Part III: The machine

7. The Desk

contracts/src/Desk.sol. One vault of USDG standing on both sides of every listing Float quotes. It is what makes the token tradeable when the home exchange is shut and the pool is empty.

The quote

buy  = mark * (1 + spread + impact + txFee)
sell = mark * (1 - spread - impact - txFee)

spread is 30 bps while the underlying exchange is open and 200 bps when it is not. A closed exchange is a stale reference, and the whole of that widening stays in the vault to cover the risk of quoting against one. impact scales quadratically with how far the trade pushes the book from balance, reaching 200 bps at the cap:

uint256 r = notionalAfter * BPS / l.oiCapQuote;
if (r > BPS) r = BPS;
return uint256(l.maxImpactBps) * r * r / (BPS * BPS);

It reads the post-trade book rather than the trade, so a trade pays for the book it leaves behind. And it divides by the stored cap, which is what makes backing a market (section 10) make it cheaper to trade rather than merely larger.

The balance sheet

equity    = availableLiquidity + reserveValue - liability
liability = sum over markets of |netOI| * oraclePrice

reserveValue is the custodied shares valued at the oracle, and its presence in that line is not cosmetic. Before it existed, the Desk's solvency check counted only on-chain USDG, so shares bought with a buyer's money were an asset that appeared nowhere: converting cash into real backing drove equity down by exactly the amount that had been backed. The act of making the product true was what made the vault look insolvent.

Both sides are marked at the oracle, never at the price the Desk transacted at. The spread lives in that gap: a buy takes the full USDG and mints fewer tokens than the mark would give, a sell retires the full position and pays less than the mark. Neither is booked as a fee, because it is not one. It is retained, totalShares does not move, and NAV per LP share rises.

What an LP actually keeps

Per dollar of notional, either direction, to first order:

LP equity change = spread + impact - protocolFee - stakerFee - launcherFee

At live settings, in hours: 30 - 0 - 10 - 10 = +10 bps of a 30 bps spread. After hours: 200 - 20 = +180 bps.

Worth stating flatly, because the parameter table misleads on it: of the three things that widen the price, only the txFee is paid out. Of the four things paid out, only the txFee is funded by a widening. The protocol, staker and launcher fees come straight out of the retained spread. Their ceilings sum to 90 bps against a 30 bps in-hours spread and nothing cross-checks them, so that is a parameter discipline rather than a guarantee.