series waive the setup fee

TRUST POINT — marks move the NAV only within a disclosed band; that band is the trust point

WHEN — devnet now; mainnet after the v1 audit and its own audit

Calm is a strategy.

Breakwater — Buffer and Floor Vaults for tokenised stocks.

Hold the asset. Choose your break. Resolve in USDC.