Isolated IMD lending markets for long-tail tokens — design spec

Status: design spec, v0.1, written 2026-10-21. Scope: interfaces and test plan only, no implementation. Labels used throughout:

• FACT (brief): a measurement the requester supplied. Not re-measured here.
• FACT [n]: stated by source [n] in §9.
• DERIVED: arithmetic in this document. Each one shows its inputs.
• ASSUMPTION: an unverified statement about the IdentityMD plane or the deployment chain.
• OPEN: a question this spec cannot settle (§7).

1. Recommendation

Build Morpho-Blue-shaped isolated markets. A market is one (collateral token, loan asset) pair, its id is deterministic, and it has no creator parameters. The loan asset is IMD or imdUSD. Each market is its own immutable contract, deployed by a factory that holds no admin key. Every risk limit comes from facts the factory reads on chain:

• a fixed protocol-wide LLTV;
• a collateral cap computed from what it costs to sell the collateral through TOKEN/IMD and then IMD/ETH within the liquidation bonus;
• a minimum-over-7-days depth reading, so depth added just before opening does not count;
• the token-admission screen.

Prices. By default each market reads a permissionless on-chain observer of its TOKEN/IMD pool (option c). The observer stores clamped, rate-limited samples and returns a median. A borrow uses the lower of the current and lagged medians. Above a fixed market size, a fresh univ4-spot attestation is also required, and the lower of the two prices is used.

Liquidation. Liquidations are oracle-light Dutch auctions. The oracle only decides when an auction starts. Bidders discover the clearing price, so a drained pool or a missed poke delays recovery but does not misprice collateral. Bad debt left after an auction is written off against that market's lenders only.

Interest and the peg. Rates follow Morpho's AdaptiveCurveIRM constants. On imdUSD markets, 20% of interest goes to a donor contract. The donor calls PoolManager.donate on the imdUSD/USDC peg pool in small hourly amounts, and only when:

• the price is within $0.9975–$1.0025;
• active liquidity is not above its recent median, which defeats just-in-time (JIT) liquidity.

Because the peg pool is thin, imdUSD borrowing is also rate-limited by peg depth. IMD-side reserves fund a first-loss buffer inside each market.

2. Decisions

#	Question	Choice	Key figure	Main reason
1	Price source	(c) Observer by default; univ4-spot attestation also required above a market size; Dutch-auction liquidation so the oracle sets only the trigger	Observer ≈ 288 pokes/day: ~$0.3–3/day on an L2, ~$430/day on L1 (ASSUMPTION on gas). Attestation at 1/hour = 24 × $4 = $96/day. Cost to push a 61-sample median 10%: observer ≈ $0.8k at 50k, $7.6k at 500k of depth; block-boundary attestation ≈ $2.6k / $26k where arbitrage exists (DERIVED §3.1)	A poke observer can be biased by a sandwich for the price of the swap fees, so it is safe only under tight caps. The attestation adds an independent check where the value at risk justifies $4 a request.
2	Limits from the pool	Cap = largest collateral amount whose sale through TOKEN/IMD (+IMD/ETH for imdUSD markets) loses at most bonus − fees − 2% margin. Depth input = min(now, min of daily snapshots over 7 days). Cap rises at most +25%/day. Recomputed on each observer epoch (1 h) and checked at borrow time	Full-range pool: cap ≈ 3.2% of pool TVL in collateral value (DERIVED). Minimum to open: sell-side −10% depth ≥ $6.8k (≈ $250k full-range TVL). The two real pools were not checked (OPEN-1)	Ties loan size to what liquidators can actually recover. A 7-day minimum makes "add depth, borrow, pull" require locking the depth for a week.
3	Market shape	One market per (collateral, loan asset), each its own contract, at most 2 per token	—	Physical balance isolation contains rebasing and blocklist failures. A deterministic id means no duplicates and no spam variants.
4	Liquidation	Dutch auction: starts at 1.05 × reference, decays 1% per minute (compounding), lasts 6 h; anyone bids; partial fills; residue written off pro rata	10 min → 95%, 60 min → 58%, 2 h → 31%, 6 h → 2.7% of reference (DERIVED)	A fixed bonus fails when executable depth is unknown or gone. An auction finds the price with no pool.
5	Interest rates	AdaptiveCurveIRM, unchanged constants (target utilisation 90%, steepness 4, adjustment speed 50/yr); initial rate-at-target 4%	Rate-at-target doubles in about 5 days at 100% utilisation [2]	No admin, adapts to unknown demand, battle-tested.
6	LP mechanic	20% of imdUSD interest, donated at most hourly, only inside the band and only if active liquidity ≤ 1.25 × its 12-sample median; the IMD-side 10% reserve stays in the market as first loss	At an 8% borrow APR: $16k/yr at $1M of loans, $160k/yr at $10M (16% / 160% APR on $100k of in-range liquidity)	Pays only in-range liquidity (FACT [7]). The liquidity check defeats a same-block JIT.
7	Token admission	Refuse: transfer-amount mismatch on a seed transfer; non-empty EIP-1967/beacon slots; DELEGATECALL or SELFDESTRUCT in runtime code; a live owner() with paused() or a blocklist selector; an ERC-777 registration. Run balance-delta checks on every transfer in	—	A permissionless factory can only refuse what it can observe. Every refusal is a deterministic on-chain check.
8	Spam and listing	Creation is permissionless but deterministic (≤2 markets per token) and gated by depth and the screen. The front end by default shows markets that are ≥7 days old, have ≥$10k supplied, a healthy oracle, and a token from the imd.fun factory	—	No creator parameters, so creating a market buys nothing but gas.

3. Questions

3.1 Price source

Facts that bind the choice.

• Launch pools carry the shared hook with beforeInitialize only, so an in-pool TWAP is impossible (FACT brief).
• Some launch pools are one-sided or thin, and two sit at the minimum tick (FACT brief).
• Oracle manipulation of thin assets is a common loss mode. Chainalysis counts $403.2M lost in 41 such attacks in 2022, including Mango Markets ($117M), where "a low-liquidity asset" was pushed up and borrowed against (FACT [6]).

Depth model (DERIVED). "Pool depth D" means the USD value of a full-range constant-product position, D/2 on each side.

• Pushing the price up 10% takes quote input Y(√1.1 − 1) = 0.0244·D: $1.22k at D = 50k, $12.2k at D = 500k.
• Pushing it down 10% takes token input X(1/√0.9 − 1) = 0.0270·D in value: $1.35k / $13.5k.
• Concentrated liquidity makes both numbers smaller. Every on-chain computation below therefore uses the real tick liquidity, not this model.
• The launch-pool LP fee is ASSUMED to be 1% (OPEN-2). IMD/ETH is 1% (FACT brief).

Option (a): poke observer.

• How it works. PoolObserver.poke() reads slot0 through StateLibrary.getSlot0 (extsload) and appends (timestamp, tick, activeLiquidity) to a ring buffer.
• Limits. At most one sample per 60 s. Each sample's tick is clamped to ±100 ticks (≈1%) from the previous sample. The window holds 61 samples.
• Weakness (DERIVED). An external observer cannot force the attacker to hold the price across a block boundary. The attacker can push, poke and unwind in one transaction. The cost per biased sample is only the round-trip fees: 2 × 1% × 0.0244D ≈ 0.0005D. Moving the median needs 31 of the 61 samples, so the cost is about 0.015D: $0.76k at 50k, $7.6k at 500k. The clamp turns this from one transaction into ≥10 minutes of sustained effort, but it does not raise the price.
• Cost to run. 288 pokes/day at ~50k gas each. On an L1 at 10 gwei and $3k ETH (ASSUMPTIONS), that is ≈ $430/day. On an L2 it is cents to a few dollars a day (the deployment chain is OPEN-3).
• Missed poke. If samples are sparse, the median goes stale. The rule below handles it.

Option (b): univ4-spot attestation.

• How it works. A request is {poolManager, poolId, samples}. The reply is a median over a block window, as an EIP-712 attestation signed by 0x5598aa…2982, domain "IdentityMD Oracle" v2, with panelSize, quorum and agreed signed (FACT brief).
• ASSUMPTION: the swarm reads state at block boundaries (end of block), not mid-transaction. If so, an attacker must hold the price across about half the sampled blocks.
• Manipulation cost (DERIVED). Where an arbitrageur re-prices every block, each re-push costs the arbitrage loss Y(√1.1 − 1)² ≈ 0.0012D plus about 0.0005D in fees. Over 31 blocks that is ≈ 0.05D: $2.6k at 50k, $26k at 500k.
• Single-venue tokens. Where no other venue exists (most launch tokens), nobody arbitrages the price back. The "manipulation" is then simply buying the token, and its cost is the market risk on the purchase. No oracle defends this case. The depth cap (§3.2) is the defence.
• Cost. $4 per request (FACT brief). Hourly refresh is $96/day, on-demand only is $4 per borrow or kick.
• Latency. Minutes (FACT brief), which is too slow to trigger liquidations without an observer.
• Trust. A single signer key. The verifier at github.com/fa11up/oracle-coop was not read for this spec (OPEN-4).

Option (c): observer plus attestation above a size. This is the recommendation.

• Thresholds. When a market's borrowed value exceeds the attestation threshold (DERIVED default: 25% of its cap, or $25k, whichever is lower), a borrow must carry an attestation no older than 30 minutes. The price used is then min(observer median, attested median).
• Cost. $0 at small size. The attestation charge is borne by the borrower, so it is per event, not per day.
• Liquidation. Only the observer triggers a kick, because the auction does not trust the reference price beyond its start point.

Option (d): Ajna buckets.

• How it works. No price feed; lenders choose price buckets (FACT [4]).
• Cost and manipulation. Oracle cost is zero and nothing is manipulable.
• Missed poke. Ajna survives one by construction.
• Cost to lenders. Lenders must price their own buckets, which is a heavy UX load for thousands of long-tail tokens. Liquidations take up to 72 h and start at 256 × the reference price (FACT [4]).
• Verdict. A good second product for the longest tail; it does not fit the "lend IMD/imdUSD passively" goal.

Option	Cost/market/day	Cost to move 10% @50k	@500k	Survives missed poke
(a) observer	L2 ≈ $0.3–3; L1 ≈ $430 (ASSUMPTION)	≈ $0.8k	≈ $7.6k	Partly: borrows halt; repay, withdraw-collateral-if-healthy and auctions continue
(b) attestation hourly	$96	≈ $2.6k (if arbitraged)	≈ $26k	Yes for borrow (fetch on demand); kicks wait minutes
(c) observer + attestation > size	(a) + $4 per large borrow	max of (a), (b) on large borrows	same	As (a); large borrows need a fresh attestation
(d) Ajna	$0	n/a	n/a	Yes

Missed-poke rule (all observer markets).

• If fewer than 31 samples fall inside the last 90 minutes, the market is STALE.
• In STALE, borrow and collateral withdrawal revert. repay, supply, withdraw (lenders, from idle cash) and running auctions continue.
• A kick while STALE requires an attestation.
• Nothing is ever priced from a stale value.

Price conversion.

• An IMD market needs only TOKEN/IMD.
• An imdUSD market values debt at $1 par and collateral as TOKEN/IMD × IMD/ETH (observer on the deep 1% pool, FACT brief) × Chainlink ETH/USD, with a staleness check.
• Valuing debt at par overstates debt when imdUSD trades below $1. That is conservative for lenders. ASSUMPTION: imdUSD is redeemable or targets $1 in the CDP (OPEN-5).

3.2 Limits derived from the pool

Cap formula. Notation:

• b: liquidation bonus, defined as the auction's expected discount. The default sizes caps at b = 10%.
• f₁, f₂: LP fees of TOKEN/IMD and IMD/ETH.
• m: a 2% margin for gas and price drift.
• P: the reference price.
• Q(C): IMD output from selling C tokens in TOKEN/IMD, computed by walking initialized ticks with StateLibrary (a quoter-style view, bounded to 200 tick crossings). For an imdUSD market, apply the IMD/ETH leg to Q(C) too.

cap = max C such that  Q(C) ≥ C · P · (1 − b + m)            (solved by bisection, 24 iterations)
full-range closed form (DERIVED): sell impact of C into reserve X is C/(X+C);
  s = b − f₁ − f₂ − m = 10% − 1% − 1% − 2% = 6%  →  C ≤ X·s/(1−s) = 0.064·X
  in value: 0.064 · D/2 ≈ 3.2% of pool TVL

Pool TVL (full range)	Sell −10% depth	Collateral cap (value)	Max loan at LTV 40%
$50k	$1.35k	$1.6k	$0.64k
$250k	$6.8k	$8.0k	$3.2k
$500k	$13.5k	$16k	$6.4k
$2M	$54k	$64k	$25.6k

IMD/ETH leg. The IMD/ETH pool (~$1.9M, FACT brief) is shared by all imdUSD markets. Each market's cap counts only its own sale, so the factory also enforces a global limit: total imdUSD-market collateral value ≤ 3.2% of IMD/ETH TVL, read from the IMD/ETH observer. DERIVED: about $60k at the reported $1.9M. This coupling is the one way markets are not isolated (§6, risk 3).

Recompute cadence.

• Every observer epoch (1 h), anyone may call checkpointDepth(). It records Q-based depth for the current tick, and the 24 h minimum rolls into a 7-slot daily ring.
• borrow uses min(capNow, capStored), where capNow is computed in the transaction.

Add-then-pull defence (all three measures, combined).

1. Time-weighted floor: depth = min(current, minimum daily snapshot over 7 days). Instant depth counts only if it is lower.
2. Slow rise: the stored cap rises at most +25% per day, compounding, from the opening cap. 25% a day takes 10 days to reach 9.3×.
3. Borrow-time check: capNow is computed at borrow, so depth pulled at any time blocks new borrowing at once.

To profit, an opener must keep depth in the pool for 7 days, which exposes it to IL and to other traders. Even then the loan is at most 3.2% × 40% ≈ 1.3% of the depth they locked. If depth is pulled after a borrow, existing loans stay, but the auction (§3.4) sells to bidders at whatever price clears. The loss lands on lenders and is bounded by the cap.

Minimum depth to open (DERIVED). Sell-side −10% depth ≥ $6.8k, about $250k full-range TVL, measured as the 7-day minimum. Below that, the maximum loan (< $3.2k) earns less than the observer's running cost and the manipulation risk is under $2k. A pool at the minimum tick has zero sell-side depth and is ineligible automatically.

Two real launch pools: not checked. This run had no RPC access to the plane's chain and no pool ids (OPEN-1). The brief's facts give one data point: the two pools drained to the minimum tick would compute cap = 0 and be refused. The method to check any pool:

1. Call StateLibrary.getSlot0 and getLiquidity, and walk getTickBitmap/getTickLiquidity for 200 ticks below the current tick.
2. Feed the result to the bisection above.
3. Repeat over 7 daily blocks.

The test test_capFromForkedLaunchPools (§5) is designed to record these numbers once the IDs are given.

3.3 Market shape

Recommendation. One market per (collateral, loan asset).

• Against one pool lending both IMD and imdUSD: it would expose lenders of one asset to the borrowers of the other, share utilisation between two very different demand curves, and complicate the peg reserve.
• Separate contracts per market instead of a Morpho-style singleton: a token that rebases or blocklists can only corrupt one contract's balance. Morpho's singleton is safe for standard tokens, but here the collateral is adversarial.

	Isolation	Oracle	Liquidation	Creator / admin powers
Morpho Blue	Per (loan, collateral, oracle, IRM, LLTV) market in one singleton	Chosen by the market creator	Fixed incentive LIF = min(1.15, 1/(0.3·LLTV + 0.7)), partial, permissionless; bad debt realised pro rata in Blue/V1.0 (FACT [3])	Picks oracle, LLTV and IRM from a governance-approved set; governance sets the fee; IRM immutable (FACT [2])
Euler v2 (EVK + EVC)	Per vault; collaterals recognised per controller vault	Chosen by vault governor	Run atomically through the EVC under "the controller vault's rules"; checks are deferred to the end of a batch (FACT [8]); discount mechanics not verified in this read	Governor can set oracle/LTV/IRM unless renounced (not verified in this read)
Silo v2/v3	Two-asset silo of two ERC-4626 vaults; risk contained per silo (FACT [5])	Deployer chooses solvency and maxLTV oracles; no oracle ⇒ price 1 (FACT [5])	Partial by default, liquidator fee (FACT [5])	Deployer sets oracles, IRM config and liquidation fee, immutable unless upgradeable settings are opted into (FACT [5])
Ajna	Per (collateral, quote) pool	None; lender buckets	Bonded kick, Dutch auction ≤72 h starting 256× and halving; bad debt from reserves, then the highest buckets (FACT [4])	None
Rari Fuse	Per-pool Compound fork, multiple assets per pool	Pool admin picks	Compound fixed close factor and incentive	Pool admin sets everything and can change it; Compound code without CEI exploited for $80M (FACT [1])
This design	Per (token, loan asset) contract	Observer (+ attestation above size), no choice	Dutch auction, partial, pro-rata write-off	None

Each failure mode of Fuse maps to a design rule here:

• Reentrancy: ERC-20 only, no ETH, CEI and a guard on every entry.
• Thin-asset manipulation: depth caps, a median observer, and the attestation above size.
• Bad admins: there are no parameters to set.

3.4 Liquidation for thin collateral

Why an auction rather than a fixed bonus. A fixed bonus (Morpho [3]) assumes a liquidator can sell the seized collateral at the oracle price minus the bonus. In a thin or drained launch pool that assumption is false, and nobody liquidates. A Dutch auction moves price discovery to bidders.

Trigger. Anyone may kick when health = collateral·P_liq·LLTV / debt < 1.

• P_liq is the observer median. It is not the minimum used for borrows, so a brief push down cannot cause unfair kicks.
• LLTV = 50% and borrow LTV = 40% are protocol constants for every market (DERIVED choice: about 2.5 daily standard deviations for tokens with 20% daily volatility, ASSUMPTION). They are not creator parameters.
• The kicker receives 0.5% of the debt, paid from collateral, to fund keepers.

Price path.

• Reference R = max(observer median, median of the previous window). A pushed-down price therefore cannot start the auction low.
• Price(t) = 1.05·R·0.99^(t/60 s). DERIVED values: 10 min 95%, 30 min 77.5%, 1 h 57.5%, 2 h 31.5%, 4 h 9.4%, 6 h 2.7%.
• Duration is 6 h, after which anyone may settle.

Bidders and fills.

• Anyone may bid. Bidders pay the loan asset up front by transferFrom. There is no flash callback; bidders may use their own external flash loans.
• Partial fills are allowed. A fill that leaves collateral worth < $50 at the current auction price, or debt < 1 unit, must take the remainder.
• Unsold collateral is returned to the borrower only once the debt is fully repaid.

Bad debt.

• On settle, remaining debt is first charged to the market's first-loss reserve (§3.6).
• The rest reduces totalSupplyAssets, which lowers every lender's share value pro rata. This matches Morpho Blue/V1.0 realisation [3].
• It never crosses markets.

Pool drained mid-auction. The auction does not read the pool after the kick. The price keeps decaying, and bidders who value the token elsewhere, or simply the cheap token, take it. If nobody bids for 6 h, all collateral is sold at dust prices or settled, and the loss is realised. New borrows in that market are already blocked by capNow = 0.

3.5 Interest rates with no admin

Option	No-admin behaviour	Weakness
Fixed kink	Constant parameters	No single kink suits thousands of demand profiles; it would need a creator choice, which is forbidden
AdaptiveCurveIRM	Rate-at-target drifts toward clearing utilisation: doubles in about 5 days at 100%, halves in 10 days at 45% (FACT [2])	Slow to react to sudden runs (days)
Utilisation target (PI controller, Silo-like [5])	Adaptive	More tunable constants and less production history

Default: AdaptiveCurveIRM with the published shape. Target 90% and steepness 4 are stated in [2]. The adjustment speed of 50/yr is DERIVED from "doubles in 5 days at 100%": e^(50·5/365) ≈ 1.98. Initial rate-at-target is 4%, the page's example [2].

One deviation: target utilisation is 85% for imdUSD markets, leaving more idle cash so lenders can exit without depending on the thin peg pool.

3.6 The LP mechanic

Mechanics.

• PoolManager.donate adds amount·2¹²⁸ / active liquidity to fee growth, and reverts with NoLiquidityToReceiveFees when active liquidity is 0 (FACT [7], quoted from v4-core Pool.sol).
• Only liquidity in range at the current tick earns it (FACT [7]).
• The donor must therefore check range, and must handle a revert by keeping the funds.

Share and cadence.

• Reserve factor is 20% of imdUSD interest, accrued per market and pulled by PegDonor.donate().
• donate() runs at most once per 3600 s.
• Each donation is at most what accrued since the last one. There is no catch-up burst, so a missed hour simply rolls the funds into the next donation, which is still capped at 2× the hourly accrual.

Anti-JIT conditions (all three must hold, otherwise the donation is skipped and the funds kept).

1. Band: the peg-pool tick is within ±25 bps of $1, both now and at the observer median.
2. Liquidity check: getLiquidity(pegPool) now ≤ 1.25 × the median active liquidity over the last 12 observer samples (≥12 minutes).
   • A same-block JIT position raises active liquidity at once, so the donation is skipped.
   • Liquidity that sits in range for longer than the sample window is real LP liquidity, which is what the donation is meant to pay.
3. Small amounts: each donation is capped at 0.1% of the in-range liquidity's value, so even a successful JIT that gets past the check captures little.

Unpredictable timing (blockhash-based) is rejected: block builders can see or set it.

Expected yield (DERIVED; borrow APR 8% is an ASSUMPTION).

imdUSD loans	Interest/yr	20% to peg LPs	APR on $50k in range	APR on $250k in range
$1M	$80k	$16k	32%	6.4%
$10M	$800k	$160k	320%	64%

These are incentives, not organic fee income. The yield attracts in-range liquidity until the APR normalises, and that deeper liquidity is the point. The current in-range liquidity is unknown. "About 250 imdUSD fills the band" (FACT brief) suggests only a few thousand dollars in range (ASSUMPTION).

Peg pressure from borrowing (FACT brief: one borrower pushed the peg to $0.89 twice). The factory enforces a global imdUSD borrow-flow limit: new imdUSD borrowed across all markets per rolling hour ≤ the peg pool's executable imdUSD→USDC depth down to $0.99. That depth is computed on chain as with Q.

IMD-side interest. A 10% reserve stays in the market as a first-loss reserve. It is never donated: the IMD/ETH pool is already deep, and donating to TOKEN/IMD pools would face the same JIT problem with no peg benefit. Once a market's reserve exceeds 5% of its debt, the excess flows back to its lenders.

3.7 Token admission

Property	Risk	Factory check at createMarket	Ongoing defence
Fee-on-transfer	Collateral credited > received	Opener supplies seed collateral. The factory checks balanceAfter − balanceBefore == amount on transferFrom, then sends it to the market and checks again	Every transfer-in is balance-delta checked; on a mismatch, revert
Rebasing (negative)	Market holds less than it accounts	Not reliably detectable at creation; probe scaledBalanceOf, rebase, gonsPerFragment selectors → refuse if any responds	balanceOf(market) < totalCollateral ⇒ market BROKEN: no borrows; withdraw/auction pro rata
Rebasing (positive)	Unaccounted surplus	—	Surplus ignored; skim sends it to the first-loss reserve
Blocklisting	Market or bidder cannot receive, so liquidation fails	Probe isBlacklisted(address), isBlocked(address), blacklist(address) selectors (staticcall, must revert)	Refused at creation, so liquidations rely on transfers working; if transfers fail anyway, the market is BROKEN and the 6 h auction expires into a write-off
Pausable	Same as blocklist	paused() responds and owner() (or getRoleAdmin) is non-zero ⇒ refuse	—
Upgradeable	Any property can change later	EIP-1967 implementation and beacon slots and EIP-1822 slot are zero; runtime code scanned for DELEGATECALL (0xF4), CALLCODE (0xF2) and SELFDESTRUCT (0xFF), skipping PUSH data	—
Transfer hooks (ERC-777)	Reentrancy	ERC-1820 getInterfaceImplementer(token, keccak("ERC777Token")) == 0	Guard on every entry
Odd decimals/supply	Math overflow	decimals() ≤ 24, totalSupply() > 0	—

Two tiers.

1. Tokens whose runtime code hash matches the imd.fun launch token (ASSUMPTION: a single, non-upgradeable implementation; OPEN-6) pass immediately.
2. Other ERC-20s must pass every heuristic.

Selector probes are heuristics: a hostile token can hide behind non-standard names. The bytecode scan and balance-delta accounting are the hard guarantees.

3.8 Spam and listing

Why spam is limited.

• Market ids are keccak(collateral, loanAsset). A factory constant chooses the loan asset (IMD or imdUSD), so each token has at most two markets.
• Creation requires:
  • passing §3.7;
  • minimum depth over 7 days;
  • a seed collateral transfer worth ≥ $100 at the observer price. The seed is the opener's collateral and remains theirs.
• Thousands of markets are possible only if thousands of pools have real depth, and creating one buys nothing but gas.

Front-end default view. Show markets that are:

• ≥7 days old;
• ≥$10k supplied;
• not STALE or BROKEN;
• current cap > $1k;
• tier-1 tokens.

Everything else sits under "All markets" with warnings: unverified token, low depth, at cap, bad debt history. Sort by supplied value. Never sort by APR alone, because a high APR on a thin market is a risk signal.

4. Contracts

All contracts share these rules:

• Solidity 0.8.26 and immutable: no proxies, no owner, no pause.
• ERC-20 only, moved through SafeERC20.
• nonReentrant (transient storage) on every external state-changing entry.
• CEI ordering throughout.
• No callbacks to users.

4.1 LendingFactory

Purpose. Screens a token, measures depth, and deploys a LendingMarket with CREATE2. It also holds the global imdUSD limits.

Constructor.

(IPoolManager pm, address imd, address imdUsd,
 PoolKey imdEthKey, PoolKey pegKey,
 AggregatorV3Interface ethUsd,
 IAttestationVerifier att,
 IObserverRegistry obs,
 ITokenScreener screener,
 IIrm irm,
 IPegDonor donor)

Storage.

• mapping(bytes32 => address) marketOf
• address[] markets
• uint256 imdUsdCollateralValue
• uint256 imdUsdBorrowedThisHour
• uint64 hourStart

interface ILendingFactory {
    event MarketCreated(bytes32 indexed id, address indexed collateral, address indexed loanAsset,
                        address market, PoolId tokenImdPool, uint256 openingCap);
    error Exists(); error Refused(uint8 reason); error TooShallow(uint256 depth, uint256 min);

    /// Anyone. Requires screener pass, 7-day observer history, depth ≥ MIN_DEPTH, seed ≥ MIN_SEED.
    function createMarket(address collateral, bool loanIsImdUsd, PoolKey calldata tokenImdKey,
                          uint256 seedCollateral) external returns (address market);
    function marketOf(bytes32 id) external view returns (address);
    function marketId(address collateral, address loanAsset) external pure returns (bytes32);
    /// Only registered markets. Enforces global imdUSD caps; reverts if exceeded.
    function reportImdUsdBorrow(uint256 amount) external;
    function reportImdUsdCollateralValue(int256 delta) external;
}

Invariants.

• At most one market per id.
• Every market's tokenImd pool key contains collateral and IMD.
• Hourly imdUSD borrow flow ≤ peg depth.
• No function changes any parameter.

4.2 LendingMarket

Purpose. One isolated market: supply/withdraw for lenders, collateral/borrow/repay for borrowers, plus auctions.

Constructor. (collateral, loanAsset, PoolKey tokenImdKey, factory). All other dependencies are read from the factory's immutables.

Storage.

• totalSupplyAssets, totalSupplyShares, totalBorrowAssets, totalBorrowShares
• lastAccrual, rateAtTarget, reserveImd, pegAccrued
• mapping(address => Position{supplyShares, borrowShares, collateral})
• mapping(address => Auction{start, ref, collateralLeft, debtLeft})
• totalCollateral, storedCap, capDay, state (OK/STALE/BROKEN)

interface ILendingMarket {
    event Supply(address indexed caller, address indexed onBehalf, uint256 assets, uint256 shares);
    event Withdraw(address indexed owner, address indexed receiver, uint256 assets, uint256 shares);
    event SupplyCollateral(address indexed onBehalf, uint256 amount);
    event WithdrawCollateral(address indexed owner, address indexed receiver, uint256 amount);
    event Borrow(address indexed owner, address indexed receiver, uint256 assets, uint256 shares, uint256 price);
    event Repay(address indexed payer, address indexed onBehalf, uint256 assets, uint256 shares);
    event Kick(address indexed borrower, address indexed kicker, uint256 debt, uint256 collateral, uint256 ref);
    event Take(address indexed borrower, address indexed bidder, uint256 collateralOut, uint256 debtPaid, uint256 price);
    event Settle(address indexed borrower, uint256 badDebt, uint256 fromReserve, uint256 socialised);
    event Accrue(uint256 interest, uint256 toReserve, uint256 toPeg, uint256 rateAtTarget);
    event StateChanged(uint8 state);

    // Lenders — anyone; onBehalf any address for supply; withdraw only by owner (msg.sender).
    function supply(uint256 assets, address onBehalf) external returns (uint256 shares);
    function withdraw(uint256 shares, address receiver) external returns (uint256 assets);
    // Borrowers — owner is always msg.sender for anything that reduces health.
    function supplyCollateral(uint256 amount, address onBehalf) external;
    function withdrawCollateral(uint256 amount, address receiver) external;      // health ≥ LTV after, state OK
    function borrow(uint256 assets, address receiver, bytes calldata attestation) external returns (uint256 shares);
    function repay(uint256 assets, address onBehalf) external returns (uint256 shares);
    // Liquidation — anyone.
    function kick(address borrower, bytes calldata attestationIfStale) external;
    function take(address borrower, uint256 maxCollateral, uint256 maxPrice) external returns (uint256 paid);
    function settle(address borrower) external;
    // Upkeep — anyone.
    function accrue() external;
    function checkpointDepth() external;
    function skim() external;                                                    // surplus collateral → reserve
    function pullPegReserve() external returns (uint256);                        // only PegDonor
    // Views
    function capNow() external view returns (uint256);
    function health(address borrower) external view returns (uint256 wad);
    function auctionPrice(address borrower) external view returns (uint256);
}

Invariants (each tested).

1. loanAsset.balanceOf(this) ≥ totalSupplyAssets − totalBorrowAssets + reserve + pegAccrued (cash solvency).
2. collateral.balanceOf(this) ≥ totalCollateral while state != BROKEN.
3. Σ positions' shares equals the totals.
4. Rounding favours the market: supply and repay round shares down for the user, borrow and withdraw round shares up.
5. totalCollateral · price ≤ cap is required at every borrow and collateral increase. Existing positions may exceed the cap after depth is pulled.
6. No borrow or collateral withdrawal while STALE or BROKEN.
7. No external call precedes a state write in any function, and every entry is guarded.
8. Bad debt only reduces this market's lender assets.
9. The auction price is monotone non-increasing in time and independent of pool state after the kick.

4.3 PoolObserver (one per observed pool, created via ObserverRegistry)

Purpose. Permissionless clamped samples of tick and active liquidity, the median, and the depth ring.

Constructor. (IPoolManager pm, PoolKey key).

Storage.

• Sample[64] ring{uint32 ts; int24 tick; uint128 liquidity}
• uint8 head
• uint256[7] dailyMinDepth
• uint32 lastDay

interface IPoolObserver {
    event Poked(int24 rawTick, int24 storedTick, uint128 liquidity, address poker);
    event DepthCheckpoint(uint256 day, uint256 sellDepth10);
    function poke() external;                       // anyone; ≥60 s since last; tick clamped ±100 to previous
    function median(uint32 window) external view returns (int24 tick, uint16 n);
    function laggedMedian(uint32 window) external view returns (int24 tick, uint16 n);
    function medianLiquidity(uint16 samples) external view returns (uint128);
    function sellQuote(uint256 amountIn, bool zeroForOne, uint16 maxTicks) external view returns (uint256 out);
    function minDepth7d() external view returns (uint256);
}

Invariants.

• At most one sample per 60 s.
• |stored − previous stored| ≤ 100 ticks.
• Stored history is append-only and timestamps are monotone.
• sellQuote matches a real swap on a fork within 1 wei per crossed tick.

4.4 ObserverRegistry

Deploys one observer per PoolId, deterministically, permissionlessly. observerOf(PoolId) → address. Its only event is ObserverCreated(PoolId, address).

Invariant: one observer per pool.

4.5 AttestationVerifier

Purpose. Verify univ4-spot EIP-712 attestations.

Constructor. (address signer, uint256 chainId).

• The signer is a deploy-time constant, given in the brief as 0x5598aa9146215bc13eb26f2c692ad1461fd32982.
• The domain is "IdentityMD Oracle", version "2".

interface IAttestationVerifier {
    struct Attestation { address poolManager; bytes32 poolId; uint16 samples; uint64 fromBlock; uint64 toBlock;
                         int24 medianTick; uint8 panelSize; uint8 quorum; uint8 agreed; uint64 issuedAt; }
    function verify(bytes calldata encoded) external view returns (Attestation memory a);
    // reverts unless: ECDSA signer == SIGNER, agreed ≥ quorum, quorum > panelSize/2, samples odd ∈ [1,61],
    // samples ≥ 31 for use in borrow, block.timestamp − issuedAt ≤ 30 min.
}

ASSUMPTION: the field layout above. The real typed-data struct must be copied from oracle-coop (OPEN-4).

4.6 AdaptiveCurveIrm

Purpose. A stateless rate function with Morpho's constants.

interface IIrm { function borrowRate(uint256 utilWad, uint256 rateAtTarget, uint256 elapsed, bool imdUsd)
    external pure returns (uint256 ratePerSecond, uint256 newRateAtTarget); }

Invariants.

• Rate is monotone in utilisation.
• rateAtTarget stays within [0.1%, 200%]/yr.
• The rate at 100% utilisation is 4 × rateAtTarget.

4.7 TokenScreener

Purpose. Pure and view checks from §3.7. screen(address token) external view returns (uint8 reasonOrZero) plus seedCheck used by the factory.

Invariant: deterministic for a given code and storage state.

4.8 PegDonor

Purpose. Collect pegAccrued from imdUSD markets and donate to the peg pool under the §3.6 conditions.

Constructor. (IPoolManager pm, PoolKey pegKey, IPoolObserver pegObserver, ILendingFactory factory).

Storage. lastDonation, pending, lastAmount.

interface IPegDonor {
    event Donated(uint256 amount, int24 tick, uint128 liquidity);
    event Skipped(uint8 reason, uint256 pending);   // 1 out of band, 2 liquidity spike, 3 no liquidity
    function collect(address[] calldata markets) external;         // anyone
    function donate() external;                                    // anyone; ≥3600 s since last
    function unlockCallback(bytes calldata) external returns (bytes memory); // only PoolManager
}

The donation path is unlock → donate → sync → transfer → settle.

Invariants.

• No donation unless every condition holds.
• An amount is never above the 2 × hourly accrual cap.
• Funds are never lost on a skip.
• unlockCallback rejects any caller other than the PoolManager.

5. Foundry test plan

Setup. Tests run on a local v4 PoolManager with mock ERC-20s, fuzzing at ≥10k runs for invariants. Fork tests are tagged fork and need an RPC and the pool IDs (OPEN-1).

Unit tests

Test	Asserts
test_supplyWithdraw_roundsAgainstUser	Shares rounding (invariant 4)
test_borrow_respectsLtvAndCap	Borrow beyond 40% LTV or beyond capNow reverts
test_borrow_usesMinOfMedianAndLagged	Price used = min
test_borrow_requiresAttestationAboveThreshold	Missing, stale, wrong-signer or under-quorum attestation reverts
test_attestation_wrongDomainOrVersion_reverts	Domain binding
test_irm_matchesMorphoReferenceVectors	Doubling ≈5 d at 100% util
test_accrue_splitsReserveAndPeg	20% to peg (imdUSD), 10% to reserve (IMD)
test_kick_onlyWhenUnhealthy	Health check
test_auctionPrice_curve	1.05·R·0.99^(t/60) at sample times; monotone
test_take_partialFillAndDustRule	Remainder rule
test_settle_reserveThenSocialise	Reserve first, then pro-rata loss
test_observer_rateLimitAndClamp	60 s spacing, ±100 tick clamp
test_observer_stale_blocksBorrowAllowsRepay	Missed-poke rule
test_factory_duplicateMarketReverts	One per id
test_factory_minDepthRefusal	TooShallow
test_pegDonor_onlyPoolManagerCallback	Access control

Adversarial tests

Test	Scenario	Pass condition
test_attack_pushedPool_sandwichPokes	Attacker pushes TOKEN/IMD +50%, pokes, unwinds, every 60 s for 30 min, then borrows	Borrowable extra ≤ clamp-bounded amount; attacker's loss in fees > extra borrow at default depth
test_attack_pushedPoolDown_unfairKick	Push price −30% for one sample, kick a healthy borrower	Kick reverts (median unchanged)
test_attack_drainedPoolMidAuction	Kick, then drain the pool to the min tick	Auction continues; capNow = 0; settle realises a bounded loss; other markets unchanged
test_attack_depthAddedThenPulled	Add 10× depth, open, borrow, remove depth in the next block	Opening cap uses the 7-day minimum; borrow ≤ pre-add cap; after pull, new borrows revert
test_attack_depthHeldSlowRise	Add depth and hold 7 days	Stored cap ≤ opening × 1.25^days
test_attack_rebasingTokenNegative	Mock token rebases −20%	Market goes BROKEN; no borrows; collateral withdrawals pro rata; invariant 1 still holds
test_attack_rebasingTokenPositive	+20% rebase	Surplus skimmed to reserve; no share inflation
test_attack_blocklistMarket	Token blocklists the market after deposit	Transfers revert, market BROKEN, auction expiry writes off; no other market affected
test_screen_refusesBlocklistPausableProxy	Mocks with isBlacklisted, owned paused(), EIP-1967 slot, DELEGATECALL	Each refused with its reason code
test_screen_feeOnTransferSeed	1% FoT token	createMarket reverts
test_screen_feeActivatedLater	FoT turned on after creation	supplyCollateral reverts on balance delta
test_attack_erc777Reentrancy	Hooked token re-enters withdrawCollateral during supplyCollateral	Reverts (guard); refused at screen anyway
test_attack_reentrancyAllEntries	Malicious ERC-20 re-entering every external function	All revert with the guard error
test_attack_jitDonationSnipe	Searcher adds 100× liquidity in range, then calls donate()	Skipped (reason 2); pending preserved
test_attack_jitSlowBuild	Liquidity added over ≥12 samples	Donation proceeds; JIT share equals honest LP share (no edge)
test_pegDonor_outOfBandSkips	Peg at $0.99	Skipped (reason 1)
test_pegDonor_zeroLiquidityNoRevert	No in-range liquidity	Skipped (3), no revert
test_attack_imdUsdBorrowDump	Borrow imdUSD and sell into the peg pool	Hourly global limit bounds price impact to ≥ $0.99

Invariant suites

• invariant_cashSolvency
• invariant_collateralBacking
• invariant_sharesSum
• invariant_noCrossMarketLoss
• invariant_auctionMonotone

Fork test

• test_capFromForkedLaunchPools: for two named launch pools, log depth, cap and eligibility. This is the check §3.2 requires.

6. Risks, ranked by severity

#	Severity	Risk	Mitigation / residual
1	Critical	Single-venue tokens: the pool price is the only price, so a patient buyer can raise it and borrow	Caps of ~1.3% of locked depth, a 7-day depth floor, slow cap rise. Residual loss ≤ cap per market
2	High	imdUSD peg: borrowers selling borrowed imdUSD into a 250-imdUSD band (FACT brief)	Global hourly borrow-flow limit, par debt valuation, peg donations. Residual: a depeg still hurts imdUSD lenders' mark
3	High	Shared dependencies break isolation: IMD/ETH observer and pool, Chainlink, attestation signer	Global imdUSD-collateral limit; IMD markets do not need IMD/ETH
4	High	Sandwich-biased observer samples are cheap (≈0.0005D each)	Clamp, median of 61, lagged min, attestation above size
5	Medium	Token heuristics miss a hostile token	Balance-delta checks, BROKEN state, per-market contracts
6	Medium	Auctions with no bidders on obscure tokens	6 h decay to 2.7%, kicker reward. Residual: losses realised
7	Medium	Attestation signer key compromise or unavailability	Used only as an extra min() on large borrows, never as sole price
8	Low	JIT sniping of donations by multi-sample liquidity	Equivalent to honest LP, by design
9	Low	Gas cost of tick walking and bytecode scan	Bounded loops (200 ticks; one-off scan)

7. Open questions for the IdentityMD developer

1. OPEN-1: Which chain are the plane's pools on? Which two launch pools (PoolIds) should we use to check the cap formula, and may we use an archive RPC for 7 days of history?
2. OPEN-2: What LP fee and tick spacing do imd.fun launch pools use, and is it the same for every launch?
3. OPEN-3: What gas price should we assume on the deployment chain to cost a 60-second poke cadence?
4. OPEN-4: What is the exact EIP-712 struct and type string for univ4-spot attestations in oracle-coop, and does the swarm sample end-of-block state?
5. OPEN-5: Is imdUSD redeemable at $1 by anyone in the CDP, and at what size and fee?
6. OPEN-6: Is every imd.fun launch token one non-upgradeable implementation with no owner, pause or blocklist, and what is its runtime code hash?
7. Does the imdUSD/USDC peg pool have a hook, and which permissions does it set, in particular beforeDonate?
8. Is the 20% imdUSD reserve factor acceptable, given that it lowers lender APR by a fifth?
9. Should the longest-tail tokens (below the minimum depth) be served later by an Ajna-style oracle-free product?

8. What is fact, inference and uncertain

• Facts come from the brief's measurements or from the sources in §9.
• Inferences are the DERIVED numbers: constant-product models of depth, manipulation cost and cap. Real launch pools use concentrated liquidity, so on-chain values will differ, which is why the contracts compute from tick liquidity.
• Assumptions about the plane are marked ASSUMPTION.
• Not done in this run:
  • checking the two launch pools;
  • reading oracle-coop;
  • verifying Euler's discount mechanics and governor powers;
  • running any code.

9. Sources (all read 2026-10-21)

1. rekt.news, "Fei Rari – REKT", https://rekt.news/fei-rari-rekt/. Cited for: the 30 April 2022 exploit, about $80M from seven Fuse pools, caused by the Compound fork not following CEI, with ETH call.value re-entry into exitMarket.
2. Morpho docs, "Interest Rate Model", https://docs.morpho.org/learn/concepts/irm/. Cited for: AdaptiveCurveIRM 90% target, 4× steepness, rate-at-target doubling in 5 days at 100% utilisation and halving in 10 days at 45%, immutable IRM, governance-set fee.
3. Morpho docs, "Liquidation", https://docs.morpho.org/learn/concepts/liquidation/. Cited for: the LIF formula (β = 0.3, cap 1.15), partial permissionless liquidation, and bad-debt realisation behaviour.
4. Ajna FAQ, "Liquidations", https://faqs.ajna.finance/faqs/liquidations. Cited for: bonded kicks, 72-hour Dutch auctions starting at 256× with stepped halvings, and bad debt charged to reserves and then the highest buckets.
5. Silo docs, "Architecture", https://docs.silo.finance/docs/developers/protocol-overview/architecture. Cited for: two-asset isolated silos, permissionless factory, deployer-chosen oracles (default price 1 without an oracle), deployer-fixed IRM config and liquidation fee.
6. Chainalysis, "Oracle Manipulation Attacks Are on the Rise" (7 March 2023), https://www.chainalysis.com/blog/oracle-manipulation-attacks-rising/. Cited for: $403.2M lost in 41 oracle-manipulation attacks in 2022, and the Mango Markets thin-asset case.
7. Uniswap v4-core, src/libraries/Pool.sol, https://github.com/Uniswap/v4-core/blob/main/src/libraries/Pool.sol. Cited for: donate dividing by active liquidity and reverting with NoLiquidityToReceiveFees at zero.
8. Euler docs, "Ethereum Vault Connector", https://docs.euler.finance/build/evc. Cited for: deferred account and vault status checks, and atomic liquidation under the controller vault's rules.
9. Uniswap developer docs, "Hooks", https://developers.uniswap.org/docs/protocols/v4/concepts/hooks. Cited for: beforeDonate and afterDonate as the donate hook points (relevant to OPEN question 7).