A Solvency-Secure, Next-Gen Perpetuals Exchange
Vest is a trustless, composable financial ecosystem built around the core principles of fairness, robustness, and trust. It is designed to maximize capital efficiency while maintaining system solvency, enforcing fair pricing, and ensuring that both traders and liquidity providers (LPs) are properly compensated for the risks they take. The first product in the Vest ecosystem, and the focus of this report, is Vest Exchange, a decentralized exchange currently offering perpetual futures with plans to incorporate synthetics, RWAs, and spot markets.
At the heart of Vest is zkRisk, a quantitative risk engine that continuously prices the cost of insolvency into every trade. Unlike many perpetual DEXs where LPs passively absorb trader PnL, Vest actively shields LP capital by using protocol-owned liquidity as a buffer and dynamically adjusting trading fees and funding rates based on real-time portfolio risk. This mechanism ensures that liquidity remains available, even under stress, and that LPs are only exposed to risks they are paid to take.
Key Takeaways
- Order book fragility: Centralized order books rely on external market makers who retreat under volatility, causing spreads to widen and slippage to spike (precisely when liquidity is most critical).
- Perp DEX evolution: The perp DEX landscape has shifted from synthetic assets and static vAMMs to hybrid models, app-chains, and dynamic vAMM pricing, each learning from past failures to improve scalability, capital efficiency, and risk controls.
- Design trade-offs in DeFi perps: Perp architectures like CLOBs, vAMMs, oracle-based models, hybrids, and borrowing-based AMMs offer different balances of execution quality, decentralization, and solvency risk.
- Risk-indifferent design: Vest uses protocol-owned liquidity and zkRisk to quantify and price insolvency risk in real time, making the system solvency-aware by design.
- Mathematical solvency guarantees: Vest’s zkRisk engine uses Entropic Value-at-Risk (EVaR) to continuously assess exchange-wide default probability and price trades based on their marginal risk.
- Risk-priced dynamic fees: Vest replaces fixed funding and trading fees with real-time Premia and funding rates that increase with risk and fall when trades improve solvency.
- Aligned incentives and LP protection: Vest LPs are shielded by an AMM buffer and paid based on actual risk, not trader losses, ensuring neutral exposure.
- Capital efficiency without compromise: Vest achieves capital efficiency by removing arbitrary OI caps, maintaining solvency through dynamic pricing, and avoiding reliance on external liquidity providers.
Background
Building a decentralized exchange (DEX) entails understanding the core principles behind traditional exchanges in the financial world. In crypto, centralized exchanges (CEXs) operate on a Central Limit Order Book (CLOB). This mechanism comprises an order book (a database of buy and sell orders) and a matching engine that executes these orders based on price, amount, and time of placement.
Order types like market, limit, and stop-loss orders significantly influence the dynamics of the order book, dictating the flow of trades and their execution. The matching engine typically prioritizes orders through a Price-Time Priority algorithm, ensuring that orders at the same price are executed in the order they were received.
The settlement process, vital for the actual transfer of assets post-trade, involves clearing positions, and necessitates robust risk management strategies to prevent defaults and ensure operational smoothness. To support high-frequency and algorithmic trading, exchanges invest in advanced hardware and software capable of handling large data volumes in real time.
Despite the perceived fairness of CLOBs with transparent order flows, equal access, and efficient price discovery, the reality is that CEXs do not own their liquidity. Instead, they rely on external market makers who “rent” liquidity to the platform by continuously placing bids and offers. These entities are not obligated to stay, and their participation is driven by profitability and risk appetite. This dependency creates structural fragility. In periods of high volatility or uncertainty, market makers often withdraw to de-risk their books, exactly when liquidity is needed most. The result can be sudden spreads widening, price dislocations, or even liquidity crises.
Building an order book exchange introduces a fundamental challenge: liquidity must be bootstrapped from external market makers. But attracting these participants is neither trivial nor cheap. Market makers need sufficient incentives to allocate capital and maintain active quotes, especially in illiquid markets where spreads are wide and risk is high. This creates a chicken-and-egg problem: without liquidity, there’s no volume; without volume, there’s no incentive for market makers to engage. As a result, many new order book exchanges must pay for liquidity provision or act as market makers themselves, both of which introduce trade-offs in scalability, neutrality, or operational complexity.
In crypto, an alternative approach is exemplified by Hyperliquid’s HLP, a system where users can pool capital into a decentralized market-making community-funded vault. Instead of relying solely on professional firms, this model sources liquidity from the community and uses internal strategies to quote across all markets. This solves the cold start problem by ensuring that new listings have immediate market coverage. For instance, that allows Hyperliquid to be fast listing new pairs as well as taking some risks by listing long-tail assets. However, this structure comes with its own trade-offs. During extreme volatility, traditional market makers can exit to protect their books – HLP may not always be able to, as it is subject to the setting of some risk parameters. For example, in addition to market making, HLP is also used for backstop liquidations. When positions cannot be sold into the orderbook, the vault steps in and takes over the position, which is often a profitable undertaking market stress. However, when backstopping liquidations, HLP takes on directional exposure, effectively becoming the counterparty of last resort. This exposes depositors to losses in the same conditions where professional market makers would typically pull back, highlighting a trade-off between liquidity resilience and passive risk absorption.
This is exactly why we need DEXs offering alternatives to CLOBs, not only because of the “decentralization ethos” but also because there is a need to overcome the challenges of CEXs and CLOBs, enabling new ways for market participation where retail investors can contribute as liquidity providers without reliance on intermediaries.
Compared to CLOBs, vAMMs offer several structural advantages, many of which motivate Vest’s decision to adopt this model. Because there is no visible order book, vAMMs neutralize predatory behaviors common in CLOBs like spoofing, sniping, and latency arbitrage, where traders can be frontrun based on displayed intent. Pricing in a vAMM like Vest’s is deterministic and based on the marginal risk a trade introduces, not order flow, thus removing the liquidity gap problem and improving predictability during volatility. For traders, this means transparent costs in the form of calculated premia and funding rather than hidden slippage and spread. For LPs, it ensures risk-adjusted compensation based on actual exposure rather than being passively matched against toxic flow.
An Overview of the Competitive Landscape
Perpetual futures have emerged as one of the most important verticals in DeFi, combining leverage, speculation, and composability into permissionless markets. Perps DEXs offer an alternative to centralized venues, enabling users to trade without KYC and giving builders a platform to experiment with new primitives that aren’t possible off-chain. Their decentralized nature brings greater transparency, censorship resistance, and asset self-custody (critical properties in an industry shaped by distrust in centralized intermediaries).
As on-chain infrastructure improves, perpetual DEXs are rapidly evolving to compete with CEXs in performance, liquidity, and user experience. The landscape today features a growing diversity of designs, each optimizing for different trade-offs across scalability, risk management, and market depth.
The Historical Evolution of Perpetual DEX Designs
The design space for decentralized perpetual futures has evolved rapidly over the last five years, shaped by performance limitations, security challenges, and shifting user preferences. From early experiments with on-chain order books and virtual AMMs (vAMMs) to today’s high-speed app-chains and intent-based models, each generation of perpetual DEXs has addressed the shortcomings of its predecessors.
In the early years (2018–2019), decentralized derivatives were still in their infancy. Platforms like dYdX initially focused on lending and margin trading on Ethereum, without yet supporting perpetual contracts. At the time, the perpetual swap remained largely a centralized product, popularized by BitMEX. On-chain experiments leaned toward synthetic assets, like MakerDAO’s CDPs or prediction markets on Augur, but lacked the infrastructure for scalable, high-performance derivatives trading. EtherDelta’s attempt at an on-chain order book in 2017 showed that full decentralization came with prohibitive tradeoffs in latency and cost, steering future designs toward AMMs.
The first true wave of perpetual DEXs emerged in 2020. dYdX launched its first perpetual product on Ethereum using a hybrid architecture with off-chain order matching and on-chain settlement. However, the high gas costs and limited throughput of Ethereum constrained growth. Around the same time, Perpetual Protocol released its v1 on xDai (later migrated to Optimism), introducing the vAMM model. This allowed traders to take leveraged positions against a constant product curve, removing the need for counterparties. Perp v1 saw rapid adoption thanks to $PERP incentives and accessible leverage, but the design proved fragile under stress, and eventually leading to over $5.7 million in losses, followed by its sunsetting, during the 2022 market crash.
By 2021, attention shifted toward L2 scalability and oracle-based pricing models. dYdX v3 launched on StarkEx, achieving near-CEX performance through off-chain order books and on-chain settlement via a single sequencer. It became the dominant perp DEX by volume, attracting institutional market makers and thousands of users. Meanwhile, Perp v1’s limitations prompted the launch of Perp v2 on Optimism, which integrated with Uniswap v3 to bring concentrated liquidity into the perp trading experience. This marked a move from vAMMs to real, on-chain liquidity provisioning, which improved capital efficiency but at the cost of complexity for LPs.
The same year saw growth in oracle-based models. GMX, launched on Arbitrum in September 2021, combined Chainlink oracles with a pooled collateral model (GLP) to offer low-slippage perp trading. Gains Network followed a similar approach, enabling synthetic trading on forex, crypto, and equities using $DAI and Chainlink feeds. These platforms prioritized smooth execution and composability over traditional order book mechanics. Meanwhile, Solana’s high throughput enabled on-chain order books like Serum and Mango Markets, though the latter would later suffer a high-profile oracle manipulation exploit.
2022 served as a stress test for many of these designs. Perpetual Protocol v1 collapsed during the Luna meltdown due to structural issues with its vAMM model. Price volatility overwhelmed its liquidation system, especially on the CREAM/USDC market, where large positions became under-collateralized faster than oracles could update, triggering a cascade of liquidations. The team ultimately decided to sunset Perp v1 and compensate affected users, later rebranding the protocol as Nekodex to reflect its shift toward more robust, risk-aware infrastructure. Mango Markets was later exploited for over $100 million via a manipulation of its own token. GMX, however, proved relatively resilient during these drawdowns, although its GLP design exposed LPs to directional risk in trending markets.
New designs began to incorporate hybrid architectures. Drift v2 introduced a Dynamic Limit Order Book (DLOB) layered on top of its AMM engine, enabling order book-like functionality while retaining pooled liquidity. Vertex, launched on Arbitrum in early 2023, took this further by integrating spot, perps, and lending markets in a single interface. These models aimed to combine capital efficiency, flexibility, and performance, delivering a CEX-like experience with on-chain infrastructure.
In parallel, infrastructure-level experimentation accelerated. dYdX announced its migration to its own Cosmos-based app chain (v4), aiming to decentralize its matching engine by embedding it into the validator layer. The chain launched in late 2023 with frequent batch auctions and other MEV-mitigation features. Other chains like Injective and Sei also embraced app-chain models with native order book modules, while Kujira repurposed its infrastructure to support similar primitives. Hyperliquid, emerging from stealth in early 2023, built its own L1 tailored to ultra-fast matching, zero gas fees, and a native community-owned vault (HLP) to provide liquidity through multiple market making strategies, perform liquidations, and accrue platform fees (challenging the tradeoff between decentralization and performance head-on).
Beyond traditional perps, 2023 saw the emergence of more experimental models. Infinity Pools proposed no-liquidation perps by dynamically borrowing against liquidity curves. Panoptic explored AMM-based options and perpetual options. These projects signaled growing interest in rethinking leverage and risk mechanics from first principles.
Alongside these experiments two up-and-coming perp DEXs gained traction. Lighter uses a full CLOB but runs it inside a custom zk‑rollup (“zkLighter”), publishing zero‑knowledge proofs that every match and liquidation obeys price‑time priority. The structure delivers sub‑5 ms latency and CEX‑like throughput, yet it still inherits classic CLOB liquidity risks: if market makers widen spreads or pull quotes during volatility, order‑book depth evaporates and traders face slippage or failed fills. Ostium targets commodities, FX, and other RWAs, and it pipes tight bid‑ask spreads from deep TradFi order books into an on‑chain peer‑to‑pool engine. Traders always transact at the oracle’s best bid/ask, but a shared liquidity vault is the counterparty. That pool earns fees and funding yet shoulders inventory imbalance risk whenever order flow is one‑sided; extreme directional moves can drain the Liquidity Buffer (the primary settlement layer for trader PnL that enables traders to execute trades without an immediate trading counterparty) capital, thus activating the temporary utilization of the LP Market Making Vault to cover potential trader gains.
By 2024, the space had matured. Most major perp DEXs converged around features like cross-margin, advanced liquidation engines, and deep DeFi composability. Intent-based perp models like Symmio began to emerge, where users specify trade goals rather than placing traditional orders, and solver networks compete to execute trades optimally. Vest Exchange entered the market with a fully on-chain risk engine (zkRisk), offering perps with dynamically priced liquidation costs and no reliance on external market makers. Designs were no longer polarized between AMMs and CLOBs, instead, they blended elements of both, often incorporating off-chain components and sophisticated internal risk systems.
The evolution of perp DEXs reflects an ongoing attempt to balance decentralization, performance, and robustness. Each wave of innovation (whether vAMMs, oracle-based models, hybrid architectures, or custom chains) has been informed by the shortcomings of the last. Failures like Perp v1’s insolvency or Mango’s oracle attack became lessons, while new models aim to internalize risk, reduce slippage, and restore trust in on-chain derivatives.
A Framework for Understanding Perpetual DEX Architectures
Perpetual DEX designs vary widely in how they source liquidity, set prices, and manage risk. These design choices impact user experience, capital efficiency, decentralization, and protocol sustainability. Most existing architectures fall into five broad categories: CLOBs, vAMMs, oracle-based systems, hybrids, and borrowing-based AMMs. Each comes with distinct trade-offs.
Order Book-Based Models (CLOBs) follow the traditional market structure seen on CEXs, where users place limit or market orders and counterparties, often professional market makers, fill the other side. Examples include dYdX, Hyperliquid, Aevo, and Injective. This model excels at transparent price discovery, supports advanced trading strategies, and provides depth for liquid assets. However, it requires fast execution environments and reliable liquidity providers. Most implementations rely on off-chain matching engines with centralized sequencers powering app-chains to reach sufficient performance. While the oracle is used to anchor index prices and calculate funding rates, actual trade execution depends on the available bids and asks in the order book.
vAMM-Based Perps, pioneered by Perpetual Protocol v1 and Drift v1, replace the need for counterparties with a virtual pricing curve, allowing trades to be executed against a formulaic model rather than real liquidity. These systems allow permissionless market creation and do not require active liquidity providers. However, the protocol itself absorbs the net PnL of users, effectively becoming the counterparty in imbalanced markets. This makes risk management critical: parameters such as funding rates and the curve’s sensitivity (k-value) must be carefully tuned to prevent insolvency (if k is too low, the market becomes shallow and small trades can cause large price swings; if k is too high, traders can open oversized positions with little slippage, leading to dangerous OI imbalances) during directional market moves.
Oracle-Settled Perps, used by protocols like GMX and Gains Network offer low-slippage trading by filling user orders at prices fetched directly from external oracles. Traders do not move the price through their order size; instead, they receive fills at the oracle price. This model simplifies the trading experience and enables exposure to a wide range of assets (i.e., long-tail tokens, stocks, and forex) so long as a reliable oracle feed exists. However, risk is shifted entirely to the liquidity providers, whose pooled capital serves as the counterparty. If traders win, LPs lose, and vice versa. Sustaining this model requires careful controls on position sizes, asset exposure, and dynamic fee adjustments to protect the pool from being drained during unbalanced trading flows.
1/ quick thread on the GMX "exploit" last night
having sat on crypto dealing desks for many years, I know that offering liquidity to savvy traders is a painful but necessary part of the game
GLP holders learned that same lesson last night! pic.twitter.com/fGm866BRCJ
— Joshua Lim (@joshua_j_lim) September 18, 2022
Hybrid Models aim to combine the advantages of CLOBs and AMMs. Platforms like Vertex, Drift v2, and dYdX v4 implement systems where an on-chain AMM provides passive liquidity while user orders are matched via an order book, often coordinated off-chain for performance. In these designs, the AMM acts as one of the market makers on the book, providing baseline liquidity even when counterparties are absent. This structure improves capital efficiency by combining passive and active liquidity while also providing fail-safes: if the off-chain matcher fails, the AMM remains as a fallback mechanism. Hybrids often feature cross-margin systems and unified accounts, with risk controls enforced through oracles to maintain solvency and prevent manipulation.
Borrowing-Based AMMs represent a more experimental class, with Infinity Pools being the clearest example. In this model, traders borrow liquidity from AMMs (typically concentrated liquidity in Uniswap v3-style pools) to take leveraged positions. For example, going long on $ETH involves borrowing $USDC from liquidity positioned below the current price, creating a built-in stop-loss at the LP’s range. This eliminates liquidations: the trader repays by selling into the LP range when price falls, with the LP assuming the asset. In return, traders pay a borrowing fee, much like option premiums. The system is deterministic and oracle-less, as pricing is entirely defined by AMM curves and smart contract logic. This model is extremely capital efficient for traders but exposes LPs to concentrated directional risk, turning them into de facto insurance providers. Though promising, it remains relatively untested at scale.
Each architecture reflects different priorities. CLOBs optimize for price discovery and execution flexibility but require fast infrastructure and market makers. vAMMs remove counterparty dependence but expose the protocol to directional risk. Oracle-based models deliver smooth UX and asset diversity, but LPs shoulder volatility and counterparty risk. Hybrids strike a middle ground by integrating passive AMMs with order-driven markets, while borrowing AMMs reimagine leverage and liquidation altogether, offering novel risk-sharing mechanics between traders and LPs.
In practice, many protocols blur these categories. For instance, Synthetix Perps v2 introduces batched order execution and configurable delays, mimicking some order book behavior. Injective supports order books but tokenizes positions, allowing LP-like strategies. These overlaps illustrate how perp designs are converging, with innovations increasingly blending models to optimize for capital efficiency, robustness, and user trust.
As perpetual DEX design matures, the emerging framework is not about choosing between CLOB or AMM, but about how to dynamically allocate risk, coordinate liquidity, and price it in real time. Each model is a different answer to the same core challenge: how to build scalable, permissionless derivatives markets without centralized intermediaries.
Why CLOBs Fail When It Matters Most
Despite their ubiquity in both TradFi and crypto, CLOBs suffer from a fundamental design flaw: they do not control their own liquidity. Instead, they outsource pricing to third-party market makers: external agents with no obligation to the exchange and that have an incentive to act in their own interest. For instance, when volatility spikes, market makers pull bids, widen spreads, and protect their inventory. The result is a system where liquidity is removed by those who control it when traders need it most.
An illiquid order book amplifies both volatility and slippage. For example, suppose a large trader places a $20M market buy order for $BTC, with the current price at $50k. If only $8M worth of $BTC is available at that level, just 40% of the order is filled at the initial price. The remaining $12M must be filled at progressively higher price levels, depending on available liquidity, finally filling the order at $50.5k. While this results in just a 1% slippage in this case, the impact can be significantly greater for less liquid tokens, leading to substantial costs for trades.
Take the December 2024 $BTC flash crash. The order book spread widened to over 1.5%, and a $10K market sell saw nearly 1% slippage.
1/6 CASE STUDY:
BTC Flash Crash (12/6/24) revealed critical flaws in traditional exchanges…
– Orderbook spread widened significantly (>1.5%)
– Millions worth of positions got liquidated
– $10K position suffering ~1% slippage during market sellSo what happened? 🤔🧵 pic.twitter.com/JBN57ekCHl
— Vest (@VestExchange) March 18, 2025
Liquidity evaporated as everyone tried to sell and no one was willing to buy. Sell orders cascaded into lower bids, triggering a feedback loop of liquidations and further price drops. Traders were forced to exit at progressively worse prices. Market makers had already left.
1/6 CASE STUDY:
BTC Flash Crash (12/6/24) revealed critical flaws in traditional exchanges…
– Orderbook spread widened significantly (>1.5%)
– Millions worth of positions got liquidated
– $10K position suffering ~1% slippage during market sellSo what happened? 🤔🧵 pic.twitter.com/JBN57ekCHl
— Vest (@VestExchange) March 18, 2025
This isn’t a one-off. Hyperliquid, the first DEX to meaningfully challenge CEXs in market share, experienced two incidents in March that exposed potential vulnerabilities in its market design. These were not protocol exploits, but attacks that exploited assumptions in the system’s risk management design.
On March 12, a trader opened a ~$270 million long position in $ETH with approximately ~$10 million in margin. Rather than closing the position on the market, where slippage would have impacted execution, the trader incrementally withdrew collateral. This had the effect of realizing gains and gradually raising the liquidation price. When the position was ultimately liquidated, Hyperliquid’s matching engine could not unwind the trade through the order book alone. The HLP vault (Hyperliquid’s internal, community-funded market maker) absorbed the risk and sold into a falling market, resulting in a $4 million loss.
This was possible because the system allowed traders to withdraw unrealized PnL as collateral, enabling them to reduce margin while keeping large positions open. In this case, as $ETH rallied, the attacker incrementally withdrew gains until triggering liquidation, eventually netting $1.8 million in profits while HLP absorbed a $4 million loss. Although the loss represented just 1% of HLP’s TVL, it exposed the challenges of margin calibration in systems where liquidity is not guaranteed and backstop risk is absorbed by the community.
A second event occurred on March 26 involving the token $JELLY. A trader used three accounts and $7.17 million to construct an attack that involved shorting the asset on one account while offsetting long positions on others. By manipulating $JELLY’s price on external Solana DEXs, the trader induced a spike of over 400%, triggering a liquidation cascade. As a result, HLP inherited a toxic short position with an unrealized loss of $12 million. Had the token reached $0.15, the vault (valued at ~$230 million) could have faced insolvency.
To contain the risk, Hyperliquid intervened directly: trading was paused, the accounts involved were frozen, and all positions were force-settled at the entry price of $0.0095. The response prevented further loss and ultimately resulted in a small profit for HLP. However, it also revealed the operational flexibility of the protocol, raising questions about the trade-offs between decentralization and risk management. While Hyperliquid maintains a decentralized architecture, decisions around trade settlement, account intervention, and liquidation resolution reflected centralized control under stress.
Lessons from these events reveal two core issues. First, in the $ETH case, static margin requirements failed to reflect real-time market conditions, allowing traders to withdraw unrealized PnL and keep oversized positions open until liquidation. Second, the $JELLY exploit showed how multi-account strategies can simulate market neutrality while producing asymmetric outcomes that game liquidation and settlement mechanisms. Both incidents exposed the limitations of rigid risk parameters in a system where liquidity, volatility, and behavior can shift quickly.
In response, Hyperliquid introduced a series of updates to strengthen its risk framework. These include dynamic margin scaling based on notional size, volatility, and liquidity rather than fixed leverage alone; stricter open interest caps that adjust relative to global liquidity and asset-specific conditions; and tighter controls on long-tail assets through onchain delisting by validator governance. Importantly, the HLP vault was restructured: the Liquidator component now operates with tighter caps and less frequent rebalancing, and automatic ADL (auto-deleveraging) will trigger if its losses exceed defined thresholds, thus ensuring backstop exposure remains contained.
From a market microstructure perspective, these events highlight the fragility inherent in CLOB-based systems. Liquidity in order books is not owned by the exchange but provided by external actors whose participation is voluntary and path-dependent. When those actors withdraw, particularly under volatile conditions, the order book can thin out rapidly, making it difficult to price risk or execute liquidations without significant slippage. Forecasting market depth is impossible; thus, liquidation risk is priced using static, guesswork approximations.
Even when internal market makers like HLP step in to stabilize the market, their role introduces complexity. Because HLP is community-funded and not fully neutral, it carries systemic implications when it absorbs losses or assumes directional exposure. This blurs the line between risk management and discretionary intervention and may influence market participants’ expectations of future bailouts or backstops.
Vest was built to address these challenges.
Rather than relying on external or conflicted market makers, Vest replaces the CLOB altogether with a quantitative risk engine (zkRisk) that continuously measures system risk and prices liquidity accordingly. All liquidation costs are calculated in real time and embedded directly into margin requirements. No more arbitrary maintenance margins. No more unpredictable slippage. No more socialized losses.
In Vest’s model, every position is priced based on its contribution to exchange-wide insolvency risk. Traders pay for the risk they introduce. LPs are compensated dynamically and protected by a protocol-owned AMM buffer. When volatility spikes, liquidity doesn’t disappear, instead, it becomes more expensive but it remains available and predictable.
Even in extreme scenarios, like the Hyperliquid one above, attempting to open a $270M position on limited TVL, zkRisk reacts by charging high premia and funding rate. It does not auto-deleverage the trade; instead, it keeps recalculating a liquidation threshold that already bakes in the projected execution cost of closing the position. If market conditions worsen, that threshold is reached quickly and the position is liquidated in the usual way. Vest doesn’t pretend to offer infinite size; it quantifies risk and ensures traders bear it fairly.
The issues faced by Hyperliquid, whether in $ETH or $JELLY, are precisely the types of structural risks Vest was designed to avoid. The system is designed to remove reliance on reactive market makers and replace it with proactive solvency pricing. The result is a market structure that doesn’t collapse under pressure, because it never promises liquidity it can’t afford.
Lessons from Past vAMM Failures
Traditional virtual Automated Market Makers (vAMMs) in DeFi have struggled with losses and insolvency (see for example the case of Perpetual Protocol V1) due to a flawed design that fails to adequately manage risk or compensate LPs for their risk exposure. At their core, most vAMMs operate similarly to spot Automated Market Makers (AMMs) like Uniswap by using a pricing function to determine trade costs. However, vAMMs distinguish themselves by allowing for “negative reserves”, which means they can support more open interest than the actual liquidity provided. While this feature increases capital efficiency through leverage, it can also lead to unconventional slippage / spreads that might result in platform insolvency.
Most vAMMs designed for perpetual futures have encountered significant challenges, particularly in balancing long and short positions, and ensuring that the system remains solvent when traders attempt to realize their gains. An example is NFTPerp v1, which was sunset after accumulating bad debt due to flaws in its liquidation logic and accounting errors. Despite $518M in trading volume, the protocol paused contracts and returned user collateral to prevent further losses, citing the inherent unscalability of the vAMM model and the risk of “last trader gets burned” outcomes during market unwinds.
Concretely, vAMMs simulate liquidity for trading pairs, often without requiring actual tokens and relying instead on mathematical models to determine prices based on trades. This approach facilitates leveraged, perpetual-like trading on various assets, including those with low liquidity, making it easier to bootstrap markets for new or niche assets. However, the primary issue with vAMMs arises from their inability to guarantee an equal balance of long and short positions, as illustrated in the example below of a bull-trending market.
Here’s what the lines indicate:
- Blue Line (Long Positions): This line displays exponential growth in long positions, indicating a significant uptake over time.
- Red Line (Short Positions): In contrast, the red line, representing short positions, shows a much slower increase. This disparity highlights the imbalance in the system.
In traditional order book systems, each long position would be matched by a corresponding short position, ensuring a self-balancing mechanism where the funding rates paid by one side compensate the other. The image above depicts how vAMMs lack this inherent balance, which can destabilize the system due to an excess of long positions not adequately counterbalanced by short positions.
The imbalance in vAMMs is further aggravated by the pricing function, which adjusts prices based on trading activity without actual liquidity, allowing for significant price shifts from relatively small trades. To counteract this, vAMMs use funding rates to rebalance the system. However, when the number of longs outweighs shorts (or vice versa) above a specific threshold, the disadvantaged side fails to fully cover the funding rates due to a lack of opposite positions.
Consequently, the platform must compensate for these imbalances using collected trading fees (which should supposedly represent the platform’s revenue), placing the vAMM’s sustainability at risk if it cannot continually gather sufficient fees to counteract the imbalances caused by its pricing mechanism.
When the market strongly trends up or down, vAMMs can destabilize. Traders may struggle to exit positions due to insufficient liquidity, potentially crashing the system as they rush to sell. The further conditions deviate from the norm, the more capital is required to support the system.
While this imbalance may be manageable in active markets, it becomes problematic during unwind situations when not all participants can exit profitably, especially if many attempt to cash out simultaneously. vAMMs rely on continual capital inflows to maintain liquidity; however, in wind-down scenarios where market activity drops, sustaining this becomes untenable, particularly if the platform must subsidize it to keep the market balanced.
The situation can also be further complicated because of the potential for price manipulation, as traders with significant resources can exploit the slippage inherent in vAMMs to trigger liquidations or move the market in favorable directions. Using the typical x*y=k curve for k=1 we can infer that the size of the premium that is paid in slippage is a function of both a) trade size, and 2) the amount of liquidity in the curve.
Past designs have failed because when the market trends in one direction over time, it creates a scenario where the vAMM can only unwind with significant price disruption. See the following image to understand what happens when the market trends in one direction.
The culmination of these factors can lead to a cycle where the platform must continuously pay out more in funding rates than it collects in fees, eventually depleting its reserves and leading to insolvency. This scenario illustrates the fundamental challenge facing vAMMs: the need to balance the system in a way that allows for sustainable operation without exposing it to the risk of collapse due to market dynamics or manipulation.
These vulnerabilities (imbalanced open interest, slippage-based pricing, unsustainable funding mechanics, and susceptibility to manipulation) have repeatedly led to insolvency in traditional vAMM designs. Vest was built to eliminate these risks from first principles. Instead of simulating liquidity through a static pricing curve, through its real-time risk engine, zkRisk, Vest is able to dynamically price insolvency into every trade using a coherent risk measure. Positions that increase systemic risk incur higher premia and funding, while LPs are shielded by a protocol-owned AMM buffer. This ensures that liquidity remains available and solvent, even under stress, without relying on continuous capital inflows or opposing trader flows. The result is a perp DEX model that combines the capital efficiency of vAMMs with a robust, mathematically enforced solvency framework.
Vest Exchange: A vAMM-Based Solvency-Secure Perp DEX
The genesis of Vest Exchange was initiated by years of extensive research and dialogue within the decentralized perpetual futures market by the Vest Labs Research team. Many of the members have experience from well-known firms such as Morgan Stanley, Goldman Sachs, Point72, Ascendex, BlackRock, Amazon, LinkedIn, and Robinhood among others. Notable members include Perpyv2 (Founder), Maxfundingrate, Riquidate, and Billie, among others.
Vest is a decentralized perpetual futures exchange built on Base, an EVM Layer 2 blockchain. Its main goal is to address three core issues in DeFi trading and liquidity provision: arbitrary fees, risk exposure for LPs, and insolvency risks.
By running calculations off-chain and integrating zkSNARKs for transparent and verifiable risk calculations, Vest offers a solution where traders are charged based on the actual risk their trades pose, and LPs are compensated for the risk they absorb. This framework offers capital-efficient pricing for traders and LPs, a new funding rate mechanism, and the elimination of OI caps. All of this with the promise of a trustworthy environment where solvency is mathematically assured.
Vest’s core value proposition lies in its dynamic solvency calculation, which determines the minimum capital necessary to ensure the exchange’s solvency with a high degree of probability. This feature is crucial, as it ensures that LPs are appropriately compensated for the risks they undertake. Specifically, the protocol operates by continuously calculating the minimum capital necessary to ensure the exchange’s solvency with high probability. This involves dynamic adjustments to trading fees, funding rates, and partial liquidations (Vest is the first perp DEX to offer this primitive) in response to new trades, asset price risks, or liquidations.
Whenever a trade or price movement amplifies insolvency risk and increases capital requirements, the platform levies a premium or adjusts the funding rate charged to the trader. To keep LPs risk-neutral, zkRisk dynamically reallocates capital in response to changes in expected PnL, charging traders for the risk they introduce. This ensures LPs remain indifferent to market direction, improving platform stability and liquidity quality.
At the heart of Vest is a mathematically-driven risk management system known as zkRisk. The zkRisk engine optimizes interactions among traders, LPs, and the exchange, allowing each party to operate in their best interest without negatively impacting others. Risk is assessed individually for each asset, with compensation adjusted for the inventory risk associated with holding specific assets, making it easier to introduce new listings. In particular, the engine is able to adjust trading fees based on the real-time risk posed by each trade. This allows Vest to dynamically manage liquidity and solvency without traditional constraints like OI caps linked to TVL.
The zkRisk Framework
zkRisk is the framework introduced by Vest to unify the trading experience of digital assets and the money market such that the solvency of an exchange is guaranteed with high probability. Instead of a limit order book, traders trade against a liquidity pool composed of external LPs and an AMM that prices shortfall risk using a coherent risk measure, the Entropic Value-at-Risk (EVaR).
Overview
In this model, the AMM is responsible for pricing liquidity based on risk quantified using the EVaR. This approach is designed to ensure that the exchange remains solvent even with fluctuations and imbalances in long and short positions.
The first step is to define the liability function Xt(θ) which calculates the exchange’s liability at time t, hence, the net payout due to traders if all open positions were to be closed at current market prices 𝑆𝑡.
Xt(θ) = qTSt − (C + P + L)
Here, 𝑞 represents the vector of long-short imbalances (𝑞i>0 implies that market i is long-heavy, thus the AMM is net short), 𝐶 is the cumulative entry notional sizes, 𝑃 is the capital owned by the AMM, and 𝐿 is the capital provided by LPs. In other words, Xt(θ) computes the difference between the value of the traders’ unrealized PnL (qTSt − C) and the available protocol assets (AMM and LP capital). It is possible to call the exchange default if Xt exceeds exchange-owned liquidity, thus if Xt > 0.
The next step uses the EVaR, which is an upper bound for the value at risk (VaR) and the conditional value at risk (CVaR). Essentially, it is used to find the tightest upper bound on the potential loss X such that the probability of the actual loss exceeding this bound is less than or equal to a confidence level α (i.e. 99.5%).
Using EVaR, the AMM charges premia / rebates as well as periodic funding to guarantee solvency with respect to rolling windows [t, t + τ ] by ensuring the following invariant holds with high probability (α) at a certain time t:
Xt + τ < 0
Now, it is possible to quantify this default risk using the EVaR, a coherent risk measure that can be thought of as the amount of capital needed to cover for the risk with a high confidence level (i.e. 99.5%). This system determines the risk state of the exchange at any moment. As for risk-indifferent pricing, it means that the DEX ensures that the risk of counterparties stays neutral before and after every trade.
In other words, Vest calculates the required capital that counterparties need to guarantee solvency with very high probability, such that when a trader opens a position that increases the risk (say opens a long on long heavy market), Vest calculates the change in required capital and charges this difference onto the trader via fees. There are two types of fees, Premia (premiums and rebates) and Funding. The former addresses marginal inventory risk, while the latter manages residual risks, including those arising from fluctuations in the underlying asset’s price process (i.e. market risk).
The Premia
Premia is a variable trading fee calculated by comparing the EVaR-defined risk state before and after accepting a trade. Trades that elevate the exchange’s risk of insolvency incur higher Premia, effectively minimizing potential solvency risks and making trading more cost-effective for risk-reducing trades. In scenarios where trades diminish the solvency risk, the Premia charged is zero. At t + τ, AMM-owned capital P is incremented by the Premia.
Thanks to its built-in engine, the pricing scheme defined by the AMM implicitly provides adaptive liquidity that responds to changes in inventory and underlying asset volatility. This virtual liquidity curve means that, unless the AMM enforces an OI cap, it effectively offers infinite liquidity around the current mid-price, making it easier to visualize available liquidity within specific price ranges. This feature not only clarifies the placement of virtual liquidity but also enables the simulation of additional trading costs by adjusting the liquidity curve relative to the mid-price.
The following example assumes the AMM being net short on an asset (e.g. $ETH) which is positively correlated with another one (e.g. $BTC). As shown in the image, bids are set with a negative spread to encourage short positions, which helps mitigate risk for the AMM.
Also worth noting, the AMM within Vest serves as the initial trading counterpart, holding proprietary capital to mitigate direct risk exposure for LPs from profitable traders. Hence, this setup preserves LP capital, employing it only when the AMM’s resources are depleted.
The funding rate
The funding rate mechanism also leverages EVaR to manage the distribution of funds between liquidity providers (LPs), the automated market maker (AMM), and traders based on price movement-induced risk changes. However, unlike traditional fixed-interval funding settlements, Vest applies funding continuously, allowing for real-time risk adjustment and smoother funding rate transitions. Similar to premium, P (AMM capital) will be incremented at time t + τ with funding charged at time t.
Incentives Alignment: LPs and Traders
The risk-indifferent pricing and dynamic fees allow Vest to harmonize the risk preferences and align the incentives of traders and LPs, ensuring that both parties can interact with the AMM while maintaining the platform’s capital efficiency and solvency.
Lower fees and better performance for Traders
For traders, dynamic fees reflect the actual risk and operational costs of their positions. The Premia calculated within the zkRisk framework varies based on the trade’s impact on the exchange’s risk profile, encouraging trades that either maintain or reduce the platform’s overall risk. As OI skew increases in one direction for a given market, both the Premia and the funding rate will ensure that LPs are compensated adequately.
But what about the costs for traders? According to this simulation model (from October 13, 2023, until November 13, 2023, for thirteen of the most commonly listed assets, including ETH, BTC, BNB, SOL, and more) trading on Vest may be on average 2-3x cheaper than on other competitors like GMX v1/v2, Kwenta, RabbitX, Gains, dYdX, and more.
Vest achieves this by calculating the minimum capital required to maintain exchange solvency with high probability. When opening a position, the trader pays only what’s necessary to meet this minimum. If the position stays below this threshold, the trader incurs no fees and experiences zero price impact. If it exceeds this minimum, the trader pays only the difference.
Additionally, because trader fees are distributed in a risk-adjusted proportion between LPs and AMM capital, and trader performance is subsidized by AMM capital first and LP capital second, this design enables traders to achieve higher profits under similar market conditions.
During a period when BTC/USD rose by nearly 30%, DEX β traders ended close to breakeven on average, whereas Vest traders achieved nearly 50% gains. While some of this may be due to the randomness of the simulation, the results highlight Vest’s ability to increase returns.
Risk Indifferent Liquidity Provision
LPs in the Perp DEX space face two main risks: exposure to trader PnL and potential protocol or AMM insolvency. For the first risk, LP gains are typically inversely tied to trader gains. Although this relationship often works in favor of LPs (since most traders incur losses over time, providing LPs with steady fee-based returns) the dynamic can shift in a bull market. In such conditions, traders may become net profitable due to general market upswings, which heightens LPs’ exposure to losses as their profits are directly linked to trader losses. As a result, LPs may experience significant losses to cover trader profits, potentially wiping out prior gains. Regarding the second risk, if a DEX becomes insolvent, LPs may be unable to withdraw their initial capital, and traders may be unable to close active positions.
As we introduced earlier, Vest aims to address these challenges by: (1) establishing a protective layer between traders and LPs through AMM capital, (2) offering LPs risk-adjusted compensation rather than a fixed rate, as is common practice, and (3) dynamically adjusting trading costs based on their impact on insolvency risk.
First, Vest’s AMM acts as a buffer between traders and LPs, absorbing the initial impact of trader profits and losses. This design not only protects LPs’ principal from being eroded by trader gains but also ensures that the yield from LP capital remains consistent, addressing the risk indifference preference of LPs.
Second, Vest provides LPs with risk-adjusted compensation instead of a fixed rate, which is often suboptimal. Fixed rates, typically based on arbitrary figures, may not accurately align with market conditions, leading to potential inefficiencies. If fees are set too high, they discourage trading activity; if too low, they fail to attract LPs by offering insufficient compensation for the risk involved.
On the other hand, Vest introduces a new design from first principles by calculating the minimum fee necessary to ensure that the expected profits and gains for LPs are neutralized, rendering LPs risk-insensitive to traders’ gains or losses. This system dynamically adjusts fees based on market conditions and the actual risk to LPs, ensuring that LPs are neither under-compensated for taking on risk nor overcompensated to the point of deterring trader participation.
To support its assumptions, Vest ran different simulations in a bull market scenario where traders are long-heavy and slightly net profitable. The image below compares the LP capital trajectories of Vest and a fixed fee DEX over several days.
The initial stability and gradual adjustment in LP capital in Vest (blue line) suggest that, even as many DEXs experience sharp drawdowns during market volatility, LPs remain relatively well-protected against losses. The rising market prices and net profitable, long-biased trader behavior eventually led to increased payouts from LPs to traders. This is due to Vest’s dynamic fee and funding rate structures, which adjust based on market conditions and trader profitability, aiming to maintain fairness and solvency.
As prices increase and traders holding long positions profit, Vest’s mechanisms for adjusting premia and funding rates could lead to higher fee payments to cover the increased risks and payouts. This explains why LP capital declines (blue line) less sharply than fixed-fee DEXs. The more pronounced and consistent decline in LP capital in the fixed fee DEX (orange line) suggests a less robust mechanism to shield LPs from the effects of a profitable trading environment for traders. In a fixed fee model, LPs might not receive adequate compensation for the risks taken when traders are consistently profitable, leading to a depletion of LP capital.
Moreover, Vest adds a small taker fee on trades, designed to make LPs net profitable on average without imposing excessive charges on traders. This structure maintains an attractive environment for traders by keeping overall fees reasonable, thereby encouraging trading activity, while also ensuring that LPs can participate with a reduced risk of loss.
Capital Efficiency Without Insolvency
By dynamically pricing trades based on their impact on system solvency, Vest can safely exceed traditional OI limits relative to its TVL, improving both capital efficiency and solvency without restrictive OI caps. This flexibility enables Vest to support a higher trade volume, boosting fee generation for the platform and LPs.
As previously mentioned, Vest continuously calculates and adjusts for risks, allowing it to operate with lower capital reserves than traditional systems and thereby maximizing capital efficiency. This approach directly deals with the liquidity issues commonly found in Perp DEXs, where low liquidity creates a feedback loop of diminished trading quality and reduced LP fees, further exacerbating liquidity constraints.
Conclusion
Even though vAMMs have a bad reputation due to flawed designs deployed in the past, we are confident that Vest’s model solves insolvency and offers a more capital-efficient way to trade on-chain (even more so than traditional order books). By moving complex risk management calculations off-chain, Vest can adequately price for the insolvency risk of the exchange, in addition to making this math provably verifiable on-chain with zkSNARKs.
We believe that Vest has the potential to represent a zero-to-one moment in DeFi, similar to what GMX represented for Arbitrum in its early days. Vest’s utilization of the EVaR for pricing trades and managing liquidity positions sets a new standard for risk assessment in DeFi, not only in perps.
All things considered, Vest offers a robust solution to the flaws inherent in previous vAMM designs while potentially outperforming traditional CLOBs in terms of efficiency. This method not only addresses the imbalance and insolvency risks that plagued earlier vAMM models but also reduces the operational complexities associated with CLOBs, making market participation more accessible and financially attractive for both traders and LPs.
References
A Risk-Indifferent Approach to Passive Liquidity Provisioning. Vest Blog
Capital Efficiency without Insolvency. Vest Blog
Perpetual DEX Part 2: AMM-Based Perpetual DEXs. DeSpread Research
Sunsetting Perp V1. Perpetual Protocol Governance
vAMM and Virtual Liquidity Curve. Vest
Vest Exchange: All You Need to Know. Vest Blog
Vest Pre-Launch Data Download. Vest Blog
Disclosures
Alea Research is engaged in a commercial relationship with Vest and receives compensation for research services. This report has been commissioned as part of this engagement.
Members of the Alea Research team, including analysts directly involved in this analysis, may hold positions in the tokens discussed.
This content is provided solely for informational and educational purposes. It does not constitute financial, investment, or legal advice.