Deep Dive: Vitalik's Paper on Index-Tracking Assets Backed by Options Instead of Debt

In early June 2026, Vitalik posted a short proposal on ethresear.ch titled Building Index-Tracking Assets on Top of Options Instead of Debt. The idea, stripped of jargon: build a synthetic dollar on Ethereum that can’t be force-liquidated, doesn’t need a real-time price oracle, and works the same way for synthetic CPI, synthetic gold, or anything else you might want to track.

The original post is four paragraphs and a handful of payoff diagrams. It assumes you already know what an option is, what a stablecoin is, what an oracle is, and what “liquidation” means in DeFi. If any of those words don’t land, the proposal is impenetrable.

This piece assumes none of that. We’ll build the construction from scratch with worked numbers at every step, and recover Vitalik’s payoff diagrams as we go. By the end, the original post should read like a one-page summary of a thing you already understand.

What we’re trying to build

The fundamental DeFi puzzle: you want an asset that lives on Ethereum but behaves like a US dollar. One unit of it should always be worth roughly $1, whether the rest of crypto is mooning or crashing. Call this a “synthetic dollar”.

The problem is that Ethereum doesn’t natively know what a dollar is. There is no $1 primitive on-chain. The chain knows about ETH, its native token, and whatever ERC-20s have been deployed. None of those things has any built-in connection to the actual US dollar.

So if you want a dollar-tracking asset on-chain, you have to build one, and you have to do it using only ETH (and possibly other crypto-native assets) as raw materials. The price stability has to come from your design, not from the chain.

This is exactly the puzzle that stablecoins like DAI, RAI, sUSD, and others have tried to solve. Most of them solve it the same way: with debt and liquidations. Vitalik’s proposal solves it differently: with options. To see why that’s interesting, we first have to understand what’s wrong with the debt approach.

The old way: debt and collateral

DAI is the canonical debt-based stablecoin. The mental model is:

1. You lock $300 worth of ETH in a smart contract as collateral.
2. The contract mints you $100 worth of DAI (an ERC-20 marked ”≈ 1 USD each”), which you can spend.
3. To get your ETH back, you return the $100 of DAI plus a small interest fee, and the collateral unlocks.

The key trick is over-collateralization. You can only borrow up to a fraction of your collateral, typically 50–66%, so $300 of ETH gets you $100–$200 of DAI. The buffer absorbs price movements: if ETH drops 30%, your $300 of collateral becomes $210, but you still owe only $100. The system is still over-collateralized; the DAI is still backed.

But what if ETH drops 60%? Now your $300 of collateral is $120, and you owe $100 of DAI. The buffer is almost gone. If ETH drops another 20%, your collateral falls below your debt: you owe more than what’s locked up. At that point, the DAI you minted is no longer fully backed. The peg breaks. The whole system is at risk.

To prevent this, debt-based stablecoins use liquidations. When your collateral ratio falls below some threshold (say 150%), anyone in the world can trigger a liquidation: they pay off some of your debt and seize a proportionally larger chunk of your collateral, at a discount. This restores the over-collateralization. You lose money, but the system stays solvent.

Why this scares Vitalik

Liquidations work, in the sense that DAI has survived for years. But they have one structural dependency that doesn’t go away: a real-time, on-chain ETH/USD price feed. Without one, the system can’t tell whether a position has gone underwater.

That sounds innocuous until you ask: where does that price come from? It comes from an oracle: a contract that publishes the current ETH price on-chain. Chainlink is the most popular one. But Chainlink (and every other real-time oracle) is a piece of trust infrastructure: it depends on a small group of nodes pushing prices, signed and aggregated.

This is the part Vitalik calls out as the weakest link. Real-time oracles are very hard to make safe, because:

• They have to respond instantly. No time for human review, slow appeals, or fraud-proof challenge periods.
• They depend on a fixed set of automated reporters. Compromise the set, and you can push a fake price and trigger billions of dollars of fraudulent liquidations.
• The most robust oracle constructions (prediction markets backed by expensive arbitration) can’t be used in real time. They take hours or days to resolve.

So debt-based stablecoins are stuck with the worst kind of oracle: one that has to be fast, can’t be challenged, and is therefore inherently less trustworthy than what crypto knows how to build.

A constraint we can’t escape

Before we propose anything, there’s one constraint we have to face head-on. It applies to DAI and to any new design.

The protocol only holds ETH. (Or whatever crypto-native asset its users posted. For this whole article we’ll assume ETH, but the same logic works for any underlying.) It does not hold US dollars. There is no Federal Reserve attached. Real dollars exist nowhere in the system.

So if we want to issue a synthetic dollar, a token that behaves like USD, every dollar we mint has to be matched by a dollar of opposite exposure held by someone else. Otherwise the books don’t balance.

Put more precisely: for the system to be solvent in all states of the world, the total dollar exposure inside it must equal zero. For every holder of “+1 synthetic dollar”, there has to be someone holding “−1 synthetic dollar”: someone short USD against ETH.

In DAI, the “+1 USD” side is the DAI holder, and the “−1 USD” side is the borrower who minted the DAI against ETH collateral. They’re zero-sum: if USD rises against ETH (i.e. ETH falls), DAI holders win and borrowers lose. Liquidations are the mechanism that closes losing borrower positions before they go underwater.

Vitalik’s design takes the same zero-sum constraint but solves it differently. Specifically, he asks: what if the “short USD” position were structured as an option, instead of as a leveraged debt? That’s the whole idea. The rest of this article is the unpacking.

The split

Here’s the construction, stated directly. Walk through it slowly; we’ll unpack each piece below.

Pick three parameters:

• A strike price S, say $1500 per ETH.
• A maturity date M, say two months from now.
• A trusted oracle that, exactly at maturity M, publishes the final ETH/USD price. Crucially, this oracle only has to fire once. It can be slow, deliberative, and challengeable in the meantime.

Anyone with 1 ETH can deposit it into the contract and receive two new ERC-20 tokens in exchange: a P token and an N token. Both are pegged to this specific (S, M) market: there is a different P and N for each strike and maturity.

At maturity M, when the oracle resolves the final ETH price to some number x, the contract pays out the deposited ETH split between the two tokens:

P holder receives:  min(1, S / x)  ETH
N holder receives:  max(0, 1 − S / x)  ETH

The min and max are doing all the work. Stare at them for a moment. The two payouts always add up to exactly 1 ETH, the same ETH that was deposited. There is nothing missing, nothing extra. The split is conservative.

Two things to note right away.

Symmetry. Whoever holds P is taking one side of a bet on the final ETH price; whoever holds N is taking the other side. The contract is just the escrow.

Conservativeness. Because P + N = 1 ETH exactly, the contract can never be insolvent. It always has enough ETH to pay out both sides. This is the structural reason there can never be a liquidation.

Walking through the payoff

The formulas are easier to feel than to read. Let’s plug in S = $1500 and walk through four ETH price scenarios at maturity. Pretend ETH is at $3000 today, so the user is depositing $3000 worth of ETH and getting back a P + N pair.

Scenario A: ETH ends at $3000 (no change).

• P receives min(1, 1500/3000) = 0.5 ETH. At $3000 each, that’s worth $1500.
• N receives max(0, 1 − 0.5) = 0.5 ETH. At $3000 each, that’s also worth $1500.

Scenario B: ETH rallies to $6000.

• P receives min(1, 1500/6000) = 0.25 ETH. At $6000 each, that’s worth $1500.
• N receives max(0, 1 − 0.25) = 0.75 ETH. At $6000 each, that’s worth $4500.

Scenario C: ETH drops to $1500 (exactly at strike).

• P receives min(1, 1500/1500) = 1 ETH. At $1500 each, that’s worth $1500.
• N receives max(0, 1 − 1) = 0 ETH. Worth $0.

Scenario D: ETH crashes to $750.

• P receives min(1, 1500/750) = min(1, 2) = 1 ETH. The min caps it; we can’t pay out more than the 1 ETH that was deposited. At $750 each, that’s worth $750.
• N receives max(0, 1 − 2) = max(0, −1) = 0 ETH. Worth $0.

A pattern jumps out. As long as the final ETH price stays at or above the strike, P is worth exactly $1500. Whether ETH is at $1500, $3000, $6000, or $1,000,000, the P holder gets the same $1500 of value. It’s perfectly dollar-stable in all those scenarios.

But the moment ETH falls below the strike, P stops being dollar-stable and just becomes 1 ETH. At ETH = $750, P is worth $750. At ETH = $500, P is worth $500. That’s the asymmetry: P protects you from upside ETH volatility, not unlimited downside.

We can plot this in two ways. First, the payouts in ETH terms: how many ETH each token receives as a function of the final price:

The two curves are mirror images, at every price they sum to 1.0 ETH, which is just a visual restatement of the fact that the contract is conservative.

Now the same picture, but plotted in dollar terms: what is the USD value of P at each final ETH price?

This is the central object of the whole proposal. Everything that follows is about how to use this kinked payoff to construct something that behaves like a stable USD on average.

”But this isn’t a stablecoin”

A reasonable reaction at this point: “P is only dollar-stable when ETH stays above the strike. If ETH crashes through $1500, P just collapses to ETH and the holder loses money. That’s not a stablecoin; it’s a covered call with a built-in cliff.”

This is correct. P, on its own, is not a stablecoin.

But notice the asymmetry. The user gets to choose the strike at mint time. If they pick a strike well below today’s price, the “P collapses to ETH” region is far away. ETH would have to fall a lot before they lose their USD-likeness. And before that happens, while they’re still safely in the flat region, they can sell their P and buy a new P with an even lower strike, pushing the danger zone further away again.

This is the heart of the proposal. P isn’t a fire-and-forget stablecoin. It’s a position you actively manage. The system gives you USD-like exposure for as long as you keep rotating to lower strikes as ETH drifts down.

The trade is: in exchange for occasional rebalancing, you get a system with no liquidations and no real-time oracle.

We’ll cost out the rebalancing in a moment. First, let’s see what the payoff looks like before maturity, since that’s the regime the user actually transacts in.

What the payoff looks like before maturity

The diagrams above are payoffs at maturity, when the oracle resolves and the contract pays out. But for the user, the day-to-day reality is the current market price of P, well before maturity arrives.

That market price is set by people trading P on a DEX. Their bids reflect what they think P will be worth at maturity, discounted by the time and uncertainty in between.

Crucially, no one knows where ETH will be at maturity. So the market doesn’t know whether P will land in the flat region (worth $1500) or the slanted region (worth less). What it can compute is a probability-weighted mix of the two.

The result is a smoothed-out version of the at-maturity diagram. The kink rounds into a curve:

The takeaway: as long as the current ETH price is comfortably above the strike, P trades at roughly $S. “Comfortably” depends on how much time is left and how volatile ETH is, the same parameters that drive any option’s price, but the principle is robust. A P with strike $1500, when current ETH is $3000 with a month to maturity, will trade for something very close to $1500.

The “quadratic drift” phrase Vitalik uses describes the shape of how P’s value drops as ETH moves toward the strike. Far from strike, small price moves barely matter. Near the strike, they matter much more. The cost accelerates as you get closer to the kink.

The rotation strategy

So how does a user maintain USD exposure over the long term, given that any one P token only protects against price drops down to its strike?

They rotate. Vitalik’s rule of thumb, almost verbatim:

If the current price is X, buy a P with strike S < X/2 and maturity 1–2 months in the future. If the price drops below S × 1.5, rotate out into a new P with strike S' < X'/2, where X' is the new price.

Let’s walk through that. Suppose ETH starts at $3000 and the user wants stable USD exposure.

1. They buy a P with strike $1500 (half the current price), maturity in 2 months. The market price of this P is ≈ $1500 since the strike is far away. They now hold roughly $1500 of “synthetic USD”.
2. Two weeks pass. ETH drifts down to $2500. The P is still safely in the flat region; the market price of P is still ≈ $1497. The user does nothing.
3. Another two weeks. ETH falls to $2250 = 1.5 × strike. We’re approaching the danger zone. Time to rotate.
4. The user sells their P (still worth ≈ $1490) for USDC, then uses the proceeds to mint a new P with strike $1125 ( = $2250 / 2) and a fresh 2-month maturity. They now hold ≈ $1485 of P at the new strike. The danger boundary just moved from $1500 down to $1125.

This is what Vitalik means when he writes never hold to maturity. Holding to maturity would expose you to whatever the oracle eventually reports, including the risk of ETH drifting below your strike right before settlement. The strategy is to always sell well before maturity and re-deposit into a new strike, so your exposure to “P collapses to ETH” never actually crystallizes.

The natural follow-up: how expensive is rotating? It depends on the secondary market microstructure for these P tokens: bid-ask spreads, market-maker depth, gas. Vitalik’s own estimate is that you can lose 2%/year or more purely to rotation slippage if it’s done naively, and that getting this number down is the single biggest engineering risk for the whole scheme. He suggests rebalancing should look more like a bond market (gradual one-sided market-making, batched auctions) than an AMM swap, so users don’t pay AMM-style spreads on every rebalance.

How would P and N actually trade?

We’ve just said rotation is the dominant cost, and that getting it cheap is the hardest engineering problem in the whole design. So it’s worth slowing down and asking the most basic question: where do these tokens actually trade, and what does a good marketplace for them look like?

The instinct is to say “we need a liquid options exchange.” That turns out to be both more than we need and the wrong shape. Let’s build up the answer the same way we built the rest of the construction: from the bottom.

What actually has to trade

There are really only two things a user ever does:

1. Get in or out. A USD-seeker buys a P. Someone betting on ETH buys an N.
2. Rotate. As ETH drifts down, the user sells their old P and buys a new P at a lower strike.

Rotation is the one that matters. A user might enter once and rotate a dozen times over a year. Every rotation pays whatever the market charges to trade. So the whole question of “is this system cheap enough to use” is really the question “how cheaply can someone rotate from one P to another.”

The trick: you only ever need one side to be liquid

Remember the single fact the whole construction rests on: a P and an N always add up to exactly 1 ETH. The contract mints them as a pair (1 ETH → P + N) and lets you hand the pair back to get your ETH (P + N → 1 ETH).

That gives us a free pricing law. At all times:

price of P  +  price of N  =  price of 1 ETH

If that ever drifts, someone makes free money: mint a fresh pair for 1 ETH, sell whichever side is overpriced, pocket the difference. Arbitrageurs enforce the equation for us.

The consequence is the most important thing in this chapter. We do not need both P and N to have deep, healthy markets. If P has a good price, N’s fair price is just “ETH minus P”, and vice versa. Only one leg needs real liquidity; the other is pinned to it by arithmetic.

(One caveat worth flagging: this only works cleanly if you can recombine P + N → ETH at any time, not just at maturity. If the contract only allows it at maturity, the anchor gets much weaker. Treat “recombine anytime” as a required feature, not a nice-to-have.)

Why you can’t just drop them in a Uniswap pool

The obvious thing is to give every P its own automated market maker (AMM) pool: a P/USDC pool you swap against, one per strike and maturity. This is also exactly the mistake Vitalik warns about, for two reasons.

Fragmentation. There’s a different P and N for every strike and every maturity. Spin up a pool for each and you get hundreds of thin, near-empty pools instead of a few deep ones. Thin pools mean big price impact, which means expensive rotations.

You pay a toll on a trade that shouldn’t cost much. A rotation is selling a P worth ≈ $1490 and buying another P worth ≈ $1485. You’re swapping one near-cash asset for another near-cash asset. An AMM doesn’t know that; it charges its usual percentage spread on the full $1490 every single time. Do that monthly and the fees alone eat the 1–4% stability budget the whole design is trying to protect.

So an AMM turns the cheapest possible trade into a recurring tax. That’s how the “2%/year done naively” becomes “5–10% and not competitive with DAI.”

What good looks like: a rollover desk, not a swap

Here’s the insight that fixes it. Rotations aren’t random. When ETH drifts down, everyone wants to do the same trade at the same time: step their strike down a notch. The flow is predictable and lopsided.

When a crowd all wants the same thing, you don’t send each person to a swap counter one at a time. You batch them. Collect everyone’s rotation requests over some window (say, daily), match them against each other inside the batch, and only take the small leftover out to the open market.

This is why Vitalik says rebalancing should look “more like a bond market than an AMM swap.” A bond market doesn’t run everything through a constant-product curve; it has dealers who quote, warehouse inventory, and hedge, and it clears big predictable flows in batches. Concretely, a good P/N venue would have:

• A single “rollover” action that sells your old P and mints your new lower-strike P in one step, so you don’t pay two separate trading fees.
• Batched clearing that nets all the simultaneous rollovers against each other before touching the open market.
• Professional market makers quoting a small set of standard P series, hedging their books on spot ETH and perps, the way bond dealers do, rather than passive liquidity sitting in a pool.

It’s an option, but the easy part of one

P really is an option (a covered call), so whoever quotes it is running an options book and needs an options pricing model. That sounds like it demands a full-blown options exchange. It doesn’t, because of where well-managed positions live.

The rotation rule keeps every user deep in the flat region: strike well below the current price, far out of the money. Down there, P barely behaves like an option at all, it just sits at ≈ $S and inches around. All the genuinely hard option pricing (the sharp sensitivity to volatility and time) happens near the strike, which a careful holder never goes near.

So the market doesn’t need to support every strike at every distance from the price. It needs depth in a handful of standardized, deep-out-of-the-money series at a few standard maturities (1-month, 2-month, 3-month). That’s a far smaller ask than a real options chain, and it’s why concentrating everyone onto a short “maturity ladder” is the right call.

One honest limit: none of this machinery saves you if nobody wants the N side. Batching and netting make trading cheap, but they can’t manufacture a counterparty. If leveraged-ETH demand dries up, the pair can’t clear at a fair price no matter how slick the venue is. We’ll come back to that in Chapter 12.

Quadratic drift, in plain English

Vitalik summarises the price-stability cost as “quadratic drift, with standard deviation on the order of 1–4% per year”. Three things to unpack.

“Drift” means the value of your P-token position, denominated in USD, wanders a bit. It’s not a clean $1 peg like USDC. Over a year, a $1500 position might end up at $1480 or $1530. The variance is bounded but not zero.

“Quadratic” describes the shape of the smoothed payoff curve near the kink. It’s a parabolic transition, not a sharp corner, and the cost of being near the strike grows roughly with the square of how close you are. Far from strike, you pay almost nothing for stability; near the strike, you pay much more.

“1–4% per year” is Vitalik’s gut estimate. For context:

• The DAI peg historically wobbles between $0.99 and $1.02. Most of the time it’s tight, but during stress events it can deviate by 5%+ for days.
• Fiat currencies routinely move 5–15% per year against each other.
• RAI, a redemption-rate-based stablecoin, has a “rate” that moves a few percent per year by design.

In that context, 1–4% annual standard deviation isn’t a peg in the USDC sense, but it’s stable enough to be usable as a unit of account or a savings vehicle. Vitalik’s argument is that this kind of “good enough” stability is underrated in the design space: most stablecoin designs over-optimize for tight pegs at the cost of robustness, and a slightly looser peg with a much more robust underlying design is a better trade.

Who buys the N token?

Every P holder is matched by an N holder. So if there’s going to be supply of P (USD-seekers), there has to be demand for N. Who wants N?

Look at N’s payoff again. At strike $1500: if ETH ends at $3000, N pays out 0.5 ETH = $1500. At ETH $6000, N pays out 0.75 ETH = $4500. At ETH $1500 or below, N pays out zero.

That’s a call option on ETH. N gives you leveraged exposure to ETH’s upside: if ETH stays flat or falls below strike, you make nothing; if ETH rallies hard, you make many multiples of what you paid.

So the natural buyers of N are:

• Speculators who want leveraged long ETH without going through a perp DEX. N is non-liquidatable leverage: you can’t be forced out of the position, you just earn zero at maturity if ETH disappoints.
• Market makers willing to warehouse the position because they can hedge it elsewhere (e.g. by holding spot ETH and shorting via perps).
• DeFi protocols that want to express directional ETH views without on-chain leverage primitives.

The economics for them are roughly the inverse of P-holder economics: they’re paying a “premium” today (the market price of N is a fraction of its expected payout if ETH rallies) in exchange for the upside if ETH rallies.

The whole system only works if these two demand pools, synthetic-USD holders on the P side, leveraged-ETH bulls on the N side, are roughly balanced. If they’re not, the market price of one side gets pushed away from “fair” until the imbalance corrects.

Beyond USD: tracking anything

Nothing in the construction is specific to USD/ETH. The oracle at maturity reports some number x, and the contract pays out based on that number. The number could be:

• ETH/USD: gives us synthetic USD, as walked through above.
• ETH/CPI: gives us a synthetic inflation-adjusted dollar.
• ETH price of gold: synthetic gold-pegged token.
• An index of San Francisco rent prices: synthetic rent-hedging token.
• Anything else an oracle can resolve, slowly, at a single moment in time.

The constraint is just: the oracle has to be able to publish one number, once, at maturity, that everyone agrees is the “correct” value of the index. Optimistic oracles, prediction markets, multisig committees with appeal periods: all qualify. Real-time price feeds are not required.

For more exotic indices, average rent, average global wheat price, things like that, this is actually a much bigger improvement over the DAI model than it is for USD. For USD, real-time oracles already exist and are probably good enough. For “average rent in SF this month”, real-time oracles don’t really exist, but a slow, deliberative oracle with appeals is perfectly plausible. The design unlocks the whole space of slow-oracle-friendly synthetics.

Side-by-side: debt vs options

The whole comparison in one table:

Property	Debt-based (DAI, RAI, etc.)	Options-based (this proposal)
Underlying primitive	Over-collateralized debt + liquidations	Split 1 ETH into a P/N option pair
Oracle requirement	Real-time, push-based, high-frequency	One-shot at maturity, can be slow and challengeable
Insolvency risk	Yes, during fast price drops	Structurally impossible: P + N = 1 ETH always
Stability of $1 peg	Tight (~ ±1%) most of the time, occasional breaks	Loose drift (~ ±1–4%/year), no cliffs
Behaviour in tail events	Sudden liquidations, possible cascades	Gradual drift; users rotate at their leisure
User maintenance	None until liquidation	Periodic rotation to lower strikes
Suitable for exotic indices	Hard: no real-time CPI / rent / etc. oracle	Natural fit: slow oracles work fine

The trade is real, and it’s a trade. You give up the tightness of the peg and take on a rotation maintenance burden. You get back: no real-time oracle dependency, no liquidation cascades, and a model that generalizes to indices where real-time oracles can’t even exist.

What’s still unsolved

The proposal is, by Vitalik’s own admission, more sketch than blueprint. The big open questions:

• Rotation slippage. This is the dominant cost. Designing the secondary market for P/N tokens so that rotations are cheap (auctions, slow market-makers, batched clearing) is the single biggest engineering problem. Get this wrong and the 1–4% drift becomes 5–10%, and the system isn’t competitive with DAI.
• N-side demand. If there’s no natural buyer for the leveraged ETH side, the market price of N gets pushed below fair value and the market price of P drops correspondingly. The economics only close if both sides have real demand.
• Choice of maturity ladder. The system needs P/N pairs across many strikes and maturities, each with enough liquidity to support meaningful flow. Concentrating liquidity into a few standard tenors (1-month, 2-month, 3-month) is probably correct, but the exact set has to be figured out.
• Oracle design. The oracle still has to be trustworthy at maturity. Slow oracles solve the “must respond instantly” problem but introduce new ones (governance attacks during resolution, appeal-process design, etc.).
• Exercise vs settlement. Vitalik’s version uses an oracle to resolve a final ETH price. A respondent on the thread (mmchougule) demonstrates a variant on Base that uses physical settlement: the N-holder exercises by paying the strike in USDC and receiving the underlying WETH, with no oracle required at all. Interesting, but it requires the underlying to be the actual on-chain asset, not “ETH” as an abstract index.

None of these are deal-breakers. They’re the engineering work that has to happen to turn an elegant idea into a working protocol.

Closing thought

The whole proposal hinges on one substitution: replace “force-liquidate underwater debt in real time” with “split into options that can never go underwater”. Once you make that substitution, every other property of the design falls out as a consequence: the oracle can be slow, the user has to rotate, the peg drifts by a few percent, the system generalizes to any index a slow oracle can resolve.

If you can recite that substitution and the four consequences without re-opening this page, you understand the proposal. Building it is a different question. But understanding it is the prerequisite, and the original ethresear.ch post will be much easier to read on a second pass with this framing in hand.