The oldest point, and everything grown from it
The umbo is the beak of a shell — the point every growth line radiates from, and where you look to find out what the animal has been doing. This is the parameters, the fees, the lexicon, the rules and the provenance of every computed thing on the site.
12 of 19 are unset
A table with a hole in it is better than no table, because you find the
hole here rather than later. An em dash would be a value; unset is a state.
Fees
| Parameter | Value | Unit | State | Note |
|---|---|---|---|---|
protocolCutBps | 1000 | bps | written | of harvested fee income, not of assets and not of revenue |
protocolCutCapBps | 2000 | bps | written | compile-time constant; the owner cannot exceed it |
withdrawalFeeBps | 0 | bps | written | zero, and zero is a decision that has to be published like any other |
performanceFeeBps | unset | bps | unset | a routed vault taking a cut of the GAIN is a different fee on a different basis |
Vault
| Parameter | Value | Unit | State | Note |
|---|---|---|---|---|
virtualShares | 1 | share | written | inflation-attack offset |
virtualAssets | 1 | wei | written | inflation-attack offset |
depositCap | unset | asset | unset | uncapped as written |
minDeposit | unset | asset | unset | dust deposits are a real griefing surface and this is not decided |
Epitaxy
| Parameter | Value | Unit | State | Note |
|---|---|---|---|---|
harvestCadence | unset | blocks | unset | who calls it, how often, and who pays for it are all open |
harvestCaller | unset | address | unset | permissioned or open; if open it needs an incentive and there is none |
poolFeeTiers | 5 / 30 / 100 | bps | written | the published tiers must be exactly the tiers the router searches |
Aperture
| Parameter | Value | Unit | State | Note |
|---|---|---|---|---|
batchInterval | unset | s | unset | trades netting against how long a signature is exposed to a price move |
solverSet | unset | — | unset | permissioned or open, and by what admission process |
maxSlippageBps | unset | bps | unset | a bound the batch must clear inside, or the fill is void |
settlementAsset | unset | — | unset | what a batch clears in, which decides who carries the bridge risk |
Governance
| Parameter | Value | Unit | State | Note |
|---|---|---|---|---|
owner | unset | address | unset | an EOA and a timelock are not the same trust assumption and this says which |
timelockDelay | unset | s | unset | meaningless until there is a timelock; listed so the pair is visible |
adductorAuthority | unset | address | unset | who can pause, and whether pausing is one key |
upgradeable | no | — | written | no proxy; a new vault is a new deployment |
Every row names its basis
A rate without a basis is not a fee. Ten per cent of harvested fee income and ten per cent of the gain are different numbers on different quantities, and a stat tile that prints one of them as “the protocol fee” is rule 12.
| Flow | Rate | Basis | Cap | State |
|---|---|---|---|---|
| Protocol cut | 10% | harvested fee income | 20% | written |
| Withdrawal | 0% | assets withdrawn | n/a | written |
| Performance | unset | gain over high-water | unset | unset |
| Aperture spread | unset | notional filled | unset | unset |
| Prismatic desk | unset | notional filled | unset | unset |
3 of the 5 flows have no rate, because the components they belong to are not built.
Fifteen ways a page like this comes apart
Each was observed on a live, funded product in this category during an
audit run against the chain rather than against the copy. No site is named — the
point is that these failures are structural, not that somebody is bad at their job.
10 are enforced here by a named check in
tools/validate.mjs; the other
five are obeyed by discipline, and say so.
-
01
A count printed twice must be computed once.
Five different answers to "how many vaults are there" on one site — 17, 15, 14, six, "the fourteen assets" — three of them a few hundred pixels from a figure computed live from the chain.
checked
counts-derived -
02
A number word in prose must equal the thing it counts.
"Four contracts, one path", above four functions on one contract, on a page whose own docs list two.
checked
prose-counts -
03
Nothing is written in the present indicative unless it is deployed.
A hook described as pushing fees into the vault, on a protocol where every vault's harvester address was zero and every share price was exactly 1.
checked
states-required -
04
A retraction belongs in the same band as the claim.
Two of three "rails" not built, retracted inside a collapsed FAQ item and on a different page, while the present-tense version held the nav, the hero chip, the title and the social card.
checked
states-required -
05
A version number must be the version in the code.
"v4 hook vaults" in the hero; the string v4 appeared once on the entire site and every code path referenced v3.
discipline only no build check enforces this one
-
06
If the argument rests on a repository, link the repository.
Four separate invitations to go and read the tests, and one github.com link — pointing at the GitHub home page — rendered nowhere on the site.
checked
no-unlinked-evidence -
07
An aggregate that drops rows must say which.
A total labelled "across every vault" computed by a helper whose own comment says unpriceable vaults are left out; the app page disclosed the exclusion, the landing page did not.
discipline only no build check enforces this one
-
08
Claiming a standard means passing it.
ERC-4626 asserted in the trust strip;
maxDepositandmaxMintreverted on chain, which the standard forbids — and the site's own ABI could not have detected it.checked
standards-scoped -
09
A price beside a token must be that token's price.
Tokenised-equity cards showing the reference equity's quote, on a chain where the token's own pool price was already being read three lines away for a swap.
discipline only no build check enforces this one
-
10
Disclose every contract you ask for an allowance to.
An unlimited approval to an address that appeared in one config file and on no human-readable page, on a docs page whose stated purpose was what is deployed.
discipline only no build check enforces this one
-
11
A parameter asserted as on-chain must be readable on chain.
"Hard cap in the contract — 20%" rendered from a JavaScript constant, under a promise that every figure is read from the contracts, with no ABI entry that could read it.
checked
params-sourced -
12
Every fee names its basis.
One page quoting a cut of harvested fees, another quoting a cut of the gain, and a single stat tile presenting the first as the protocol's fee.
checked
fee-basis -
13
A promise about your contract is not a promise about your dependency.
"Redeem any block", unconditionally, for a vault forwarding into a lending market whose withdrawability is a function of utilisation.
discipline only no build check enforces this one
-
14
The key that undoes the guarantees goes in the guarantee list.
Four correct guarantees on the home page; the single externally-owned account that sets the harvester and the fee on all of them, on another page.
checked
trust-in-list -
15
A copyable address with no stated utility is a purchase prompt.
A verified token contract in the hero and the footer of every page, never mentioned again — no utility, no supply, no relationship to the vaults.
checked
empty-ca
Seven words, each one earning it
If the biology does not describe what the contract does, the word is wrong and gets replaced. That test removed three candidates before these survived.
| Term | What it names | Why the word |
|---|---|---|
| Tablet | the transferable ERC-20 receipt | The crystallographic unit of nacre is a single aragonite tablet, about a third of a micron thick. Every tablet in a shell is interchangeable with every other; the value is in the stack, not in any one of them. A fungible share is the same object. |
| Epitaxy | the v4 hook that harvests fees into the vault | Each new tablet nucleates in register on the one below it, through pores in the organic sheet — it does not land at random. A harvest deposits on the existing stack and raises every share by the same factor, which is the same property. |
| Aperture | the batched private intent router | The gape between the valves: the one controlled opening, narrow, and the only way anything gets in or out. An order passes through it without the shell opening. |
| Prismatic | the tokenised-equities desk | The prismatic layer is the outer wall of the shell, and it is a different mineral from the nacre behind it — calcite, not aragonite, grown on a different schedule. An equity bonded to a 24-hour chain is exactly that: the same shell, a different material, its own clock. |
| Lustre | the yield decomposition | Lustre is one word for at least three separate optical effects, and quoting it as a single number is the mistake this whole site is about. One figure for "yield" hides four other terms, three of them negative. |
| Adductor | the emergency stop | The muscle that closes the shell. It stops what is being taken in; it does not remove anything already deposited. Redemptions stay open under Adductor. Nothing else moves. |
| Umbo | the published parameters | The oldest point of a shell, the beak the whole thing grew out of. Every growth line on the surface radiates from it, so it is where you look to find out what the animal has been doing. |
Every accent is the colour of a real stack
Reflectance of 32 aragonite and
protein bilayers by transfer matrix at normal incidence, integrated against the CIE 1931
two‑degree colour matching functions under D65, converted to sRGB.
node tools/palette.mjs reproduces every hex below, after twelve self-checks.
Derived
The hue of every accent, and the ratios between the chromas in the hero. Five tablet thicknesses evenly spaced across an 80 nm window inside the published range for sheet nacre go in; whatever hues the interference produces come out. No thickness was chosen to land on a colour — that would make the hue chosen and the derivation decorative.
Chosen
One global chroma and every lightness. A reflectance spectrum fixes a chromaticity, not a luminance, and has no opinion about how bright a swatch should be on a web page. Each accent keeps its physical hue and is darkened to the highest lightness that still clears 4.5:1 on the darkest surface it sits on.
The finding, which the palette would rather it did not say
This measurement was wrong twice, and both errors flattered the claim. The first version ran on a 12-bilayer stack — a default in the optics module — while every hex, every figure and the hero run on 32. And it matched on hue alone. Hue is ill-defined wherever chroma approaches zero, and that is exactly where a hue-only search lands: it reports 340 nm and 481.75 nm as agreeing to 3.87 degrees of hue — at 0.204 times the chroma, an OKLab distance of 0.1391. A saturated rose beside a warm grey. The search is on colour difference now, and the hue-only answer is still printed above because the gap between the two is the more interesting number.
One caveat the shaded band in the figure makes visible, and it is the family’s recurring lesson rather than a new one: the answer depends on the window you search. Across the whole modelled range the closest pair is identical to 0.01087; restricted to the 300–500 nm window a sheet-nacre tablet is actually reported in, the closest pair is 305 and 462 nm at 0.06614 — close, and visibly not the same. Both numbers are here because quoting only the first would be the thing this page is about.
Three things that could make every hex above wrong
Neglecting aragonite’s dispersion. Its index runs about 1.690 at 400 nm and 1.675 at 700 — roughly 1% — and the model uses one value. Measured, not assumed to be small.
Truncating the stack at 32 bilayers. It never settles exactly: a lossless periodic stack keeps layer-count-dependent sidelobes outside its stop band forever.
The refractive index of the organic sheet, for which the literature gives 1.435 to 1.56. This one is the largest by a factor of 7, and every hex above is quoted to six digits on top of it.
Provenance — the hero
The patch at the top of the home page is the same physics. Each cell is one aragonite tablet, laid out as a Lloyd-relaxed Voronoi tessellation because real nacre tablets are close to a Poisson-disc arrangement rather than a Poisson one. The stack thickens as you watch, and every tablet walks the interference series.
Two things about it are chosen and named rather than tuned: every tablet is drawn at OKLab lightness 0.925 with the most saturated thickness in the sweep at chroma 0.085. The ratios between the chromas are derived, which is why the patch goes almost colourless around 480 nm — a real feature of the interference, not a gap in the animation.
The lookup table was wrong by up to 108 degrees of hue on the first attempt, and it
looked fine. It was built on a 5 nm wavelength grid, which is what every
published colour-matching table uses. A 32-bilayer
stack is a photonic crystal: its stop bands are narrower than that, so the integration
aliased and returned a different colour rather than a noisy one. The requirement also
tightens with the layer count — at 8 bilayers a 4 nm grid is good to 0.06
degrees; at 32 the same grid is out by 11.6. js/optics.js now asserts the
grid against the stack in use, with a negative control that fails if a 5 nm grid
ever stops being detectably wrong.
Four consequences of the design, not a wish list
Nothing pays for a harvest
The share price only rises when someone calls the harvest path, and the caller pays gas to raise everyone else's shares including their own by the same factor. A permissioned caller is a liveness dependency; an open one needs an incentive, and there is no line item for it. harvestCaller and harvestCadence are both unset for this reason and not by oversight.
Storage accounting cannot mark a loss
Under storage accounting totalAssets moves on harvest and on deposit/withdraw, and on nothing else. If the underlying position is worth less than the credited total, redemption at the computed price pays early redeemers in full and leaves the shortfall with whoever is last. This is the central unresolved question in the design and it is the reason /tablet leads with the decomposition rather than the price.
A batch needs a reason for a solver to show up
Aperture clears a batch at a uniform price. Uniform clearing removes most of what a solver would earn from ordering, which is the point and is also the problem: the surplus that pays for solving has to come from somewhere, and no parameter names it. solverSet and batchInterval are unset together because neither can be chosen without the other.
Two clocks have no agreed price between them
A tokenised equity trades on chain for the 135.5 hours a week its reference venue is closed. There is no accepted answer for what the fair price is during those hours, and every mechanism that pretends there is has to choose between quoting a stale number and quoting a number no one can arbitrage. Prismatic is unset for this reason.