The hedge book

Every backed coin's pool is margin on a real market. The hedge book is that, added up — the account all the pairings amount to, stated the way an exchange states one — and, underneath it, who actually holds the positions and what the chain can prove about them.

It is public, at /hedge.

Where the hedge lives, in plain words

The positions are held on Lighter, a perpetuals exchange built as a zk-rollup on Ethereum with a verifiable matching engine. Its accounts live on Lighter's rollup, not on Avalanche, and a smart contract cannot own one. So a tracker's vault cannot hold its own position. Instead:

• the protocol runs a hedge wallet — an ordinary wallet, not a contract — that is a Lighter user;
• every tracker of that wallet is hedged inside the wallet's one cross-margin Lighter account (a wallet may hold at most four sub-accounts, which is far fewer than the trackers, so one account per tracker is not possible); the keeper keeps a per-tracker ledger that attributes each tracker its share of the cash, the positions and the funding;
• the vault stores the wallet's address as its hedgeFunder, and that is the only address the vault can ever send hedge money to;
• Lighter takes USDC straight from Avalanche: it issues the hedge wallet a deposit address on Avalanche (an "intent address"), and a plain USDC transfer to it credits the wallet's Lighter account within minutes. Withdrawals do not come back the same way: Lighter's fast withdrawal pays the wallet on Arbitrum, and the wallet carries the USDC home with Circle's CCTP — USDC is burned on Arbitrum and minted straight into the vault on Avalanche, with no wrapped token and no liquidity pool in between.

That is the honest shape of it: the dollars behind a bonded coin leave Avalanche for an exchange account controlled by a wallet key the protocol holds, and come back by way of Arbitrum and Circle's bridge. The rest of this page is what bounds that, and what you still have to trust.

How the money moves

 out    vault ──fundHedge──▶ hedge wallet                                  on Avalanche
        hedge wallet ──USDC transfer──▶ Lighter's deposit address           on Avalanche
        Lighter credits the wallet's account, booked to the tracker         on Lighter

 back   fast withdrawal ──▶ hedge wallet                                    on Arbitrum
        hedge wallet ──CCTP burn──▶ Circle attests ──mint──▶ vault          on Avalanche

• Out of the vault. LTVault.fundHedge(amount) sends USDC to the hedge wallet and nowhere else. It is capped on chain at fundableUsdc() — the vault's idle USDC above its redemption floor, protocol fees excluded — it refuses before the tracker has bonded, and it refuses while the vault is paused. Only the vault owner or the hedge wallet itself can call it, and neither chooses the destination.
• Into Lighter. The keeper asks Lighter for the hedge wallet's deposit address on Avalanche (createIntentAddress, requested again before every send and compared with the last answer — a different answer is refused until it has been seen three times in a row), checks it is a plain address with no code that is neither the wallet nor the vault, and sends exactly the vault's amount to it with an ordinary USDC transfer. Lighter credits the wallet's account "within a few minutes" (its words); the keeper books the credit to the tracker it came from. Lighter's minimum deposit is 5 USDC; smaller amounts simply wait in the vault until backing adds up.
• Back. To return money, the keeper first shrinks the tracker's share of the position so the equity left keeps the stated multiple, then asks Lighter for a fast withdrawal: a transfer to Lighter's fast-withdraw pool whose memo and recipient are the hedge wallet itself, signed by the wallet key. The pool pays the wallet on Arbitrum — 15 to 20 seconds according to Lighter's docs, for a fee its API quotes (3 USDC per the docs; neither measured live yet), minimum 4 USDC. The wallet then approves exactly that amount to Circle's TokenMessengerV2 on Arbitrum and burns it with depositForBurn towards Avalanche (CCTP domain 1), naming the vault as the mint recipient and itself as the only address allowed to present the attestation. Once Circle has attested, the wallet presents the signature to MessageTransmitterV2 on Avalanche and the USDC is minted straight into the vault. Presenting the attestation cannot redirect the mint: the recipient is fixed in the burn. The wallet presents every attestation itself; Circle's paid forwarding service is not used.
• What the bridge adds. The way back waits for one Circle attestation — seconds to a few minutes according to Circle — on top of the fast withdrawal. Circle's fee on the Arbitrum → Avalanche route, the smallest transfer it accepts and the real latency have not been measured yet, and will be, with a 10 USDC round trip, before any vault money moves. The keeper reads Circle's quote before every burn and refuses to burn above a cap it is configured with. The fast-withdrawal fee and the bridge fee, if any, are costs of the tracker, booked when the leg leaves. The vault's redemption floor is what pays sellers while money is on its way back.
• Nothing counted twice, nothing lost. While a leg is open, the dollars are in none of the obvious places — not in the vault, not yet in the account. The keeper books every leg per tracker — sent to the wallet but not yet transferred to Lighter, transferred but not yet credited, withdrawn but not yet paid on Arbitrum, burned on Arbitrum but not yet minted into the vault — keeps those books on disk across restarts, and counts each dollar exactly once in NAV. A return is only marked paid when the matching Circle message — identified by its own nonce, not by its amount — has minted USDC into the vault. If the books, or the per-tracker ledger, ever disagree with what the venue and the chains show, no NAV is posted for any tracker of that wallet until the difference is explained and repaired by hand.

The keys

The hedge wallet key has to be online on the keeper's machine, because deposits and recalls happen automatically, around the clock. It is a separate wallet from the protocol owner's. It holds two small gas balances that are the operator's money, never a vault's: AVAX on Avalanche, and ETH on Arbitrum for the burn back.

The switches

• Kill switch. The vault owner calls setHedgeFunder(address(0)): from that block, fundHedge reverts for everyone. No further dollar can leave that vault for the venue.
• Pause. setPaused(true) stops fundHedge too, along with minting and redeeming.
• Rotation. A new hedge wallet is: bring the tracker's share of the Lighter balance back to the vault with the old key, then setHedgeFunder(new wallet).

Neither switch can reach money that is already on Lighter, on Arbitrum or in the bridge. There is no on-chain request a vault can send to Lighter: dollars on the venue come back only through the hedge wallet's key — or, as a last resort, through Lighter's own escape hatch on Ethereum, which pays the wallet's address, not the vault.

What you are trusting

• The hedge wallet key. The keeper's code only ever withdraws to the wallet itself and only ever bridges back to a vault. A thief holding the key would not be bound by that code: the recipient of a fast withdrawal is a field the key signs, so a stolen key could withdraw the whole account — every tracker of the wallet — anywhere on Arbitrum, or register a new trading key. The same key can also call fundHedge, so until the owner pulls the kill switch, a stolen key reaches the account and each bonded vault's fundable USDC. The key lives on the keeper machine only, and is a wallet of its own, never the owner key (the deployment script refuses if the two are the same).
• One shared account. Every tracker of a hedge wallet hedges inside one cross-margin account. That nets a long and a short tracker on the same market on the venue, which uses less margin; the cost is that losses are no longer isolated per tracker — a liquidation of the account hits every tracker of the wallet. The keeper sizes every tracker well under the venue's leverage cap.
• Lighter's deposit address. The intent address belongs to Lighter's bridge operator. Dollars sent to it are in flight for the minutes it takes to be credited, guarded by nothing on chain.
• Lighter's fast-withdraw pool. It is a liquidity pool Lighter runs. If it is short, a return waits (the keeper reads the pool's limit before asking and parks a recall the pool cannot pay). The slow path — a secure withdrawal to the wallet's own address on Ethereum after Lighter's delay, about 25 minutes on 2026-09-22 — exists, but is not the keeper's path.
• One hop on Arbitrum. Returning dollars sit on the hedge wallet on Arbitrum between the fast-withdrawal payout and the burn towards Avalanche. For that hop they are guarded by the keeper's code and by nothing on chain.
• Circle's CCTP. The bridge is in the return path. It depends on Circle's attestation service answering, its contracts can be paused by Circle, and USDC has a blocklist Circle controls. A burn that is never attested is money that does not arrive.
• Lighter's custody. Deposits sit with Lighter. Unlike a venue on its own chain, Lighter is a rollup on Ethereum with an escape hatch: an account holder can force an exit on Ethereum if the venue stops answering. That exit pays the hedge wallet's own address, so it still passes through the wallet key.
• The keeper. It trades the account and signs NAV. A keeper that stops rebalancing, or trades badly, costs the trackers; the API key cannot move money out of the account to a stranger, but it can lose it in the market.

Several Lighter details are read from its public API and docs and have not yet been exercised with money — whether the deposit address is stable, the fast-withdrawal fee and pool limits in practice, the exact permission model of API keys. Where this page states them, it states what Lighter's docs and API showed on 2026-09-22; the first small-size tests come before any vault money moves.

One position per tracker, not per coin

A tracker carries a single position, on one market, inside the hedge wallet's account. Every coin bonded onto NVDAx5 puts its backing behind the same Nvidia exposure, so the book sums their backing before it computes anything:

margin(u)   = sum of the backing of every coin on tracker u
size(u)     = margin(u) · leverage / entry
notional(u) = size(u) · mark
PnL(u)      = size(u) · (mark − entry) · (+1 long, −1 short)

Each row opens to show which coins are behind it and what share of the position each one owns — split pro rata on backing, because a pooled position carrying one averaged entry has no other honest way to attribute itself.

This table is the position the coins' backing amounts to — what the hedge wallet is meant to carry — computed from the chain and marked at Lighter's price. It is not a read of the Lighter account, which is not public.

What each column means

Below the positions, a second table lists every tracker's hedge wallet, what its vault could send right now, and every HedgeFunded payment it has made, each linked on Snowtrace.

The account behind each row

The hedge wallet's Lighter account is cross-margined: one USDC balance backs every position in it, and a tracker's leverage is its notional divided by its share of the equity. Keeping the multiple is therefore a matter of trading the difference — when the position gains, the keeper buys a little more; when it loses, it sells a little down with a reduce-only order — rather than closing and reopening anything.

The keeper never sizes past 90% of the leverage Lighter allows on the market. It only sends immediate-or-cancel limit orders, priced off Lighter's mark within 0.5%; an order that does not fill is tried again on the next pass, and a market the venue marks inactive, frozen or reduce-only can be shrunk but not grown. Lighter charges no trading fee on a Standard account.

Liquidation

Lighter liquidates an account when its equity falls below its maintenance margin: the position's notional times the market's maintenance margin fraction m (3% on its 20× markets, 6% on its 10× markets, 2.4% on gold and silver, about 2% on QQQ, 1.2% on SPY, read from Lighter's market details on 2026-09-22). With E the entry and L the leverage, a single position reaches that point at:

long    P_liq = E · (1 − 1/L) / (1 − m)
short   P_liq = E · (1 + 1/L) / (1 + m)

The size cancels out entirely, which is why a leg's liquidation depends only on its entry, its leverage and its market — and why adding backing at a new mark moves it, through the averaged entry.

These are moves from entry before funding, for a position nobody rebalances, and for a tracker alone in the account: because the account is shared, another tracker's losses can bring the liquidation closer, and another's gains push it further. The keeper de-levers long before that point. Lighter's own liquidation logic for the account is the authoritative one; it charges a 1% liquidation fee.

Why the account leverage is not exactly the stated multiple

Notional is divided by equity, and equity moves with unrealised PnL. A book losing money carries more leverage than it opened with, and the number goes up — which is precisely the thing worth seeing. A book showing a flat 5× through a drawdown would be hiding it.

Checking it yourself

What the chains prove — every dollar that left for the venue and every dollar that came back:

LTFactory.venueRouting(lt)     → (marketId, trader)   // Lighter market id; trader = the hedge wallet
LTVault.hedgeFunder()          → the only address fundHedge can pay; 0x0 = cut off
LTVault.fundableUsdc()         → what the vault could send it right now
LTVault.bonded()               → false: NAV pinned at 1.0, nothing can leave for the venue
LTVault.paused()               → true: nothing leaves, nothing mints or redeems
HedgeFunded(to, amount)        → emitted by the vault for every dollar sent to the hedge wallet
NAVOracle.hedgeEquityUsd()     → the tracker's share of the account equity the keeper signed with the last NAV

The rest of the trail is public too: the hedge wallet's USDC transfers to Lighter's deposit address on Avalanche, the fast-withdrawal payouts to it on Arbitrum, its CCTP burns on Arbitrum, and the mints into the vault on Avalanche. A dollar coming back arrives as a USDC Transfer from the zero address to the vault, emitted by the USDC contract (0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E) in the same transaction as the MessageReceived event of Circle's MessageTransmitterV2.

The venue side is public for markets, not for accounts. Lighter's public API gives any market's prices, margin fractions and funding with no key — https://mainnet.zklighter.elliot.ai/api/v1/orderBookDetails?market_id=110 for Nvidia, and …/api/v1/funding-rates for every market's funding. An account's balances and positions are only readable with that account's credentials; until Lighter offers a public view, the venue side of each tracker rests on the keeper's signed equity and on the withdrawals that land back in the vault.

Live, and honestly so

Marks are Lighter's mark price, refreshed about every 15 seconds, so the book moves as the market moves. The positions themselves — margin, size, entry — are re-read from the chain, because they only change when someone trades a coin. Funding is settled on Lighter every hour and shows up in the account's equity, not in the table.

Lighter lists its stock, index and commodity markets around the clock, with no closed-market price band, so the book keeps marking through nights and weekends; the price can still gap when the underlying market reopens. A market the venue halts cannot be resized until it resumes. When a market the venue cannot quote appears, its leg says so and is left out of the totals rather than counted as flat. An unknown price is not a zero.