SpyDefi: on-chain capital markets for tokenized equities

Section 1Market context

Global public equities exceed $130 trillion in market value, roughly forty times the entire crypto asset market. The infrastructure that services this asset class has improved incrementally since the paperwork crisis of the late 1960s forced the creation of centralized depositories, but its architecture is unchanged: ownership is an entry in a broker's database, which references an entry at a clearinghouse, which references a custodian. Settlement requires a full business day. Markets operate six and a half hours per weekday.

Within this architecture, the productive uses of equity (collateralized borrowing, securities lending, derivative hedging, dividend monetization) are reserved for institutions with prime brokerage relationships. A retail holder can buy, sell, and wait. The bundling problem runs deeper still: every common share fuses three distinct claims (price exposure, a dividend stream, a governance vote) into one inseparable instrument, so none of the three has independent price discovery.

Since 2023, regulated issuers have brought tokenized equities to public chains with custodied backing and on-chain redemption. Custody is therefore solved. Market structure is not: a tokenized share in a wallet today can do precisely nothing a paper certificate could not do in 1970. SpyDefi exists to build the layer above custody, the layer where the economics actually live.

Section 2System overview

SpyDefi is organized as eight modules sharing one risk engine, one oracle layer, and one revenue pipe. Modules deploy in three phases; each is independently useful, and each compounds the others. A unified account abstraction means a user's collateral, debt, perp positions, and vault shares are netted in a single margin computation.

The protocol holds no equities itself in an issuer sense. It integrates tokens from regulated issuers, treats them as collateral assets with per-asset risk parameters, and verifies issuer redemption mechanics before listing. Listing and parameter changes pass through time-locked on-chain governance held by veSPYFI.

Section 3, Module 01Multi-collateral credit market

The credit market accepts any listed tokenized equity as collateral against USDC debt. Each collateral asset \(i\) carries a maximum loan-to-value \(L_i\) and a liquidation threshold \(\theta_i\), both set from the asset's liquidity depth and its overnight gap risk rather than intraday volatility. An account's health factor is:

When \(H < 1\), the position is eligible for liquidation: any actor may repay a capped portion of the debt and seize collateral at a discount \(\delta_i\), with the penalty split between the liquidator and the protocol revenue pipe. Partial liquidation limits ensure positions are restored to health with minimal collateral loss.

Interest rate model

The borrow rate follows a kinked utilization curve. With utilization \(u = B_{\text{total}} / S_{\text{total}}\) and kink point \(u^*\):

Suppliers of USDC receive \(r(u) \cdot u \cdot (1 - \phi)\), where \(\phi\) is the reserve factor; the spread \(\phi\) routes to the revenue pipe. All curve constants are immutable per market deployment and public.

Oracles and market closures

Price feeds combine the issuer's net asset value attestation with on-chain DEX liquidity and, during US market hours, the primary exchange print. While the underlying market is closed, the oracle reports the last verified price and the perp market's funding-implied price serves as an advisory signal. Liquidation thresholds are sized to absorb a two-sigma weekend gap per asset, which is why LTVs are deliberately lower than crypto-collateral norms.

Section 4, Module 02Auto-compounding yield wrappers

For each listed equity dX, the protocol deploys an ERC-4626 vault sX (sDSPY, sDTSLA, and so on). The vault holds the underlying, harvests dividend distributions and collateral lending income, and re-invests proceeds into more of the underlying. The exchange rate between sX and dX is monotonically non-decreasing:

Because the wrapper is a standard ERC-4626 token, it is composable: sX is itself accepted as collateral in the credit market at parameters derived from its underlying, and downstream protocols can integrate it without custom logic. This is the same composability pattern that made liquid staking tokens the dominant collateral in crypto-native DeFi, applied to equity yield.

Section 5, Module 03Senior / junior tranching

Different capital wants different risk. The tranching module splits any wrapper vault's yield into a senior claim and a junior claim over a fixed epoch. Senior capital receives a capped rate \(r_s\) with first claim on the pool's realized yield \(Y\); junior capital absorbs shortfall first and receives the residual, a levered position on the same flow. With senior principal \(P_s\) and junior principal \(P_j\):

The junior tranche's effective yield is \(Y_j / P_j\), which amplifies both outcomes. Institutional capital that requires predictable, senior-secured yield and risk-seeking capital that wants leverage on the same pool stop competing and start clearing against each other.

Section 6, Module 04The five-layer yield engine

Wrapper yield is not a single number; it is a stack of five independent sources, each of which can be enabled or disabled per vault by governance, and each of which is visible separately on-chain.

Layers L1 and L2 are passive and always-on. L3 and L4 alter the return profile (capped upside, basis exposure) and are therefore offered as distinct vault variants rather than silently mixed in. L5 applies only to stablecoin reserves, never to equity collateral.

Section 7, Module 06Equity perpetuals exchange

The perpetuals module lists linear perps on each supported equity, margined in USDC, with funding paid continuously between longs and shorts to converge the perp price \(P_f\) to the oracle index \(P_s\):

Cross-margin is the structural advantage. A trader long 1,000 dTSLA in the credit market and short 1,000 TSLA-PERP is economically flat; the risk engine recognizes the offset and margins the net exposure, not the gross legs. The margin requirement for an account with positions \(q_a\) across assets is computed against correlated stress scenarios:

Because the underlying market closes nightly while the perp does not, off-hours perp prices constitute a continuous 24/7 price signal for US equities, an instrument that does not exist in traditional markets at retail scale.

Section 8, Module 07Dividend stream tokenization

Any wrapper position can be split, for a chosen maturity \(T\), into a principal token (PT) redeeming one unit of the underlying at \(T\), and a yield token (YT) collecting all dividend and yield flow until \(T\). No-arbitrage fixes the relationship:

The YT market is, in effect, the first liquid forward market for individual equity dividend expectations accessible outside institutional dividend-swap desks. A holder who wants cash today sells the next four years of dSPY dividends in one transaction; a buyer who believes payout forecasts are too low takes the other side. The implied yield curve that emerges is itself novel public data.

Section 9, Module 08Voting rights tokenization

Where the underlying issuer supports pass-through voting, a tokenized share can be wrapped into an economic claim (eX) and a voting claim (vX) for a given record period. The vX token is freely transferable until the snapshot, at which point votes are tallied and submitted through the issuer's rails, and the wrapper unwinds.

The result is honest price discovery on a quantity that has always had value and never had a price. Proxy contests, activist campaigns, and index-fund apathy all imply that votes are worth something; vX markets measure what. Auction-based allocation for contested record dates prevents last-block sniping and routes auction proceeds to vault depositors who supplied the underlying shares.

Section 10, Module 05SPYFI token economics

SPYFI has a fixed genesis supply of 1,000,000,000 with no mint function. Allocation is fully public and fully non-discretionary:

Revenue routing and burn

All protocol revenue \(R(t)\) (interest spread, perpetual trading fees, liquidation penalties) accrues in USDC to the buyback contract. A permissionless execute function swaps capped tranches through the SPYFI/USDC pool under a TWAP guard and burns the output. The supply path is:

veSPYFI

Locking SPYFI for duration \(t_\ell\) (one week to four years) mints non-transferable voting weight:

veSPYFI governs risk parameters and asset listings through a time-locked process, boosts liquidity-mining emissions, and receives the staker share \(\beta\) of revenue. Unlocked SPYFI carries no claim on revenue; the burn is its only structural flow.

Section 11Trust minimization

The protocol's credibility model is structural, not reputational, following the launch pattern that made DAI durable:

• No admin functions. No pause, no override, no allowlist. Parameter changes pass only through time-locked governance, visible days before execution.
• No upgrade path. Contracts are non-proxy and immutable. Successor versions are separate deployments that users opt into voluntarily.
• No insider allocation. The deploying team holds zero genesis supply and acquires SPYFI only on the open market.
• Deployer self-destruction. The deployment account renounces and destroys its privileges within the genesis transaction sequence.
• On-chain solvency. Every liability and collateral balance is a public contract state; solvency is checkable by anyone at any block without attestations.

Section 12Risk framework

No design removes risk; good design names it. In approximate order of severity:

Smart-contract risk

Immutability cuts both ways: a defect cannot be patched in place. Mitigations are audits published in full, a standing bug bounty, deliberately small per-module codebases, and phased deployment so early modules accumulate scrutiny before later ones depend on them.

Issuer and custody risk

Tokenized equities are claims on regulated issuers. An issuer failure, redemption suspension, or adverse regulatory action impairs the collateral regardless of protocol correctness. The listing framework prices this: weaker redemption mechanics mean lower LTV or no listing, and per-issuer concentration caps bound the system's exposure to any single issuer.

Oracle and gap risk

Equities gap across closures. Liquidation thresholds are sized against historical gap distributions per asset, funding-implied off-hours prices are advisory rather than liquidating, and liquidations triggered solely by a stale price during closure are rate-limited.

Liquidity risk

In a stressed market, liquidators must sell collateral into thinner books. Partial liquidation caps, per-asset supply caps tied to observable DEX depth, and the junior tranche's first-loss buffer exist to make stress an orderly repricing rather than a cascade.