Docs
loom is a liquidity layer for yield-bearing stablecoin positions — a second layer for DeFi. Deposits keep earning at blue-chip venues; LUME is minted against them at up to 80% LTV, with no oracle and no liquidation engine in the codebase. Live on Base Sepolia; audit pending, mainnet after it.
Written for a reader who has supplied a DeFi money market before. What is different here: the mint cost is measured rather than quoted, there is no price between the debt and the collateral, and every position can exit by being sold whole. Every checkable claim carries a § — it opens the enforcing contract's verified code on Basescan. /verify carries the complete ledger and address book.
The mental model
The protocol is one object — a receipt — and the verbs that act on it.
Figures illustrative.
Enforced byPositionManager §Receipt §
The receipt
Every deposit opens one — an ERC-721. Its four rows are the vocabulary the whole product is written in.
The receipt is the unit of account for everything. Debt is booked per receipt, not per owner — transfer the token and the debt, the accruing charge, and the unlock all travel with it. That is what makes a position sellable whole.
The unlock is stamped once, at deposit: now plus the market's withdrawal delay — 2 days on the launch market, and the registry hard-caps any market at 30 days. It is never reset: not by minting, not by repaying, not by a sale.
A closed receipt stays on-chain rather than being burned, so it still appears in your wallet. It can't be sold on the marketplace, minted against, or closed again — the token itself stays transferable.
Enforced byReceipt §PositionManager §
Deposit
A deposit routes 100% to the market's venue through its adapter — the launch market supplies USDC to Aave V3 today — and books the vault shares to a fresh receipt owing nothing — a zero-mint deposit is a complete position. There is no deposit fee and no split: the receipt claims everything the deposit earns, at the venue's own rate, under a per-market supply cap.
Enforced byVault §AaveV3Adapter §MarketRegistry §
Mint & the charge
Minting writes LUME onto a receipt you hold — whenever, in as many steps as you like — up to the market's max LTV: 80% of live net value, the receipt's shares at today's price minus the charge it already owes. Never of what was deposited. The registry hard-caps any market's LTV at 90%.
The debt is dollars against dollars — no price between them to attack.
Figures illustrative.
Past the cap, a position is reported, not seized — healthOf returns the exact excess, repayable by anyone.
The charge
A minted position pays the yield earned by the slice of its own collateral the minted face occupies — value(drawnShares) − drawnBasis, measured per receipt. That is the venue's own supply rate on the minted share, zero spread, and never principal — if the venue earns nothing, nothing is charged. There is no rate parameter anywhere in the protocol to set, raise, or govern.
Anyone may settle any receipt's charge — harden is permissionless, and a keeper runs it nightly. Settling turns an accrual into a transfer: the receipt's payout is already quoted net, so nothing on it moves.
On-chain, mint is borrow(receiptId, amount) — the ABI's name for the same verb. Passing receiptId 0 means "the receipt this transaction just created", which is how deposit-and-mint lands as one transaction.
Enforced byPositionManager §MarketRegistry §CarveAccumulator §
Stake — sLUME & the coupon
LUME stakes into sLUME, an ERC-4626 pool. 100% of the charge goes to stakers: no emissions, no points, no protocol rate. The pool prices the coupon as it vests, so a staker's figure moves without anyone executing anything.
The plumbing: a hardened charge is collected as vault shares and banked at the value it was taken at; the coupon — an equal face of LUME — is minted to the pool at par as it vests. The vest is linear over the span the charge took to accrue — 24h at the floor, 30 days at the cap, and a nightly sweep sits at the floor — because a share price that steps is sandwichable and one that vests is not. The collected shares themselves sit with the treasury.
Publishing both terms makes the gap measurable without summing receipts off the token.
Any yield figure the app shows for sLUME is realized — what a staked LUME actually returned over a stated window, annualized. No forward rate is projected, because there is none to project.
Enforced bysLUME §LUME §CarveAccumulator §
The marketplace
Every receipt can be sold whole, on-chain. Listing escrows the ERC-721 with the marketplace contract; a buyer pays the ask in LUME and takes the receipt with its debt, its accruing charge, and its unlock. Bids work the same way in reverse: the bidder's LUME is escrowed until the bid is accepted or withdrawn — an expired bid can no longer be accepted, and the bidder reclaims the LUME by withdrawing it.
Both sides settle pinned — a trade that no longer matches its bounds reverts.
The fee is 0 today — owner-settable, hard cap 5%, raises wait 48h. While escrowed, a receipt can't be minted against or closed.
Enforced byReceiptMarketplace §
Exits & T+2
Figures illustrative.
Enforced byPositionManager §Vault §ReceiptMarketplace §
Markets & venues
Five markets, two venue shapes — a savings vault is a different adapter, not a different label.
Every rate shown anywhere is read from the venue itself — Aave's liquidityRate (a ray), sGHO's targetRate (basis points), sUSDe derived from its own reward schedule. A derivation that is ill-conditioned is refused and shown as an em dash rather than printed wrong.
Enforced byMarketRegistry §
Security model
Enforced byPositionManager §
Governance & custody
The custody trail for the live USDC market, as deployed today; every hop below You is a contract.
A migration swaps the adapter under the vault without touching a single position — receipts, debt and unlocks all live above the seam.
One redemption is paid out of one side; the app reads the split and says so.
Same-block is reserved for moves that cannot hurt a depositor. A hop that moves value at par spends no budget; the hop INTO the refuge — an adapter holding the asset bare — is never rationed, and draining the rest out of a dead venue is rationed on its shortfall alone.
Testnet truth: the current owner is the deploy key — an EOA with an EIP-7702 delegation, verified on-chain — and it is also the treasury and the fee recipient. A Safe multisig ships with mainnet. Renouncing ownership is disabled on every contract.
Enforced byMarketRegistry §Vault §