LAUNCHPAD.FAIL Red Paper:
Reserve Risk, Solvency Controls, and Treasury Backstops
This Red Paper describes the risk, reserve, and solvency design for LAUNCHPAD.FAIL (“LPF”), a protocol for interactive token allocation. The LPF White Paper defines the cryptographic fairness, escrow, and state-channel adjudication model; the Pink Paper defines the economic distribution and launch incentive model. This Red Paper defines the treasury, reserve, max-loss, and risk-control framework required to operate interactive allocation games safely, during early launch conditions and at scale.
LPF games have explicit expected value, but expected value alone does not guarantee solvency — and, under LPF's own fractional cap rules, literal balance-sheet insolvency is not even the failure mode which occurs. When the maximum payout scales down with reserves, the reserve process cannot cross zero; instead, it can grind so low that the payable maximum win falls below any level worth playing for. Version 0.2 therefore redefines the risk target around operational ruin: the event that the safe maximum win stays below a viability floor for a sustained period. The framework bounds the probability of that event through layered reserves, adjudicator-funded active-liability caps, treasury subscription rate limits, payout and entry caps, circuit breakers with a settlement carve-out, and simulation-driven parameter selection.
The core operating principle stays the same: start small, cap losses, simulate aggressively, disclose assumptions, and scale only when reserves and data justify it.
1 Introduction
LPF launch games create real-time token allocation outcomes. A participant contributes or acquires a token amount \(b\), enters a rule set, and receives a final allocation \(A\). The White Paper proves the result can be made fair and adjudicable; the Pink Paper explains how allocations, rewards, vesting, and launch economics are configured. This paper addresses a different question:
How does the protocol avoid ruin?
A game can be mathematically profitable in expectation and still face ruin if: maximum wins are too large; reserve capital is too small; early variance is severe; starting liquidity is thin; the public market cap is too low; reward boosts create excess liabilities; claims arrive faster than edge accumulates; participants concentrate on high-volatility strategies; or token-price reflexivity reduces the effective backstop value. The core principle of the Red Paper:
Expected value is not risk management.
A protocol edge \(h\) creates a positive expected margin, but reserve risk is determined by the full distribution of outcomes, the payout caps, the bet sizing, the liquidity, the claim behavior, and the treasury access. LPF separates four concepts: fairness (was the result computed correctly); expected value (is there a configured long-run edge); solvency (can valid claims be honored); and market resilience (do claims, sells, liquidity, and circulating supply remain stable under stress). This paper concerns the last two — and it begins by fixing what “ruin” even means for a system that caps its own exposure.
2 Risk Model and Notation
Let \(R_t\) denote the effective reserve after round \(t\), \(b_t\) the entry escrowed for round \(t\), and \(A_t\) the gross allocation produced by settlement (White Paper §6.5). The protocol's net reserve change per round is
\[Y_t=b_t-A_t.\]
On a loss, \(A_t=0\) and \(Y_t=b_t\) — the routed escrow, per the Pink Paper's loss route with \(\delta_{\text{vault}}=1\); other routes scale this inflow by \(\delta_{\text{vault}}\). On a win at multiplier \(E_t\), \(A_t=b_tE_t\) and \(Y_t=-b_t(E_t-1)\): the escrow returns inside the gross payout, and the reserve funds the remainder. The reserve evolves as
\[R_{t+1}=R_t+Y_t+G_t-C_t,\]
with replenishment \(G_t\) (edge splits, fees, treasury subscription) and costs \(C_t\) (reward emissions, boosts, operations, liquidity support). Per-round loss is capped: \(Y_t\ge-(W_{\max,\mathrm{eff}}-b_t)\), by the cap bound into each round's commitment (White Paper §10.3).
3 Reserve Architecture
LPF uses a layered reserve architecture; each layer has explicit caps, and no layer has open-ended access to the one below it.
3.1 Per-game bankroll
Each game or launched token has a primary bankroll \(R_{\text{game}}\), which funds ordinary valid claims and absorbs normal variance. It defines the maximum entry size, the maximum payout, pause thresholds, and the reserve health ratio.
3.2 Adjudicator settlement reserve
The adjudicator program requires access to a reserve so that emergency ejects, dispute outcomes, and valid settlements can be honored even when the normal server path fails. Let \(R_{\text{adj},i}\) denote the adjudicator-accessible reserve for game \(i\). This reserve is capped — per-round maximum settlement, per-game cap, per-epoch drawdown cap, global drawdown cap, pause threshold, multisig-controlled replenishment — and the adjudicator never has unlimited treasury access.
3.3 Treasury subscription facility
The Treasury Subscription Facility (“TSF”) is a controlled drawdown mechanism from a multisig or DAO treasury into settlement reserves — a programmable funding authorization, not a blank check. A TSF configuration is \(\text{TSF}_i=(R_{\max,i},D_{\max,i},W_{\max,i},\tau_i,\text{expiry}_i)\): the maximum reserve accessible to game \(i\), the per-epoch drawdown cap, the per-round payout cap, the dispute timeout, and the authorization expiry. A global cap \(R_{\max,\text{global}}\) bounds the sum: \(\sum_i R_{\max,i}\le R_{\max,\text{global}}\).
One honest remark, carried over from the White Paper's admission rule (§10.2 there): the per-epoch rate limit does not change the long-run mathematics of whether the house goes bust. It stretches the random walk out over more time, and buys the reaction time in which humans and circuit breakers can act. Its enforceable value is the admission gate: the server must stop opening rounds when remaining allowance plus vault balance cannot cover a configured tail-loss event across all active rounds.
3.4 Early launch vs mature launch
Early launch mode uses low max win, low max entry, tight per-round loss caps, a small adjudicator reserve, multisig-controlled drawdown, aggressive circuit breakers, minimal boosts, and conservative liquidity assumptions. Mature launch mode relaxes toward larger bankrolls, larger adjudicator reserves, higher caps, automated solvency checks, deeper liquidity, and lower relative treasury dependency. The protocol begins strict and relaxes only when reserves, liquidity, and data justify it.
4 Max Win, Max Bet, and Capped Loss
LPF caps the absolute loss per round. Let \(W_{\max}\) denote the maximum gross payout in quote terms and \(b_Q\) the entry in quote value. The effective maximum multiplier is
\[M_{\max,\mathrm{eff}}(b_Q)=\min\!\Big(M_{\max,\text{rule}},\,\frac{W_{\max}}{b_Q}\Big),\]
so small entries may display large possible multipliers while large entries cap sooner.
| Entry size | Absolute max win | Effective max multiplier |
|---|---|---|
| 0.10 SOL | 1.00 SOL | 10× |
| 0.05 SOL | 1.00 SOL | 20× |
| 0.01 SOL | 1.00 SOL | 100× |
| 0.001 SOL | 1.00 SOL | 1000× |
Under the gross convention, the reserve's maximum loss per round is \(L_{\max}(b_Q)=W_{\max}-b_Q\), conservatively approximated by \(W_{\max}\). Max win derives from reserve and liquidity, never from taste: with \(\eta_R\) the maximum fraction of effective reserve exposable in one round and \(\eta_L\) the maximum fraction of pool quote liquidity a payout may represent,
\[W_{\max}\;\le\;\min\big(\eta_R\,R_{\text{eff}},\;\eta_L\,X,\;W_{\text{policy}}\big).\]
The bound is recomputed per epoch, and the value in force is frozen into each round's commitment as \(W_{\max,\mathrm{eff}}\) (White Paper §10.3), so cap dynamics never reach backward into a live round.
5 Effective Reserve and Market Cap
A project's nominal token supply is not the same as effective reserve. With total supply \(S\), initial price \(P_0\), and fully diluted market cap \(M_0=P_0S\): if a fraction \(\lambda\) of supply pairs into initial public liquidity, the pool token reserve is \(Y_0=\lambda S\) and the approximate quote reserve is \(X_0=\lambda M_0\). In other words, 20% of supply paired at the initial price gives quote-side liquidity of roughly 20% of fully diluted market cap.
5.1 Haircut on token-denominated reserves
Let \(\beta\) be the supply fraction held for backstop use, \(S_{\text{backstop}}=\beta S\), with mark-to-market value \(\beta M_0\). A token-denominated backstop cannot be valued at full mark, because selling it would move the market against the seller. Apply a liquidity haircut \(\chi\in[0,1]\):
\[R_{\text{eff}}=R_Q+\chi\,\beta\,M_0,\qquad \chi=\min\!\Big(1,\frac{\zeta X_0}{\beta M_0}\Big),\]
where \(R_Q\) is quote-asset reserve and \(\zeta\) the pool-depth fraction considered safely liquid. The haircut shrinks when the backstop is large relative to pool depth. The Pink Paper's backstop health (§7.2 there) is stated on these effective values.
5.2 Required backstop fraction
If simulation determines a required effective reserve \(R_{\text{target}}\), the required token backstop fraction is approximately \(\beta\ge(R_{\text{target}}-R_Q)/(\chi M_0)\); if \(R_{\text{target}}>R_Q+\chi\beta M_0\), the launch is under-reserved.
5.3 Low market cap constraint
A low starting market cap means small public liquidity, low effective value of token reserves, payouts that can overwhelm the market, reflexive sell pressure from claims, and hence a reduced safe max win: \(W_{\max}\le\min(\eta_R R_{\text{eff}},\,\eta_L X_0)\). Low market cap directly compresses the game.
5.4 The exit-liquidity double count
6 Ruin, Redefined
Version 0.1 defined ruin as \(R_t<0\) and targeted \(\Pr[\text{insolvency within }N\text{ rounds}]\le\alpha\), with reference values \(N=10^{12}\), \(\alpha=10^{-6}\). Version 0.2 keeps the target's spirit and discards its event, because the event is unreachable under the protocol's own rules.
6.1 Why \(R_t<0\) is the wrong event
The fractional cap rule of §4 ties per-round exposure to the current reserve: \(W_{\max,t}\le\eta_R R_t\). Each round can therefore lose at most the fraction \(\eta_R\) of what remains, and the reserve is a positive multiplicative-type process — it can shrink geometrically, but it cannot cross zero, in the same way a gambler betting 1% of a shrinking bankroll never reaches exactly nothing. Simulating \(\Pr[R_t<0]\) under these rules returns zero by construction and certifies nothing.
6.2 Operational ruin
The real failure is operational. As \(R_t\) grinds down, the caps grind down with it; below some level, the payable maximum win is too small for the game to be worth anyone's time, entries stop, edge income stops, and the launch is dead in every sense that matters — with a positive balance.
Note what this buys. Firstly, the event is reachable, so simulation estimates a real number. Secondly, the event is observable in production — \(W_{\max,t}\) and \(W_{\text{floor}}\) are both onchain-legible — so the risk target doubles as a monitoring alarm. Thirdly, it prices the liquidity channel correctly: a reserve drawdown and a pool-depth collapse both depress \(W_{\max,t}\), so the definition captures market-resilience failures that \(R_t<0\) never saw.
6.3 Drawdown
The maximum drawdown over \(N\) rounds, \(D_N=\max_{0\le i<j\le N}(R_i-R_j)\), remains a useful secondary statistic: configurations minimizing \(\Pr[D_N>(1-W_{\text{floor}}/(\eta_R R_0))R_0]\) keep the cap path away from the floor.
6.4 Estimation for extreme targets
Because \(10^{12}\) rounds and \(10^{-6}\) tails exceed naive simulation, estimation combines Monte Carlo simulation, stress scenarios, analytic concentration bounds, extreme-value modeling of cap-path minima, and importance sampling for rare events. Simulation outputs are parameter guidance, never absolute proof.
7 Monte Carlo Simulation Framework
The Red Paper proposes simulation-driven parameter selection, now targeted at \(\Pr[\mathcal{R}_{\text{op}}]\).
7.1 Simulation inputs
A simulation samples: entry-size distribution; strategy distribution; rule-set mix; eject behavior; terminal outcomes under the capped Appendix-A distribution; payout caps; loss-route inflows \(\boldsymbol{\delta}\); reserve replenishment; claim timing; sell pressure \(\phi\); liquidity depth; reward boosts; seasonal emissions; treasury drawdowns under TSF limits; and pause/circuit-breaker behavior with the settlement carve-out.
7.2 Per-round loop
For each round \(t\): sample the entry \(b_t\); sample the strategy or action policy; sample the terminal event; compute the base allocation; apply the payout cap; apply any boost; compute \(Y_t=b_t-A_t\); update the reserve and the liabilities; apply the claim and vesting schedule; update the pool if claims sell; apply circuit breakers; recompute \(W_{\max,t}\); record the drawdown and the floor-crossing counter; flag \(\mathcal{R}_{\text{op}}\) when the counter reaches \(K\).
7.3 Strategy and correlation
Participant strategy distribution matters: conservative, balanced, degenerate, random, cap hunters (entry sizes chosen to maximize the effective cap), and bonus hunters (optimizing seasonal missions). Simulations must include adversarial and correlated strategies, not only independent random play. One structural fact simplifies the correlation model: rounds are per-participant with independent seed pairs (White Paper §3.1), so terminal events across concurrent rounds are statistically independent. Correlated losses can arise only through correlated behavior — many participants choosing high multipliers in the same epoch — never through a shared crash point. A future shared-round extension forfeits this property and requires this entire section to be redone; that is one reason shared rounds are out of scope for v0.2.
7.4 Bet-size distribution
Entry sizes are heavy-tailed: many small entries, few maximum entries. A mixture model \(b_t\sim\pi_s B_{\text{small}}+\pi_m B_{\text{medium}}+\pi_l B_{\text{large}}+\pi_{\max}B_{\max}\) suffices to start; the \(\pi_{\max}\) component matters most, because risk concentrates in maximum-size play.
8 Parameter Heat Maps and Surfaces
The risk parameters are multidimensional, so the protocol should generate visual risk maps: \(W_{\max}\) against \(R_{\text{eff}}\) colored by \(\Pr[\mathcal{R}_{\text{op}}]\); max entry against market cap \(M_0\); quote liquidity \(X_0\) against claim sell fraction \(\phi\) colored by price impact; backstop fraction \(\beta\) against \(W_{\max}\) colored by effective solvency health. Useful 3-D surfaces include \(\Pr[\mathcal{R}_{\text{op}}]=F(W_{\max},R_{\text{eff}},M_0)\) and \(F(\lambda,\beta,\phi)\). Recommended standing visuals: the two heat maps below and of §8, a drawdown distribution chart, a cap-path fan chart (Figure 2), a stress waterfall, and a solvency health gauge.
9 Early Launch Safety Policy
Early launches use strict caps: a max win near 1 SOL equivalent; entry sizes bounded so no participant exceeds safe exposure; a small per-game bankroll; a capped adjudicator reserve; a multisig-controlled treasury subscription; automatic pause thresholds; boosts disabled or minimal; short seasons with limited budgets.
9.1 Max win example
With \(W_{\max}=1\) SOL, a 0.1 SOL entry can win at most \(10\times\), and a 0.01 SOL entry at most \(100\times\) — the emotional upside of high multipliers survives for small entries while the protocol loss stays bounded.
9.2 Reserve fraction rule
A simple starting rule, \(W_{\max}\le1\%\cdot R_{\text{eff}}\): with \(R_{\text{eff}}=100\) SOL the cap is 1 SOL; if the reserve grows to 1000 SOL the cap can grow to 10 SOL, subject to the liquidity and policy constraints.
9.3 Liquidity fraction rule
A second rule, \(W_{\max}\le0.5\%\cdot X_0\): with quote-side liquidity of 200 SOL, the cap is 1 SOL. The effective max win is the minimum of the reserve-based and liquidity-based caps — and §5.4 applies whenever both the liquidity cap and the token-backstop haircut lean on the same pool.
9.4 Active liability cap
Version 0.1 set \(L_{\text{active}}\le\eta_A R_{\text{eff}}\) with \(\eta_A=0.05\), which contradicted §3.2: a fraction of effective reserve is not money the adjudicator can actually reach, and the worst case is precisely that every active round terminates through adjudication at once. Version 0.2 states the binding form:
9.5 Where the guarantees live
The combination is worth spelling out. Escrow custody (White Paper §10.1) guarantees the participant's principal is adjudicable. The active-liability rule guarantees the vault-funded remainder of every possible win is adjudicable. Together, every promise a live round represents is covered by funds the adjudicator can reach without anyone's cooperation — which is the property that makes the fairness layer's timeout defaults worth having.
10 Solana Control Model
The Solana implementation enforces reserve access through program accounts, vault authorities, and multisig-controlled configuration.
10.1 Treasury vault and subscription account
A multisig treasury controls primary reserve assets and authorizes the game or adjudicator program to access limited funds through a subscription account, which defines: the authorized game; the token mint; the max drawdown; per-round and per-epoch caps; the expiry; a pause flag; the treasury authority; the adjudicator authority; and the settlement program ID. This is the onchain control surface of the TSF.
10.2 Settlement vault
The settlement vault holds assets for normal claims and adjudicated outcomes, replenished by game revenue (loss-route inflows), treasury subscription drawdown, manual multisig deposit, and edge allocation.
10.3 Drawdown rules
A drawdown from treasury to settlement vault is valid only if: the game is authorized; the mint matches the configuration; the amount respects the per-round, per-epoch, and global caps; the subscription has not expired; the game is not paused for new drawdowns; and post-drawdown reserve health remains within policy, unless emergency mode explicitly permits otherwise.
10.4 Parameter updates
Critical parameters are multisig- or governance-controlled: max win and entry sizes, per-game and global reserve caps, drawdown caps, boost caps, season budgets, dispute timeouts, pause thresholds. Every change emits an audit event, and cap changes are prospective only — each live round keeps the \(W_{\max,\mathrm{eff}}\) frozen in its commitment.
10.5 Pause states and the settlement carve-out
| Pause | Meaning |
|---|---|
| pause entries | No new rounds are admitted |
| pause boosts | Base games continue; boosts disabled |
| pause claims | Claims of settled allocations delayed, only under explicit, pre-disclosed emergency policy |
| pause drawdown | Treasury subscription disabled for new admissions |
11 Circuit Breakers
Circuit breakers reduce risk during stress; all of them are transparent, rules-based, and subject to the §10.5 carve-out.
- Reserve health. If \(H_{\text{reserve}}=R_{\text{eff}}/(L_{\text{active}}+L_{\text{claimable}})<H_{\min}\): reduce max win and entry, pause new rounds, disable boosts, trigger treasury review.
- Drawdown. If epoch drawdown exceeds \(D_{\max,\text{epoch}}\): pause new treasury drawdowns, decrease max win, require admin review.
- Liquidity. If pool quote liquidity falls below \(X_{\min}\): reduce max entry, pause acquisition and new launches, display a liquidity warning.
- Volatility. If price or pool reserves move beyond \(|\Delta p|>p_{\max,\Delta}\): pause entries, update max win, increase the reserve valuation haircut \(\chi\).
- Claim pressure. If claims exceed the expected rate: reduce boosts, keep vesting running, pause new high-exposure rounds, trigger treasury review.
- Floor proximity (new). If \(W_{\max,t}\) approaches \(W_{\text{floor}}\) — the precursor of operational ruin — escalate before the \(K\)-epoch window starts running: freeze emissions, open governance review, and if configured, draw the TSF toward the target reserve.
12 Risk Disclosure Framework
Participants should understand: games have negative expected value while \(h>0\); higher multipliers are less probable; maximum wins may be capped, and the cap in force is visible in every signed state; the round amount is the confirmed acquisition output; liquidity and slippage affect entries; claims may be immediate, vested, or locked; emergency adjudication may involve a timeout delay; frontend animation is not settlement authority.
Projects should understand: interactive allocation creates stochastic liabilities; insufficient reserves cause operational ruin well before literal insolvency; low market cap limits the safe max win; thin liquidity raises slippage and reflexive risk; boosts and rewards are liabilities; token-denominated reserves take haircuts, and the same pool must not be counted twice; aggressive emissions create sell pressure; milestone and vesting settings shape circulating supply.
Governance should understand: raising the max win raises \(\Pr[\mathcal{R}_{\text{op}}]\); lowering reserve requirements raises it too; boosts raise liabilities; edge changes move both user EV and reserve growth; vesting changes move circulating supply; TSF caps define maximum drawdown exposure; and no authority governance holds extends to the settlement of committed rounds.
The disclosure principle: the protocol must not present risk parameters as exact science. They are model-driven safety controls under uncertainty; the correct posture is transparent assumptions, conservative caps, continuous monitoring, and fast parameter adjustment.
13 Simulation Outputs and Parameter Selection
A risk report recommends: \(W_{\max}\); \(b_{\max}\); the per-game reserve \(R_{\text{game}}\); the adjudicator reserve \(R_{\text{adj}}\) (which now also bounds concurrency, per §9.4); TSF caps \(R_{\max,i}\); the active liability limit; boost caps; season budgets; pause thresholds; liquidity thresholds; and the pair \((W_{\text{floor}},K)\) defining the operational-ruin event itself. Outputs carry confidence bands, \(\Pr[\mathcal{R}_{\text{op}}]\in[p_{\text{low}},p_{\text{high}}]\) — for rare events a single number misleads. Every recommendation includes stress scenarios: maximum-size players dominating; claims selling into thin liquidity; high-multiplier wins clustering early; boosts activating during a drawdown; a sharp price fall; withdrawn liquidity; server liveness failures forcing adjudication drawdowns; the TSF hitting its epoch cap; and the §5.4 double-count scenario, where backstop liquidation and winner sells share one pool. The safety margin is \(\mathcal{S}=R_{\text{eff}}/R_{\text{target}}\); above 1 the system exceeds the target reserve, below 1 it falls short.
14 Reference Risk Configuration: FUEL
| Parameter | Example |
|---|---|
| Max win | 1 SOL equivalent |
| Max entry | Derived from max win and rule caps |
| Effective reserve target | At least 100× max win |
| Viability floor \(W_{\text{floor}}\), window \(K\) | 0.25 SOL, 14 epochs |
| Adjudicator reserve \(R_{\text{adj}}\) | Small, capped; bounds concurrent rounds via §9.4 |
| Treasury subscription | Multisig-controlled, per-epoch rate limit |
| Active liability cap | \(\min(R_{\text{adj}},\,5\%\ R_{\text{eff}})\) |
| Boosts | Disabled or tightly capped |
| Seasons | Small budgets, checked against Pink Paper Appendix F |
| Circuit breakers | Aggressive, with the §10.5 settlement carve-out |
14.1 Example formula set
Early launch: \(W_{\max}=\min(0.01R_{\text{eff}},\,0.005X_0,\,W_{\text{policy}})\). Active liability: \(L_{\text{active}}\le\min(R_{\text{adj}},0.05R_{\text{eff}})\). Effective backstop health: \(H_{\text{backstop}}\ge1.25\) on haircut values. Drawdown pause: \(D_{\text{epoch}}>D_{\max}\Rightarrow\) pause new entries. Floor proximity: \(W_{\max,t}<2W_{\text{floor}}\Rightarrow\) escalate.
14.2 Scaling up
As data accumulates, the protocol adjusts bet-size assumptions, reserve requirements, max win, boost budgets, liquidity thresholds, treasury caps, and the simulation model itself. Scaling is evidence-driven, never vibes-driven.
15 Relationship to the White Paper and Pink Paper
| Paper | Focus | Question answered |
|---|---|---|
| White Paper | Fairness, escrow, state channels, adjudication | Was the result fair, verifiable, adjudicable? |
| Pink Paper | Token economy, loss routing, rewards, vesting | How are allocations funded, distributed, governed? |
| Red Paper | Reserves, caps, operational ruin, treasury safety | Can the protocol survive its own variance? |
The Red Paper constrains the other two. A launch configuration is unsafe if it cannot satisfy the reserve and solvency requirements — even if it is fair, and even if it is economically engaging. And the constraint runs the other way once: the settlement carve-out of §10.5 is the Red Paper subordinating its own emergency powers to the White Paper's guarantees, which is the correct hierarchy.
16 Conclusion
LPF allocation games require more than fair randomness and clever tokenomics; they require reserve discipline. A protocol can hold a positive expected edge and still fail — not by crossing zero, which the fractional caps forbid, but by grinding beneath the viability floor and staying there, which is the failure this paper now names, measures, and targets. LPF therefore defines a layered risk system: per-game bankrolls; adjudicator reserves that bound total active liability; multisig treasury subscription facilities with honest rate-limit framing; per-round payout caps frozen into round commitments; entry caps; liquidity-aware limits with the double-count corrected; Monte Carlo stress testing aimed at operational ruin; circuit breakers that can never touch a committed settlement; transparent disclosures; and simulation-driven parameter selection.
The most important operational principle remains simple: start small, cap losses, simulate aggressively, disclose assumptions, and scale only when reserves and data justify it. The reference FUEL deployment begins with a 1 SOL max win, preserving high-multiplier excitement for small entries; as reserves, liquidity, and empirical data grow, parameters adjust under governance and multisig controls — every one of which stops at the settlement boundary. The Red Paper turns LPF from a fair game protocol into a risk-managed launch system.
Appendix A: Monte Carlo Pseudocode
For each simulation path: initialize the reserve \(R_0\) and pool reserves \(X_0,Y_0\); set the floor-crossing counter to zero. For each round \(t=1,\ldots,N\): sample the entry \(b_t\) and the strategy; sample the terminal event from the capped distribution; compute the base allocation and apply \(W_{\max,t}\); apply any boost; update the reserve by \(Y_t=b_t-A_t\) plus replenishment minus costs; route losses by \(\boldsymbol{\delta}\); update liabilities and the claim schedule; update the pool if claims sell; apply circuit breakers (settlement always exempt); recompute \(W_{\max,t}\); if \(W_{\max,t}<W_{\text{floor}}\), increment the counter, else reset it; if the counter reaches \(K\), record operational ruin and stop the path. Repeat over many paths; estimate \(\Pr[\mathcal{R}_{\text{op}}]\); fit a tail model or apply rare-event methods for extreme targets.
Appendix B: Risk Map Inputs and Outputs
| Input | Meaning | Output | Meaning |
|---|---|---|---|
| \(M_0\) | Starting market cap | \(\Pr[\mathcal{R}_{\text{op}}]\) | Operational ruin probability |
| \(\lambda\) | Public liquidity fraction | \(D_{\max}\) | Maximum drawdown |
| \(\beta\), \(R_Q\) | Backstop fraction, quote reserve | \(H_{\text{backstop}}\) | Effective backstop health |
| \(W_{\max}\), \(b_{\max}\) | Max win, max entry | \(X_t\), \(S_{\text{circ}}\) | Liquidity and circulating supply paths |
| \(h\), \(\phi\), \(\gamma\), \(\chi\) | Edge, sell fraction, pool fee, haircut | \(W_{\max,\text{safe}}\), \((W_{\text{floor}},K)\) | Recommended cap; ruin event definition |
Appendix C: Example Safety Parameter Calculation
Suppose \(M_0=1{,}000\) SOL, \(\lambda=0.20\), so \(X_0=200\) SOL. Suppose \(R_Q=50\) SOL, \(\beta=0.10\), \(\chi=0.50\). Then
\[R_{\text{eff}}=R_Q+\chi\beta M_0=50+0.5\cdot0.1\cdot1000=100\text{ SOL}.\]
With \(\eta_R=0.01\), the reserve-based max win is 1 SOL; with \(\eta_L=0.005\), the liquidity-based max win is also 1 SOL; hence \(W_{\max}=1\) SOL, supporting a 0.1 SOL entry at a 10× cap and a 0.01 SOL entry at a 100× cap.
The double count, worked. The \(\chi=0.50\) haircut assumed roughly \(\zeta X_0=100\) SOL of pool depth stands behind the token backstop as exit liquidity; the \(\eta_L\) cap assumed the same \(X_0\) absorbs winner sells. Under the joint stress — a capped win pays out and sells while the treasury liquidates backstop tokens — the pool serves both flows at once, and the honest effective reserve is lower than 100 SOL. A conservative recomputation reduces the haircut by the committed pool fraction, e.g. \(\chi'=\max(0,\chi-\eta_L\cdot X_0/(\beta M_0))=\max(0,0.5-0.01)=0.49\) in this mild example, but the correction grows sharply when \(\eta_L\) or the backstop-to-pool ratio grows. The robust discipline: satisfy stress scenarios with \(R_Q\) alone, and treat the token backstop as the recovery layer rather than the stress layer.
Appendix D: Risk Language Template
A participant-facing explanation may say: “LPF rounds have a configured protocol edge. Higher multipliers are less likely to be reached. The maximum win for a round may be capped based on reserve and liquidity settings, and the cap in force is shown in every signed game state. If the server fails during a round, signed checkpoint evidence can be submitted through emergency adjudication, which may require a timeout before settlement; the entry itself is escrowed onchain for the round's duration. Final allocations are based on verified settlement, not frontend animation.”
A project-facing explanation may say: “Interactive allocation creates stochastic liabilities. Launch configuration should be sized using reserves, liquidity, backstop capacity, max win caps, reward budgets, vesting schedules, and stress simulations. Low market cap or thin liquidity requires lower max win sizes and stricter circuit breakers, and a token-denominated backstop must be valued after a liquidity haircut, counting the pool only once.”
Appendix E: Open Modeling Questions
The following require empirical calibration from live data: (1) the participant bet-size distribution; (2) the eject-strategy distribution; (3) the claim sell fraction \(\phi\); (4) liquidity provider behavior; (5) reward boost elasticity; (6) the retention impact of seasons; (7) the correlation of wins and claims; (8) token price volatility; (9) drawdown tolerance; (10) rare-event tail behavior of the cap path; (11) the right \((W_{\text{floor}},K)\) — the viability floor is a product truth, and only players can reveal it.