| Limit | Value | Why |
|---|---|---|
| Global package pool | $5,000,000 | Hard cap on total stock emission. When the pool is used, claims stop. |
| Per-wallet cap | $250,000 | No single wallet can take a disproportionate share of the pool. |
| Minimum claim | $10 | No dust spam. |
| Price staleness | 7 days | Claims revert if the price oracle hasn't been refreshed. |
| Price deviation | ±50% / update | A fat-fingered oracle update can't 100× anyone's package. |
| Reward payouts | ≤ funded pot | Rewards come only out of USDG the treasury paid into the pot. The stream is hard-capped by rewardsPot − rewardsOwed every time it advances, idle time with no holders is skipped rather than paid retroactively, and a new buyer inherits nothing that streamed before they arrived. |
| Redemption lock | 0 (none) · max 72h | Redemption to USDG is open immediately and forever — it works even if buys are paused. The owner can arm a lock of at most 72h for new buys, and setting it back to 0 unlocks every existing package at once: the gate only ever loosens. The $VASAI stake has no lock at all — unstake() is callable any time. |
All limits are enforced by the StockPackage contract and readable on-chain by anyone.
The quoting engine implements Avellaneda–Stoikov market making — the classic academic strategy behind open-source bots like Hummingbot: a reservation price skewed by inventory, and a spread driven by volatility and order-book liquidity. Around it sits a defensive risk layer:
| Guard | Behavior |
|---|---|
| Volatility circuit breaker | A stock moving more than the profile limit (6–12% / 24h) goes RISK-OFF — no quotes. |
| Drawdown guard | If the package falls beyond the profile limit below basis, ALL quoting halts; monitoring continues. |
| Stale-data guard | No quotes on market data older than 5 minutes. |
| Spread floor | The agent never quotes tighter than fee break-even. |
| Risk profiles | Safe / Balanced / Aggressive — you choose how wide the agent quotes and how early it stands down. |
| Layer | Status | Detail |
|---|---|---|
| Non-custodial vault | LIVE | Only the depositor can withdraw. Owner can only pause new deposits — there is no drain function. |
| Minter-gated stocks | LIVE | Stock tokens can ONLY be minted by the StockPackage contract. Direct self-mint is impossible. |
| Reentrancy defense | LIVE | OpenZeppelin ReentrancyGuard + checks-effects-interactions in every state-changing function. |
| Attack test suite | 14 TESTS | Direct-mint, minter takeover, oracle attacks, double-claim, withdraw→redeposit re-mint, cap overflow, dust, pause — all verified to revert. |
| Frontend hardening | LIVE | Strict CSP, no secrets in the client, exact-amount ERC-20 approvals, chain-id checks. |
| Independent audit | BEFORE MAINNET | Full third-party audit of vault + package + trading module. |
| Multisig + timelock | BEFORE MAINNET | Owner keys move to a multisig behind a timelock. |
| Chainlink oracle | BEFORE MAINNET | Owner-set reference prices are replaced by Chainlink feeds. |
VASAI is in public prototype: wallet connection, deposits/withdrawals, capped stock-package claims and the risk-managed quoting engine are live on the test network. Trade fills shown in the terminal are a paper-trading simulation on real prices and are always labeled SIMULATED. Live trading, real fees and mainnet launch follow the audit.
Disclaimer. Nothing here is financial advice. VASAI is experimental software in active development; test tokens have no monetary value. Do not deposit funds you cannot afford to lose. Digital assets are volatile and market making can lose money.