Skip to content
DeFi Reference

On-chain options — collateralized writing and options as a primitive

1. TL;DR

Section titled “1. TL;DR”

An on-chain option lets one party (the writer) lock collateral and sell someone else the right, but not the obligation, to buy or sell an asset at a fixed price by a certain date — Hegic’s 2020 innovation was pooling that collateral across many option writers so no individual has to underwrite a single contract alone, and settling without any external price feed at all, since exercising just moves already-locked funds. A parallel line of research treats options not as a product to trade but as an alternative primitive to debt: instead of a liquidatable loan, split one unit of collateral into two option-like tokens whose values always sum to the original unit, so nobody can ever be liquidated — at the cost of a slow, predictable drift away from full exposure instead of a sudden one. Both ideas remain a small slice of DeFi derivatives next to perpetual futures, and both have already produced real, dated security incidents.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

An option is like a coupon that lets you “reserve” today’s price on something you might want to buy later — a furniture store coupon good for one couch at today’s $500 price, valid for two months, that you paid $20 for. If the couch goes on sale for $400, you throw the coupon away and just buy it at the sale price; if it goes up to $700, you use the coupon and save $200 minus your $20 cost. The store (the option writer) has to keep a couch aside the whole time in case you use it, which is the collateral tying up their capital.

ELI5

Section titled “ELI5”

An option is a paid-for right to buy or sell something at an agreed price later, but you never have to use it if the market moves against doing so. On a blockchain, since there’s no company to trust to honor that right, the seller has to lock up real money or tokens up front, matching exactly what they’d owe if the option gets used. That locked money sits in a shared computer program until either the buyer uses their right before the deadline, or the deadline passes and it goes back to the seller. Because the money is already sitting there, the program doesn’t need to know the current market price to let someone use their option — only whether the buyer chose to.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario (adapted from a 2018 ethresear.ch proposal): Alice owns 1,000 ETH and, with ETH trading at $200, wants downside protection below $200 through November 1st. She pays a premium of 10 ETH. Bob is bullish on ETH and is willing to be the counterparty.

  1. Contract created (state: Alice holds 1,000 ETH plus 10 ETH earmarked as premium, ETH at $200). Alice deploys a smart contract, deposits 10 ETH into it, and the contract states that anyone who deposits 200,000 DAI before November 1st can claim that 10 ETH.
  2. Bob writes the option (state: Bob deposits 200,000 DAI, claims Alice’s 10 ETH premium). Bob deposits 200,000 DAI into the contract and withdraws the 10 ETH — his compensation, paid up front, for agreeing to be on the other side of Alice’s insurance. The 200,000 DAI now sits locked in the contract as the collateral backing Alice’s right to sell.
  3. ETH falls to $150 before the deadline (state: Alice’s uninsured 1,000 ETH is worth $150,000). Alice exercises: she sends her 1,000 ETH to the contract and receives all 200,000 DAI in exchange, at the locked rate of 1 ETH : 200 DAI — regardless of the $150 market price. Per the contract’s rules, “all ETH sent to SC goes to Bob,” so Bob now holds 1,000 ETH that the market values at only $150,000, having earlier received $2,000 worth of ETH as premium.
  4. Alternatively, ETH rallies to $260 (state: exercising would mean selling at $200 instead of $260). Alice lets the contract expire unused — exercising would cost her $60 per ETH versus just selling on the open market. Bob keeps his 200,000 DAI (now unlocked) plus the 10 ETH premium he already pocketed, his full compensation for having offered the insurance and having it go unused.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: On-chain options need a price oracle to settle correctly. Reality: In Hegic’s original design, “maintenance and execution of hedge contracts do not depend on the external price feeds” — settlement only needs the buyer’s decision to exercise and the funds already locked in the contract, not an outside price at expiry (Hegic announcement, 2020-02).
  • Myth: Fully collateralizing every option is just how options naturally work on-chain. Reality: An early ethresear.ch commenter flagged this directly: “real-world option underwriters do not really fully collateralize their options… There are regulations that quantify risk and basically force underwriters not to under-collateralize too much” — full collateralization is a trustlessness cost specific to the on-chain setting, not a property of options generally (ldct, ethresear.ch, 2018-09).
  • Myth: An “option-based” synthetic asset is a totally different animal from a debt-based stablecoin. Reality: They solve the identical problem — giving exposure to a price index using only a trustless asset as backing — but the options-based version removes forced liquidation entirely, at the cost of a slow, quadratic “drift” away from full exposure as the price approaches the chosen strike (Buterin, ethresear.ch, 2026-06).
  • Myth: Removing liquidations removes risk. Reality: The options-based design “still needs some action… in response to large price movements,” it just shifts who decides when to act — the protocol via forced liquidation, or the user via voluntary rebalancing — rather than removing the underlying exposure risk (Buterin, ethresear.ch, 2026-06).

If you only remember one thing

Section titled “If you only remember one thing”

An on-chain option settles without ever consulting a live price feed, because the only thing it needs to know is whether the already-locked collateral gets claimed before the deadline — the price only matters to the humans deciding whether to exercise.

3. How it works

Section titled “3. How it works”

Payoffs and collateralization

Section titled “Payoffs and collateralization”

A call’s payoff is max⁡(spot−strike,0)\max(\text{spot}-\text{strike},0); a put’s is max⁡(strike−spot,0)\max(\text{strike}-\text{spot},0). Because there is no centralized clearinghouse to guarantee a writer’s obligation on-chain, the dominant early design fully collateralizes every contract: to write a put with strike KK on quantity qq of an asset, the writer locks K×qK\times q of the quote currency (or qq units of the underlying for a call) for the life of the contract. This is capital-intensive compared to traditional finance, where “it’s very unlikely that all the obligations that [a large bank] are saddled with will be exercised in such a way that they lose more than their company’s capital base” — real-world underwriters rely on portfolio diversification and regulatory capital rules to write options many times over-collateralized in aggregate, a structure early on-chain designs could not easily replicate (ldct, ethresear.ch, 2018-09).

Pooled liquidity and fungible tokens

Section titled “Pooled liquidity and fungible tokens”

Two refinements reduce that capital cost. Hegic’s liquidity pool model lets writers “distribute funds across multiple contracts simultaneously, diversifying risk and optimizing capital efficiency” instead of underwriting one specific buyer — a single shared pool sells options to whoever wants them, with premiums (theoretical yearly returns quoted at “+27% up to +108% APR” in Hegic’s initial design) distributed across all pool participants pro rata, and idle DAI collateral additionally earning yield elsewhere in the meantime. Separately, an ethresear.ch proposal for fungible ERC-20 option tokens shows how a writer can mint many identical, tradable option tokens against pooled collateral: “Bob wants to create 10 PUT options… He deposits the 2000 DAI into our contract, and our contract creates 10 ETH-DAI-200-1.11.2018-PUT ERC20 tokens,” which trade freely on any exchange, with exercise proceeds split pro rata among whichever writers’ collateral happens to still be in the pool when a holder exercises (flygoing, ethresear.ch, 2018-09).

Options as a debt alternative

Section titled “Options as a debt alternative”

A 2026 ethresear.ch post reframes the entire problem: instead of asking “how do we build good options products,” it asks “should synthetic assets be built on options instead of debt at all?” A liquidation-based synthetic (an ordinary crypto-collateralized stablecoin or perpetual) requires a real-time price oracle, because “the system must be able to force-liquidate the user” the instant collateral becomes insufficient — and “real-time oracles are very hard to make safe.” The proposal instead splits one unit of collateral (ETH) into a pair of tokens PP and NN against a ticker TT, a strike SS, and a maturity MM: at maturity, once an oracle reports T=xT=x,

P receives min⁡ ⁣(1, Sx) ETH,N receives max⁡ ⁣(0, 1−Sx) ETHP \text{ receives } \min\!\left(1,\ \frac{S}{x}\right)\text{ ETH}, \qquad N \text{ receives } \max\!\left(0,\ 1-\frac{S}{x}\right)\text{ ETH}

Because P+N=1P+N=1 always, by construction, “there is no possibility of liquidation” — the system can never become insolvent, since the two tokens’ claims are defined to exhaust exactly the one unit of ETH that backed them, and the required oracle only needs to report a value once, at maturity, rather than continuously. The tradeoff is that a PP holder who wants stable USD-like exposure does not get it exactly: as spot approaches the strike from above, PP‘s dollar value “starts to diverge quadratically from 1 USD,” so a user must periodically rebalance — rolling into a lower-strike PP token as the price nears the current strike — to keep tracking their target exposure, rather than being automatically kept whole the way a liquidation-based design attempts to.

4. Worked numeric example

Section titled “4. Worked numeric example”

Continuing the Alice/Bob scenario from §2 end to end.

At-the-money put written. ETH is at $200; Alice pays 10 ETH (worth $2,000 at inception) for the right to sell up to 1,000 ETH at $200 each any time before November 1st. Bob posts 200,000 DAI as collateral and immediately receives Alice’s 10 ETH premium — he is now effectively long 10 ETH and short the put.

Case A: ETH crashes to $150. Alice’s 1,000 ETH, unhedged, would fetch only $150,000 on the open market. She exercises the put instead, sending her 1,000 ETH into the contract and receiving all 200,000 DAI. Her insured outcome ($200,000) beats her uninsured outcome ($150,000) by $50,000, against a premium that cost her $2,000 at inception (or is worth only $1,500 marked at the now-lower ETH price) — a net benefit of roughly $48,000–$48,500 from having bought the put. Bob is on the other side of that trade: he now holds 1,000 ETH the market values at $150,000, having paid away his 200,000 DAI for it, a mark-to-market loss of $50,000, partially offset by the $1,500–$2,000 premium he pocketed up front, for a net loss of roughly $48,000–$48,500 — exactly Alice’s gain, since this is a zero-sum contract before considering who was “right” about the direction of ETH.

Case B: ETH rallies to $260. Alice’s put finishes out-of-the-money (exercising at $200 would be worse than selling at the $260 market price), so she lets it expire. Bob’s 200,000 DAI is released back to him, and he keeps the 10 ETH premium — now worth $2,600 — as pure profit for having offered insurance that was never needed. Across both cases, Bob’s collateral (200,000 DAI) had to sit fully locked and unusable for the entire two-month life of the contract regardless of which outcome occurred, which is exactly the capital-inefficiency ldct’s ethresear.ch comment flags as the central cost of the fully-collateralized, on-chain model.

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • Hegic — the original pooled-liquidity options protocol; American-style calls and puts on ETH and wBTC via a peer-to-pool model where liquidity providers collectively act as the counterparty, now running on Arbitrum with roughly $9 million in total value locked (DefiLlama, secondary, as of 2026). Hegic protocol announcement
  • Opyn — options infrastructure that also produced the power-perpetual instrument Squeeth (see /derivatives/power-perps-and-everlasting-options/); historically offered vanilla put and call vaults on ETH.
  • Panoptic — a “perpetual, oracle-free, instant-settlement, fully-collateralized options trading protocol” built directly on Uniswap v3 liquidity positions, letting any Uniswap v3 pool double as an options market without an external price feed, live on Ethereum mainnet (Panoptic, secondary, as of 2026). research.panoptic.xyz

Solana

Section titled “Solana”
  • PsyOptions / PsyFi — a Solana-native options and structured-vault platform offering permissionless call and put creation (“PsyOptions”), automated covered-call/put-selling vaults (“PsyVaults”), and vault-backed lending (“PsyLend”), the closest Solana analogue to Hegic’s pooled-writer model (Solana Compass, secondary, as of 2025).

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”
  • Hegic, 23–24 April 2020 — $28,000 permanently locked. Just hours after Hegic’s smart contracts launched, a single missing letter — the unlock function checked for OptionIDs where the storage variable was actually OptionsIDs — silently broke the liquidity-unlock path, freezing roughly $28,000 (mostly DAI, some ETH) forever. Hegic’s own security reviewer, Trail of Bits, had audited the contracts for only two days shortly before launch and said it had flagged eleven issues that were not properly addressed before shipping; the team first called the bug a “typo” before walking that framing back two days later under community pressure, and pledged to reimburse affected users from its own funds (Decrypt, secondary, 2020-04). This is the canonical early lesson in why a fully-collateralized, no-oracle design is not automatically a simple, low-risk design — the funds were locked not because of a price manipulation, but because of an ordinary naming-collision bug in code that had just barely been reviewed.
  • Panoptic, 25 August 2025 — up to $5 million at risk, no funds lost. A Cantina researcher disclosed a critical flaw in Panoptic’s position-ownership fingerprinting scheme: the protocol’s hashing approach turned out to be a variant of a scheme previously shown insecure in academic literature, whose XOR-based structure let an attacker construct hash collisions and spoof ownership of another user’s option position. Panoptic paid the researcher a $250,000 bounty and coordinated a rescue across affected chains before the vulnerability could be exploited in the wild (Metaverse Post/Code4rena disclosure report, secondary, 2025-08). Unlike Hegic’s incident, this was caught through responsible disclosure before any loss occurred — a useful contrast in outcomes for what is structurally a similar class of “custom cryptographic shortcut turns out to be unsafe” bug.
  • Structural risks common to the design. Full collateralization concentrates tail risk: if many written options finish deeply in the money simultaneously — a correlated market crash rather than an idiosyncratic move — a shared liquidity pool faces every writer’s claim coming due at once, unlike a traditional options desk that can rely on diversification across uncorrelated underliers. Options built directly on AMM liquidity positions (Panoptic) inherit that AMM’s own risks, including the loss-versus-rebalancing dynamics covered in /exchange/impermanent-loss-vs-lvr/. And the options-as-debt-alternative design in §3 trades away sudden liquidation risk for a different, slower risk: a user who fails to rebalance a PP token as spot approaches its strike ends up with steadily less of the exposure they thought they had, a risk that is easy to underestimate precisely because nothing dramatic appears to happen day to day.

7. Open problems

Section titled “7. Open problems”
  • Whether options-based synthetics can find a market structure that doesn’t leak value to slippage. The 2026 ethresear.ch proposal is explicit that this is the central unresolved risk: “it is very easy to lose 2% per year or more from multiple rounds of slippage, and this is the largest risk by which this whole scheme might become uncompetitive,” and the post calls for “an ideal market structure that minimizes slippage far more than traditional AMMs do” without offering one.
  • Whether a dynamic strike could reduce quadratic drift. A commenter on the same thread proposes letting the strike itself move with volatility (“if the strike price was actually… the square root of the difference between the strike price and the current price, you’d dampen out the extreme-end risk”) but this remains an untested idea, not an implemented mechanism (conalloreilly, ethresear.ch, 2026-06).
  • Whether fully-collateralized on-chain options can ever match the capital efficiency of regulated, partially-collateralized underwriting without reintroducing the counterparty and regulatory-oversight assumptions that on-chain design is meant to avoid (ldct, ethresear.ch, 2018-09) — no proposal reviewed for this page resolves this trade-off.
  • How to price fungible, pooled options tokens fairly when multiple writers with different entry premiums back the same token. The original ERC-20 options thread flags this directly but leaves it unresolved: pro-rata payout distribution can systematically favor later or earlier writers depending on how the pool composition shifted before exercise (adamskrodzki/flygoing exchange, ethresear.ch, 2018-09).

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Pooled-writer optionsHegic (Arbitrum), OpynPsyOptions / PsyFi
Oracle-free / AMM-native designPanoptic, built on Uniswap v3 LP positionsNone found in sources reviewed
Options-as-debt-alternative researchActive (ethresear.ch, 2026) — no live implementation foundNone found in sources reviewed
Dominant collateralization modelFull collateralization, pooled across writersFull collateralization, pooled via vaults (PsyVaults)
Documented security incidentHegic (2020-04, $28K locked); Panoptic (2025-08, disclosed responsibly, $0 lost)None found in sources reviewed

The core design constraint — full collateralization in the absence of a trusted central counterparty — is identical on both chains, so Ethereum and Solana options protocols converge on structurally similar pooled-liquidity models; the main difference is that Ethereum’s deeper concentrated-liquidity AMM ecosystem (Uniswap v3) has enabled the oracle-free, AMM-native design Panoptic pursues, which has no confirmed Solana analogue in the sources reviewed for this page.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

Announcing Hegic Protocol and the Concept of a Hedge Contract — 0mllwntrmt3, ethresear.ch, 25 February 2020. ethresear.ch/t/7023

Summary of the reference

Section titled “Summary of the reference”

The post introduces Hegic’s core primitive, the “hedge contract”: an on-chain, options-like instrument that grants the holder the right to exchange an asset at a predetermined strike price within a specified timeframe, while obligating the seller (writer) to fulfill that exchange. Its initial implementation supports put hedge contracts letting holders swap ETH for DAI at a locked price. The key architectural choice is a liquidity pool model: rather than requiring a specific writer to underwrite each specific buyer, writers deposit funds into a shared pool that distributes exposure across many contracts simultaneously, diversifying individual writer risk and improving capital efficiency relative to one-to-one underwriting. Settlement and maintenance of the contract are designed to depend only on locked liquidity, timestamps, and ordinary EVM execution — explicitly not on any external price oracle, since the contract does not need to know the market price to let a holder exercise their already-defined right. On the economics side, the post quotes theoretical annualized returns for liquidity providers (writers) of roughly 27% to 108% APR depending on prevailing weekly holding rates of 0.5%–2.0%, with DAI collateral additionally earning MakerDAO’s Dai Savings Rate through a CHAI integration while sitting idle in the pool. Governance and fee distribution run through the fixed-supply HEGIC token (3,012,009 tokens), which is entitled to all settlement fees and can vote on Hegic Improvement Proposals.

Key quotes

Section titled “Key quotes”

“Hedge contract is an options-like on-chain contract that gives the holder (buyer) a right to buy or to sell an asset at a certain price.” (Introduction)

“Maintenance and execution of hedge contracts do not depend on the external price feeds.” (Mechanism)

“theoretical yearly returns for hedge contracts writers (sellers) are in between from +27% up to +108% APR.” (Economics)

How to read the original

Section titled “How to read the original”

Background needed: call/put payoff definitions and a basic sense of what it means to “fully collateralize” a financial obligation. Skip the HEGIC tokenomics and governance details on a first pass if your interest is purely mechanism, not the project’s token design. The hardest part to appreciate on a first read is why removing the price-oracle dependency is valuable at all — the answer becomes clearer once you contrast this design with a liquidation-based system (see the second reference below), which needs a live, manipulation-resistant price feed continuously, not just once at settlement; Hegic’s no-oracle property is a direct consequence of full collateralization, since the contract never needs to determine solvency, only whether the holder chose to exercise.

What changed since

Section titled “What changed since”
  • Hegic itself launched buggy: a naming-collision bug froze roughly $28,000 of user funds within hours of the 2020-04 mainnet launch (see §6) — an early, concrete lesson that “no oracle needed” does not mean “no smart-contract risk.”
  • Later oracle-free designs, notably Panoptic (2026, live on Ethereum), extend the no-external-oracle idea by building options directly on top of Uniswap v3 liquidity positions rather than a standalone liquidity pool, removing the need for even an internal pricing model.
  • A parallel and more recent line of research (2026-06, second reference below) goes further than “no oracle at settlement” and asks whether options can replace debt as the base primitive for synthetic assets generally, not just for standalone options products.

Secondary references

Section titled “Secondary references”
  1. “Options for ERC20 tokens” (ethresear.ch, 2018-09) — read for the earlier, more informal brainstorm that led toward fungible, tradable ERC-20 option tokens.
  2. Panoptic research documentation — read if you want to see the no-oracle idea taken further, built directly on Uniswap v3 LP positions instead of a bespoke pool.
  3. DefiLlama’s Hegic page — read for current, dated TVL and fee figures for the live protocol.

The reference

Section titled “The reference”

Building index-tracking assets on top of options instead of debt — Vitalik Buterin, ethresear.ch, 1 June 2026. ethresear.ch/t/25036

Summary of the reference

Section titled “Summary of the reference”

The post starts from a general problem — giving users trustless exposure to any price index TT using only a trustless base asset like ETH as backing — and observes that every existing approach (algorithmic stablecoins, perpetual futures) relies on forced liquidation, which in turn requires a real-time, manipulation-resistant price oracle, “by far” the hardest kind of oracle to build safely. The proposal removes liquidations entirely by making the base building block an option instead of debt: splitting one unit of ETH into a pair (P,N)(P,N) against a ticker TT, strike SS, and maturity MM, where at maturity PP receives min⁡(1,S/x)\min(1,S/x) ETH and NN receives max⁡(0,1−S/x)\max(0,1-S/x) ETH for the oracle-reported value x=Tx=T. Since P+N=1P+N=1 by construction, the system can never become insolvent regardless of how far TT moves — the post notes this is structurally identical to a scalar prediction market and can share an oracle with one. The catch is that a PP-holder seeking stable exposure only gets it approximately: near the strike, PP‘s value “diverges quadratically” from a perfect $1 peg, so the post proposes an explicit rebalancing strategy — hold deep in-the-money PP tokens and roll into a lower strike as price approaches the current one — accepting a modest, ongoing “quadratic drift” (the post suggests standard deviation on the order of 1–4% per year is a reasonable price to pay) in exchange for never facing sudden liquidation. A comparison table contrasts liquidation-based synthetics (fine until a sudden liquidation event; real-time oracle dependence) against options-based synthetics (a slow, predictable drift instead; only slow-oracle dependence), and the post closes with a broader argument that individually-chosen exposure baskets (“personalized stablecoins”) could be a superior model of money to a single one-size-fits-all peg.

Key quotes

Section titled “Key quotes”

“All attempts at providing this functionality have to deal with a fundamental issue. The system as a whole can only hold ETH… What happens if T rises so high that a holder of negative-T goes ‘bankrupt’?” (Introduction)

“This post proposes to make synthetics rely only on ‘slow’ oracles by flipping the problem on its head: we remove the entire concept of liquidations by making the ‘base building block’ of the system options rather than debt.” (Introduction)

“Notice that P + N = 1. Hence, there is no possibility of liquidation.” (Synthetic options)

“The safe bet is to hold deep ‘in-the-money’ options, and then rotate them into options with a lower strike price as soon as the price gets anywhere remotely close to the strike price.” (How to use synthetic options)

How to read the original

Section titled “How to read the original”

Background needed: call/put payoff structures (the PP/NN split is literally a covered-call/put decomposition of one unit of the base asset), and a passing familiarity with why real-time price oracles are considered risky (see /oracles/oracle-manipulation/ for that background). Skip the closing “Modular and Composable Stablecoins” thermodynamics analogy on a first pass — it is a speculative extension, not part of the core mechanism. The hardest part is the “quadratic drift” claim: the intuition to hold onto is that as spot approaches the strike, a small move in spot causes an increasingly large move in the option’s delta (its exposure to further price changes), so a PP-holder’s effective ETH exposure changes smoothly but increasingly fast near the strike, rather than jumping discontinuously the way a liquidation would — “slow” is relative to a liquidation, not literally negligible.

What changed since

Section titled “What changed since”
  • As of this page’s writing (2026-08), no production protocol implementing this exact P/NP/N split-options design was found in the sources reviewed — it remains an active ethresear.ch research proposal rather than a shipped product.
  • The idea echoes and formalizes intuitions already present in Hegic’s fully-collateralized model (both designs make solvency a matter of construction, not liquidation) and in Multiverse Finance’s verse-splitting mechanics (see /derivatives/prediction-markets/), suggesting a convergence across DeFi research toward “split, don’t liquidate” designs by the mid-2020s.

Secondary references

Section titled “Secondary references”
  1. “Options for ERC20 tokens” (ethresear.ch, 2018-09) — read for the earliest concrete proposal of tradable, collateral-backed options tokens that this later post builds conceptually on.
  2. Scalar Markets documentation (Seer) — read if you want to see the prediction-market structure this design explicitly says it mirrors.
  3. Milionis, Moallemi, Roughgarden et al. on loss-versus-rebalancing — read for the liquidation-based-synthetics side of the comparison this post argues against (see /exchange/impermanent-loss-vs-lvr/).

10. Sources

Section titled “10. Sources”