Permissionless financial infrastructure.

Building blocks for the financial world.

A public record of promises, built from a few blocks, specified to keep four guarantees for every user, with no price feed that can liquidate anyone. Pick an instrument and watch it assemble.

The idea

Bullet loan

Dollars against bitcoin, at a fixed rate for a fixed term.

Live (v1, audited)

No margin calls: there is no price feed that can liquidate you. Repay by the date and your collateral comes back.

How it works

.explore-module__8HEYta__interactive{display:none}

Bullet loan

Live (v1, audited)

The idea

Dollars against bitcoin, at a fixed rate for a fixed term.

No margin calls: there is no price feed that can liquidate you. Repay by the date and your collateral comes back.

What it does

A borrower posts collateral and names the most it will repay; lenders bid the repayment down.

The auction sets the repayment. Repay by the due date and the collateral comes back. Miss it, and after a grace period fixed when the loan opened, the lender takes the collateral in kind.

How it is composed

One obligation and one lien, opened by an auction.

AuctionOrchestrator.createAuctionThe borrower opens an auction; the orchestrator locks the collateral in the vault.
AuctionOrchestrator.placeBidLenders bid the repayment down; the best bid's dollars are held, in the vault or by the orchestrator.
AuctionOrchestrator.finalizeAuctionAnyone may finalise: Obligation records the debt, and the lock passes to a new Lien.
Obligation.pay → Lien.release, claimRepaid: the lien releases and the borrower claims the collateral. Not repaid: anyone may enforce the lien, and the lender collects from Obligation.

Calls on v2's building blocks, from the specifications; not yet deployed.

What it stands on

The rate is discovered by competing bids, not set by anyone.

Read as an option, the borrower's position is a call on the bitcoin: it may repay and take the collateral back, and repaying early costs the full repayment.

Precedent. The pledge and the security interest, and the market and the fair: the old institutions a secured loan and its auction record.
Literature. Composing Contracts (2000): contracts from a few combinators; on Gavel, one obligation and one lien. Merton (1974): the borrower's position as a call.
Alongside. Aave and Morpho: lending markets where a loan can be liquidated when its health factor, from oracle prices, falls below one. No affiliation.
Alongside. Marlowe (2018): a design for on-chain combinator contracts, paying only from funds committed in advance. Gavel records debts, secured by liens. No affiliation.

The argument and its counter-arguments

Insured BTC bill

Designed

The idea

A fixed dollar amount, paid on a set date.

The risk that a borrower does not pay is sold to someone willing to carry it.

What it does

A loan's claim plus cover bought from an underwriter, issued in series and packaged as one token.

The payoff is fixed, but it carries risk: it depends on the underwriter meeting its cover, which is secured by a lien on the underwriter's collateral.

How it is composed

A claim, a cover obligation and their liens, priced by auction.

ObligationA bullet loan's claim is the bill's base.
Underwriter auctionUnderwriters compete to price cover on that claim.
Obligation, LienThe cover is the underwriter's obligation, due if the loan is breached, and secured by a lien on its collateral.
Series mechanismLoans maturing on a standard date are issued as one token per date. Designed; no specification yet.

Designed, not yet specified: the contracts its design notes name, in plain verbs. Function names follow a specification.

What it stands on

Who carries the loan's risk is on the record, and its price is set by auction.

Read as options, a lender's claim is a fixed-rate bond less a put on the collateral; cover buys that put back from an underwriter, leaving a fixed dollar payoff.

Literature. Read as options (Merton, 1974), a lender's claim is a fixed-rate bond less a put; cover buys the put back, leaving a fixed payoff.

The argument and its counter-arguments

Liquidation cover

Idea

Outside Gavel — another lending marketYour position there, unchanged. That market uses a price oracle. Gavel reads the position through a disclosed resolver and changes nothing there. No affiliation.

reads → disclosed by target

The idea

Keep your position on another lending market, and buy cover beside it.

The position stays where it is; the cover sits beside it, on Gavel.

What it does

Cover for the penalty you pay if that market liquidates you.

It pays towards the penalty and does not prevent the liquidation. That market uses a price oracle; the cover reads its state through a disclosed resolver and changes nothing there.

How it is composed

An underwriter's obligation, reading the outside position through a disclosed resolver.

The outside position is read, and the read is disclosed with the cover.
Underwriters compete to price the cover.
The underwriter owes, up to the penalty, if the position is liquidated; its collateral is locked under a lien.
If it is triggered, the cover pays, or the lien is enforced on the underwriter's collateral.

An idea, not yet designed: what each side does, without a contract view.

What it stands on

Where the oracle line is drawn.

Gavel's own contracts are oracle-free by design. The cover reads a market that uses an oracle, and names what it reads, by target, when it is created.

Alongside. Aave and Morpho, where loans are liquidated by health factors computed from oracle prices. Gavel reads such a position, changing nothing there. No affiliation.

The argument and its counter-arguments

Cash-settled future

Designed

The idea

Fix a price today for a date ahead, and settle the difference in cash.

Miners and holders can fix a sale or purchase price for a date, within the margin each side posts.

What it does

Two obligations resolved from a dated SpotAuction clearing, each secured by margin.

It is capped by its margin: a collar, not a future without limit. How the settlement price is read from the auctions is not yet specified.

How it is composed

Settlement read from the protocol's own auctions.

VaultEach side locks margin.
Obligation, LienTwo obligations, each secured by its margin lien.
SpotAuctionAt the date, the spot auction clears.
ObligationThe clearing sets what each side owes; each lien is released or enforced.

Designed, not yet specified: the contracts its design notes name, in plain verbs. Function names follow a specification.

What it stands on

The reference price is discovered on the same record.

No outside feed settles it. The price that settles the contract is one anyone could have traded at.

Alongside. Perpetual futures, which depend on continuous liquidations driven by an oracle. The base layer leaves them out; others may build them.
Alongside. Marlowe (2018): a design for on-chain combinator contracts, paying only from funds committed in advance. This future is capped by its margin. No affiliation.

The argument and its counter-arguments

BOND

Designed

The idea

A public record of credit honoured.

Borrowers who repay build a public credit record, and lenders can see it.

What it does

Minted when interest is paid on secured credit; put at stake on one's own obligations; burned on breach.

A credit record only. It carries no governance, fee or revenue right.

How it is composed

Minted on interest paid in time on an obligation secured by a lien.

ObligationInterest is paid in time on a secured obligation.
BONDBOND is minted for the credit honoured.
BONDIt is put at stake on one's own new obligations.
BONDIt is burned if any of those obligations is breached.

Designed, not yet specified: the contracts its design notes name, in plain verbs. Function names follow a specification.

What it stands on

Reputation, the merchant's good name, on the record.

It is minted as secured, interest-bearing debts are repaid in time and, where staked, burned on breach, on a record that no one administers.

Precedent. Reputation, the merchant's good name: the institution BOND records.

The argument and its counter-arguments

Vault

Keeps conservation, isolation and exits: balances held as accounts, collateral held as locks.

Specified

Who holds what?

Property and possession

Obligation

One promise to pay one amount of one asset at one time, with a claim token for the creditor and a position for the debtor.

Obligation. A claim and its duty, in Hohfeld's terms (1913): one party's right to be paid is the other's duty to pay.

Specified

Who owes what to whom, and when?

Contract and debt

Lien

Keeps resolution: every lien resolves within bounds fixed at its creation.

Lien. A pledge in the shape of secured-transactions law. The first deployment's lien takes the collateral in kind; sale belongs to a variant.

Specified

What makes a promise credible?

The pledge and the security interest

Auctions

Gavel's own auctions discover prices and rates in the open, instead of reading a price feed.

An earlier version runs on the testnet.

Specified

What is a thing worth?

The market and the fair

BOND

A record of credit honoured: minted when interest is paid on secured loans and, where staked, burned on breach.

Designed

Who can be trusted?

Reputation, the merchant's good name

The idea underneath every instrument

Financial contracts compose from a few combinators.

Peyton Jones, Eber and Seward (Composing Contracts, ICFP 2000) showed that essentially every financial contract can be built from a few combinators. Gavel takes that set as its test of completeness: each combinator has a block.

Peyton Jones, Eber and Seward, Composing Contracts: an Adventure in Financial Engineering (ICFP 2000).

Combinator	What it means	Block
`zero, one, scale by a constant, truncate`	Pay a fixed amount at a date	Obligation
`give`	Take the other side	Holding the claim, or the debtor's position
`and, then`	Contracts together, or in sequence	A set of obligations; a trigger for sequence
`scale by an observable`	An amount set by an observation	A resolver
`cond, when`	In force only if a condition holds	A trigger on the obligation
`or, anytime`	The holder chooses	An exercise trigger
`—`	What happens if a party does not pay	The lien: Gavel enforces what the combinators assume

The combinators assume every party performs; the lien adds what happens when one does not. Fixed amounts are in the core; triggers and resolvers arrive with the contingent obligation, which is designed, not yet specified.

Marlowe (2018) and Findel (2017) were designed to run such contracts on blockchains. In Marlowe's design, a payment beyond funds committed in advance fails; Gavel records obligations larger than any deposit, secured by a lien and enforced. No affiliation.

Four guarantees, for every user.

Every contract of v2's base layer is specified to keep them, whatever token, contract or counterparty anyone else has chosen. v2 is unaudited.

Conservation.The vault records each asset only as it measures it entering. Only the token itself can make the vault hold less than it records.

Isolation.No position, lien or account can draw on another's value. A choice of token, contract or counterparty harms only those who made it.

Exits.Every user can always take back what is free to them, subject to the token; a pause can only delay an auction's exits.

Resolution.Every lien resolves within bounds fixed at its creation, extended by any time spent paused; the pause has no maximum.

Permissionless
Gavel's own contracts: oracle-free by design
No price-feed liquidation
No protocol fees
Rules fixed at creation

How a pause affects the guarantees

The core can be paused by its emergency multisig, which cannot move user funds or change terms. A pause stops no exit that was open before it. While it runs, an auction with bids is held: its finalisation is paused and its expiry clock stands still, so its exits open after the pause at the same distance. A pause can delay a lien's resolution for as long as it lasts, but never redirect it.

v1 · Live (v1, audited).The bullet loan on Arbitrum One, audited by Sherlock: the working proof of concept.

v2 · In development.Unaudited. The core — vault, Obligation and Lien — is built; its first testnet deployment is pending.

Understand What the core is, and where it stops.Try The apps on the testnet.Build The contracts are open; anyone can compose on them without permission.