Every contract is backed by collateral before it exists, so there is nothing to liquidate: no margin call, no forced close, and no price feed to manipulate.
Writers escrow the asset and set their own premium. Buyers pay it for the right, not the obligation, to buy at that strike before it expires. Covered calls, settled in the asset itself.
Backed by Lightspeed, Blockwall and angels · $500K
Field 01
One tradeable line in Anvil is a series: an underlying, the token the strike is paid in, a strike, and an expiry. That quadruple is the atomic unit. Every contract offered on it is already covered by underlying sitting in escrow.
available = listed − sold
listed rises when a writer escrows and offers, and falls when they pull an unsold offer. sold only ever rises. So “3 available” means 3 contracts are genuinely backed by underlying in escrow right now.
Depth at a price is whatever the market happens to bring. Scarcity is emergent, temporary, and it disappears the moment someone posts a bigger order.
Every price level holds the contracts writers have collateralized there and no more. When the unsold contracts at $4,700.00 are gone, the next buyer takes $4,750.00 or waits for another writer to escrow more. Scarcity here is real collateral, not inferred from liquidity.
Anatomy of a series
the asset the writer escrows
what the buyer pays to exercise
snaps to the $50.00 tick for this asset
after this the series stops trading
underlying delivered per contract
seriesId = keccak256(underlying, quote, strike, expiry)
At zero the strike is sold out. Nothing can sell contract 901 until a writer escrows the underlying for it.
Field 02
Each row is one series and one premium. Availability is the number of contracts writers have escrowed and not yet sold; buying takes one off the shelf. Buy a row down to zero and it sells out for real: nothing refills it, and the desk routes you to the nearest strike that still has stock, exactly as the contract would.
Sample offers, held in browser state. Nothing here touches a chain.
Protocol response
Idle. Pick a strike on the ladder to buy a contract from a writer.
Contracts held
0
Premium paid
$0.00
Your options
Nothing held yet. Buying gives you the right to pay the strike and take the underlying before expiry, never an obligation to. The writer’s side is not a token; it stays in escrow as collateral.
The writer’s side
Sold contracts never come back. The only thing that refills a strike is another writer escrowing the underlying and listing it.
Field 03
An option is only worth writing if someone will pay for it, and what they pay tracks volatility. A tokenized treasury bill is the safest thing to write and almost the least useful: at roughly half a percent of volatility its premium rounds to nothing. Gold and a large-cap equity carry real premium with a tail that behaves nothing like a token.
So the ladder opens on the quiet end. Position limits are set so the worst plausible loss on a single series costs about the same share of the treasury whichever asset it is: a more volatile name is not banned, it is sized down until it hurts the same.
Gold
Silver
Crude oil
Apple
Microsoft
Nvidia
Meta
AMD
Micron
SanDisk
Tesla
Bitcoin
Ethereum
Solana
Reference prices, shown until the live feed answers.
Open the terminalField 04
Six steps run in a fixed order. The first one is the gate: collateral moves before an offer exists, which is why nothing later in the sequence can default.
OfferBook / WriterEscrow
A writer escrows the underlying, names their own premium, and lists an offer. Collateral moves before the offer exists, so nothing on the shelf is ever unbacked.
OfferBook
A buyer takes an offer and pays the premium. It goes straight from buyer to writer, minus the protocol fee. Anvil never holds premium.
OptionToken
Options are ERC-1155 and freely transferable. Transferring one moves the right to exercise and no obligation, because the holder never had one.
ExerciseEngine
Before expiry the holder pays strike times quantity and receives the underlying. Their option tokens burn. No oracle is involved.
Anyone
After expiry the series stops trading. Anyone may flip its status, so writers never need a keeper to get paid.
WriterEscrow
Each writer collects their pro-rata assignment: quote for the contracts assigned to them, underlying back for the rest.
assigned = theirSold × seriesExercised / seriesSold
When a holder exercises, Anvil does not decide whose collateral was taken. The swap happens at the series level: underlying leaves the pool, quote enters it. Only after expiry does each writer compute their share, and then collect that many contracts’ worth of quote plus everything else back as underlying, including anything they wrote but never sold.
The reason is gas. Exercise costs the same regardless of how many writers back a strike. Walking a writer list on every exercise would get more expensive the more popular a series became, which is exactly backwards. Rounding is down, so the sum of assignments can fall a few units short; that dust stays in the pool and can never leave a writer unpaid.
Field 05
AnvilCore is the only address anyone calls. It holds no balances, enforces the pause, and passes caller identity down: every module is guarded by onlyCore, and no entry point lets a caller name a different beneficiary. Everything below core is reached downward, never upward.
Two further contracts, a depositor-funded vault and its risk limits, sit outside this graph. They write through core like any other participant, so the venue neither knows nor cares that they exist.
The orchestrator and the only address anyone calls. Holds no balances, enforces the pause, and establishes caller identity; every module is guarded by onlyCore.
Defines the terms. Admin lists an underlying, fixing its quote token, contract size and strike tick; after that anyone may open a strike, because an empty series holds no collateral and obliges nobody.
Where writers list and buyers take. Escrows collateral before creating an offer, then routes premium from buyer to writer directly, minus the fee.
Exercise before expiry, settle after it. The holder pays the strike and takes the underlying, which is the reason Anvil has no oracle.
The shelf. Tracks listed and sold per series and owns the sorted strike ladder used to route a buyer past a sold-out strike. The only contract permitted to move those numbers.
Custody for all writer collateral, and the pro-rata settlement after expiry. Tracks per-token obligations so solvency is checkable: held balance should always cover what is owed.
ERC-1155, one id per series. Only one side is tokenized: the writer's obligation lives in escrow as collateral, not as a token, so there is no short token and no id encoding to get wrong.
One fee, charged once, on the premium. Capped by an immutable constant so governance can lower it but never raise it past the ceiling. Never takes custody.
A ninth folder, shared/, holds types, errors, math, the auth base and safe ERC-20 transfers. It is not deployed and it never imports a module.
Field 06
Most of this design is a list of refusals. Each one deletes a subsystem, and every deleted subsystem takes a class of failure with it. These are not features waiting to be added later.
Writers name their own premiums. Anvil never quotes, so it has no volatility surface to maintain and no model risk, and it cannot be arbitraged through mispricing. A writer who prices badly is the one who finds out.
Removes the pricing engine, and with it every argument about whose model is right.
Settlement is physical: the holder pays the strike and receives the underlying. Nobody rational does that unless the option is in the money, so the holder's own decision carries exactly the information a price feed would have supplied.
Removes the settlement price, the staleness window, the dispute period and the guardian veto, which together are the biggest attack surface an options protocol normally has.
Anvil does not write options, does not run a vault, and does not take the other side. Its only revenue is a cut of each premium, so it earns whether the market goes up, down, or nowhere.
Removes any path by which the protocol itself can lose money on a trade. A protocol-owned writer vault would be short volatility: a different product, explicitly out of scope.
Every option is fully collateralized before it is listed. There is no leverage on the writer's side, and the buyer's only outlay is the premium they already paid.
Removes the liquidation engine entirely, because there is nothing to liquidate and nothing that can default.
What is left is a venue. Writers bring collateral and a price, buyers bring premium, and Anvil takes a capped cut of that premium for making the exchange safe. It earns whether the market goes up, down or nowhere, and it never takes the other side of anything.
Field 07
In development
Options expire. A strike sells out while you are away from a desk, and an in-the-money contract left unexercised pays nothing. Both are problems a phone solves better than a browser tab.
Physical settlement means nobody exercises on your behalf. The app watches your positions and tells you before the window closes.
Tell it the strike you want. It pings you when a writer backs it, or routes you to the nearest rung that has room.
The same chain, the same tenors, the same on-chain fills as the terminal, sized for a thumb instead of a cursor.
Nothing to download yet. When there is, it will be announced here and on X first.
Concept render. Sample data.
