Thesis Vault - PAXG Vol Income Vault by Enhanced

Litepaper

Version 1.3 July 2026 Enhanced Labs

This document is a high-level overview of the PAXG Volatility Income Vault and the Enhanced protocol that powers it. It is informational only, does not constitute investment, financial, or legal advice, and is not an offer or solicitation. The protocol is provided "as is", without warranty of any kind. See the Disclaimer below.

Abstract

The PAXG Volatility Income Vault is a depositable structured-yield product for tokenized gold. A depositor makes a single deposit of PAXG; the vault then writes conservative, out-of-the-money European covered calls on the pooled gold on a rolling biweekly epoch, sells them to competing institutional market makers, and distributes the premium pro rata — auto-compounded into PAXG by default, or delivered as a withdrawable USDC income stream. Principal remains fully collateralized onchain at all times, with no leverage and no liquidation risk.

The vault is powered by Enhanced: structured-product vault infrastructure for onchain assets. At its core, it consists of an options engine on Ethereum that lets holders of any oracle-priced asset write European options onchain, plus a vault system that wraps those strategies into depositable products — immutable, parametrically-defined strategy vaults that perform option-writing on a rolling epoch basis, with epoch-level accounting and pro-rata premium distribution.

The vault, its oracle-driven settlement, and its RFQ price-discovery mechanism all rest on the same option primitive. That primitive is built on the open-source Opyn Gamma Protocol — the gold standard for onchain options for several years and the most battle-tested options margin and settlement system in DeFi. Enhanced extends Gamma with signed RFQ execution, an automated vault layer, tighter access-control gates for compliant institutional use, and more.

Yield is not borrow demand, not trading fees, not token emissions. It is the premium paid by institutional market makers to purchase options the protocol writes on behalf of its users.

As of 1 August 2026, the protocol has successfully completed an audit by Sherlock, a top-tier smart-contract audit firm; the reports are linked from the vault page.

1. Introduction

Enhanced is structured-product vault infrastructure capable of supporting many vault products. This document, however, focuses specifically on the PAXG Volatility Income Vault — the first vault deployed on top of the infrastructure and the reference implementation for everything that follows. The architecture, RFQ mechanics, settlement model, and access-control gates described below apply to every future vault built on Enhanced; PAXG-specific parameters — epoch length, protocol fee, the compounding-vs-income mode toggle — are called out where they appear.

Outside of stablecoins and the largest crypto assets, holders of onchain assets have few sustainable ways to earn yield. Lending markets depend on borrow demand that is structurally thin for most assets; automated market-making imposes impermanent loss that erodes the underlying; staking and emissions are inflationary and asset-specific.

In traditional finance, the most common way to make a held asset productive is to sell OTM options against it and harvest the asset's volatility as premium income. A treasury holding gold writes calls; an endowment holding equities writes covered calls; a wealth manager runs structured-note overlays. Volatility is monetized, principal is preserved, and the yield is sourced from a real counterparty — the option buyer — rather than from inflation or subsidy.

Enhanced implements that primitive on-chain, generalized to any asset for which a reliable price oracle exists and for which institutional market makers are willing to quote. The PAXG Volatility Income Vault packages it for depositors who want structured-yield exposure without operating the strategy themselves: the vault rolls fixed-duration epochs, writes options against pooled collateral, and distributes premium pro rata to depositors. The net effect for the depositor is AI-powered smart structured outcomes and payouts, in a single click.

Critically, Enhanced does not reinvent the option primitive itself. The margin system, the option-token standard (Otoken), and the settlement controller are built on the open-source Opyn Gamma Protocol, which has been the most reviewed, most audited, and longest-running options margin system on Ethereum. Enhanced inherits Gamma's battle-tested foundations and adds the surface area required for a structured-yield product.

The protocol is designed around five goals:

• Immutability. Each vault's economic parameters are fixed at creation and addressed by their hash; they cannot be mutated afterward.
• Risk isolation. Each option position is a separate, independently-collateralized margin vault; one position cannot draw on another's collateral.
• Full collateralization. Covered-call vaults post exactly one unit of the underlying per option written, eliminating liquidation risk for the depositor while remaining solvent by construction.
• Competitive, signed price discovery. Premium is set by an RFQ auction among whitelisted market makers, not by an internal valuation, and every economic term is cryptographically signed by its counterparty.
• Onchain settlement. Redemption and settlement payees are fixed by signed messages and on-chain checks.

Lessons from the First Generation

First-generation onchain options vaults (2021–2023) proved that demand for structured yield exists. They also exposed real failures:

• Opaque pricing via internal valuation rather than competitive auction.
• Asset coverage limited mainly to BTC, ETH, and other crypto assets - these vaults outgrew the thin altcoin markets — making flows too predictable and easy to hunt.
• Appetite was tightly coupled to the price action of those same assets.
• A narrative that couldn't compete with lending yield, staking yield, and restaking yield.

Enhanced improves on all four: competitive RFQ pricing among institutional makers, user-aligned strike design with an optional compounding mode to reepoch premium back into the underlying, superior asset selection focused on underserved assets where yield is genuinely scarce (including RWAs), and timing aligned with institutional capital moving onchain.

2. The PAXG Volatility Income Vault

The vault is the automated, depositor-facing layer of the protocol. A vault is defined by an immutable VaultParams struct — fields covering the underlying, collateral, and strike assets, epoch length, capacity, minimum deposit, and target-strike metadata — and created by the owner via createVault. The vault's identifier is the keccak256 hash of its parameter set, so any parameter change yields a different vault; an existing vault can never be re-parameterized.

2.1 Why Gold

Gold presents a compelling macro setup. A strong rally through 2024–2026 has lifted implied volatility (GVZ in the high 20s and even into the low 30s), while the asset's role as a structural inflation hedge tends to favor measured price action over extended timeframes. This is precisely the environment where covered-call income shines: elevated premiums paired with steady, range-bound behavior or controlled upward growth.

2.2 How It Works

The vault writes European-style covered call options on deposited PAXG at a low-delta 103–107% OTM strike on a biweekly (14-day) epoch. Institutional market makers compete via auction to buy these options, and the winning premium is credited to depositors upfront.

AI-powered strike and size selection. While the epoch duration is fixed at a biweekly cadence, the strike and option size are not statically dialed in. For each epoch the vault employs an AI-powered system that aggregates market insights, signals, and price action to find the most optimal strike price and size within the OTM band. The goal is simple: keep as much gold as possible in the strategy — maximizing the premium captured while minimizing the units settled away above the strike — which makes the vault materially more dynamic than fixed-strike TradFi alternatives. The depositor sees none of this complexity: it surfaces as AI-powered smart structured outcomes and payouts, in a single click.

At expiry:

• If the gold price remains below the strike, the option expires worthless. Depositors keep their gold and the full premium.
• If gold rises above the strike, settlement occurs via unit transfer — only the difference is settled. Depositors keep the large majority of their gold position. It is worth reiterating that even in this scenario, the total dollar value of deposits at the end of the epoch is still higher than at the start; what is "lost" is merely the upside beyond the strike (capped upside, not capital loss).

2.3 Compounding and Income Modes

Depositors choose how their epoch premium is delivered. The choice is a per-user setting on the vault and can be toggled at any time.

• Compounding mode (default). Premium earned in USDC is automatically swapped to PAXG as soon as received, and the resulting PAXG is added to the depositor's principal during the next epoch. The position auto-compounds without manual intervention: yield is converted back into the underlying and immediately re-deployed when the next epoch starts.
• Income mode (optional toggle). Premium earned in USDC is credited to a separate, depositor-controlled balance and is withdrawable at any time, including during an active options epoch. There are no locks, no queueing, and no waiting on epoch settlement to access the income stream. The depositor's PAXG principal continues writing options on the rolling schedule; only the premium leg accrues to a withdrawable balance.

Toggling between modes takes effect at the next epoch settlement. Switching from income to compounding does not retroactively sweep an existing income balance — already-accrued income remains withdrawable.

2.4 Target Audience

The vault is deliberately not positioned as a product designed to "outperform buy-and-hold gold." That framing sets the wrong benchmark. Systematic premium income is a different return profile, suited to different audiences with different investment objectives. The three personas below illustrate who it is built for.

• Persona A — The gold believer growing wealth. An institution or individual who holds gold as a long-term store of wealth and wants to grow that wealth predictably. Gold has rallied significantly over the past two years. What if it mean-reverts and ranges for the next two? What if prices drift slightly lower over the coming year? Systematic premium income provides a cushion in flat-to-down and ranging markets, while the vault's conservative out-of-the-money strategy retains the large majority of any upside. That combination makes it a strong contender as a predictable wealth-growth product for someone who already intends to hold gold through the cycle.
• Persona B — The holder who wants income without timing the exit. A user who already holds gold but is unsure when to take profit or sell to generate cash. Gold pays no dividend and produces no income on its own; realizing any return requires correctly timing a sale. By toggling on income mode, the USDC premium generated each epoch becomes withdrawable roughly every two weeks. The holder harnesses volatility to earn a recurring income stream — without ever having to time the sale of the underlying.
• Persona C — The patient compounder. An investor who wants gold exposure with a wealth-compounding mindset rather than a trading one. They don't expect gold to make dramatic moves every two weeks, so they value the peace of mind that comes from a steady premium stream cushioning any downside, while the conservative out-of-the-money strategy preserves the large majority of gold's upside. For this holder the appeal is the slow, systematic growth of their gold position — they are happy holding the majority of their gold exposure while income is being generated on top, premiums smoothing the ride and compounding quietly over time, without the need to watch the market or act on short-term volatility.

2.5 User Flow Diagram

A depositor makes a single deposit of PAXG into the vault and then chooses how epoch premium is delivered. From that one deposit, two distinct flows branch — compounding (default) and income (optional) — both driven by the same rolling options epoch and reconciled at settlement.

2.6 Comparison to TradFi Gold Covered-Call Products

The vault was reverse-engineered from every live gold covered-call ETF in traditional finance. The structural advantages of the onchain approach surface clearly side by side:

Product	AUM	Strike	Tenor	Expense Ratio	KYC	Yield	Upside Profile
GLDI	~$160M	103% OTM	Monthly	0.65%	Yes	~14%	Capped at ~3% per month
IAUI (NEOS)	~$470M	Dynamic OTM	Monthly	0.49%	Yes	~13%	Capped, varies month to month
ZWGD (BMO)	~C$33M	OTM spread	1–2 month	0.65%	Yes	~5%	Partially capped (partial overwrite)
IGLD (FT Vest)	~$525M	ATM	Annual	0.85%	Yes	~8.5%	Capped for the full year
GDXY (YieldMax)	~$250M	ATM (synthetic)	Weekly/monthly	~1.0%	Yes	~70% distribution rate*	Sells nearly all upside; yield-first, NAV erodes
Enhanced PAXG Vol Income Vault	N/A	103–107% OTM (dynamic)	Biweekly	0.5% mgmt fee (billed per epoch, ~2 wks)	No	4–14% (premiums only)	Most conservative — keeps majority of gold upside

* GDXY writes synthetic covered calls on GDX (gold miners) rather than gold bullion; its headline distribution rate is largely return of capital and comes with materially higher volatility and NAV erosion.

Key structural advantages: a materially lower management fee than TradFi with no embedded distribution layers; no KYC barrier and global permissionless access; 24/7 market operation versus exchange-hours-only in TradFi; a biweekly tenor for faster theta capture; and onchain settlement transparency on every fill, fee, and expiry. It is also the most conservative product in the peer set on upside: writing 103–107% OTM keeps the majority of gold appreciation for depositors, where peers cap returns at or near spot — and in the extreme case sell nearly all of the upside for headline yield.

2.7 A Note on Risk

This vault is not principal protected. If gold rises sharply through the strike during an epoch, depositors end the epoch holding fewer PAXG units than they started with. The dollar value of the position is typically still higher than at the start of the epoch — the premium plus gold appreciation up to the strike — so the practical effect is capped upside, not capital loss. But unit count can fluctuate.

2.8 Deposits and Withdrawals

Deposits and withdrawals do not take effect immediately. Both enqueue the user and settle at the next epoch boundary, so all participants in an epoch share its outcome pro rata. Each user has principal tracked in explicit states — pending, active, and claimable — and the vault emits a typed event on every transition. Premiums earned during an epoch are credited to the user's record at settlement and may be claimed independently of principal.

3. The RFQ Auction

Every option position in Enhanced originates from a request-for-quote auction. A market maker signs an EIP-712 Quote that fixes every economic term — asset, strike, expiry, price, quantity, direction, collateral, and an expiration on the quote itself. The taker — the vault, acting on behalf of its depositors — reviews quotes from competing makers, picks one, and countersigns a matching Confirmation bound to the maker's signature. A backend operator relays the matched pair to the on-chain execution gateway, which verifies the signatures, opens an isolated margin vault for the taker, mints and sells the option to the maker, and routes the premium back — all in a single atomic transaction.

Because every economic term is signed by the counterparty, the operator cannot front-run an order into a different price, quantity, or strike. Replay is prevented by single-use signed digests.

4. Architecture Overview

Enhanced is organized as two clean layers:

• The core layer implements the option primitive itself — the execution gateway (EnhancedOptions), the margin system inherited from Gamma (Controller, MarginCalculator, MarginPool), the option-token factory (OtokenFactory / Otoken), the oracle layer (Oracle, ManualPricer), and the access-control whitelist (Whitelist). This layer is asset-agnostic.
• The vault layer sits on top of the core. The EnhancedVault contract implements the depositor-facing strategy: epoch accounting, deposit/withdrawal queues, and premium distribution. A vault calls into the core to write options on behalf of its depositors.

The vault and the core share one execution path. Every covered call the vault writes on depositors' tokens hits the same execution gateway, is signed by the same EIP-712 typed-data schema, and is settled by the same oracle as any other option written through Enhanced. This is the meaning of "structured-product vault infrastructure": one primitive, shared security — and every future vault built on Enhanced inherits the same foundation.

The contract topology is summarized in a separate diagram. The periphery layer sits on top of an execution gateway; the gateway sits on top of a Gamma-derived margin core; and a small registry contract (AddressBook) lets every core contract resolve its peers at runtime, so upgrades and redeployments do not require rewiring.

5. Access Control

Enhanced layers a modular access-control system over the core, focused on who may participate. Vault creation is permissioned to the owner. The execution gateway maintains separate trusted-maker and trusted-taker sets plus a maker whitelist that pins each maker's redemption payee to a registered receiver. Together, these gates allow the protocol to run a permissioned institutional auction — named, vetted counterparties only — while leaving the option primitive permissionless in its mechanics. None of the gates can redirect a depositor's funds; they constrain who may participate, not where value flows.

6. Roles and Permissions

Enhanced uses a least-privilege role model. No single operational key can both move funds and rewrite accounting, and the most powerful actions are owner-gated and signature-bound.

Role	Capability
Owner	Creates vaults; sets operator, signer, margin pool, swap router, fee recipient; manages whitelists; authorizes upgrades. Held as an institutional-grade MPC.
Operator	Sequences epochs, relays signed orders, runs queue processing. Cannot alter economic terms or redirect payees.
Vault signer	Signs the order authorization for each vault trade. Separable from the operator key.
Manager	Sole authorized caller of the controller for settle/redeem; operators are permanently disabled in the controller.
Pricer / disputer	Submit and dispute oracle expiry prices within the locking and dispute windows.
Pausers	Engage system-partial (block all but redeem/settle) or system-full pauses.
User	Deposits, withdraws, claims premium; toggles between compounding and income modes.

Delegated actions are authorized by EIP-712 signatures rather than standing approvals: quotes, confirmations, asset transfers, custody releases, and vault-order authorizations all use single-use signed digests. Contracts are upgradeable via the standard UUPS pattern behind ERC-1967 proxies, gated to the owner. Notably, controller operators are permanently disabled by construction — the enable function can only be called while already disabled — so the manager remains the single settlement authority.

7. Fees

For the inaugural PAXG Volatility Income Vault, the protocol charges a 0.5% annualized fee on the vault's TVL, billed at the close of every epoch. The vault's epoch is two weeks, so an annualized 0.5% works out to approximately 0.01923% per epoch (0.5% ÷ ~26 epochs per year). The rate is fixed at vault creation and the accrual is transparent on-chain.

The vault charges no withdrawal fee: deposits, withdrawals, and claims move principal one-for-one outside of the per-epoch protocol-fee accrual. Future vaults may be configured with different fee schedules at creation, but the same principle applies — the fee rate is set immutably at vault creation and visible on-chain.

8. Market Makers and Counterparties

The integrity of an RFQ auction depends on the quality of its counterparties. Enhanced therefore operates a permissioned market-maker set: only named, vetted, top-tier institutional market makers are admitted to quote against the vault. Admission is by signed onboarding and gated by a 48-hour timelock (§9), and each market maker quotes under a unique signing key tied to its entry in the trustedMakers registry. Spoofing and impersonation are infeasible because every quote is signature-bound and every digest is single-use (§3).

In the early operating phases, training wheels are on: the active maker roster is intentionally small and conservatively vetted, with capacity caps per vault and tight participation controls. The roster will expand gradually as the protocol matures and as additional liquidity partners complete onboarding and risk review. Users may inquire about the current participating market-maker set through Enhanced Labs; the identities of admitted makers are not concealed.

Market makers participating in Enhanced auctions may be subjected to a maker fee, paid to the protocol on each filled quote. This fee is independent of the vault-level protocol fee described in §7.

9. Security

The core option primitive — margin, otokens, settlement — inherits years of audits, formal review, and live operation through the Opyn Gamma Protocol. Enhanced builds on that foundation rather than replacing it. As of 1 August 2026, the protocol has successfully completed an audit by Sherlock, a top-tier smart-contract audit firm; the new components (the execution gateway with signed RFQ, the vault layer, and the custody-limit primitives) were all in scope, and the reports are linked from the vault page. A public bug-bounty program is under consideration alongside launch, and early operation is bounded by phased capacity caps per vault.

Conservative design choices reduce the attack surface today:

• Disabled high-risk paths. OTC trading and flash-loan physical redemption — both available in some option-protocol designs — are intentionally turned off in Enhanced.
• Single settlement authority. Controller operators are permanently disabled, leaving the manager as the only settlement caller.
• Timelocked market-maker admission. Adding a market maker to the whitelist is subject to a mandatory 48-hour timelock: the owner schedules an addition, and the new maker can only be activated after the delay elapses. This gives depositors and observers advance, on-chain notice of any change to the counterparty set and a window to react before a new maker can quote.
• Reentrancy and upgrade safety. Fund-moving entrypoints are reentrancy-guarded; upgrades are UUPS and owner-gated.

Known risks and the mitigations applied:

Risk	Mitigation
Oracle manipulation	Per-pricer locking period, disputer override window, deviation-band guard; settlement blocked until all relevant prices are past dispute.
Signature replay	Single-use signed digests.
Market-maker counterparty risk	Auctions restricted to whitelisted makers; new makers admitted only through a 48-hour timelock; per-counterparty custody release capped in basis points; outstanding custody blocks redeem/settle.
Under-collateralization	Covered vaults require one unit of underlying per option; excess-collateral check re-verified after every action batch.
Underlying repricing (e.g. LST depeg)	Physically-settled call payout rate capped at one unit of underlying per option.
Operational error or abuse	Owner pause, operator emergency pause, system partial / full pause, phased capacity caps.
Capped upside (by design)	Inherent to covered calls; disclosed, not mitigated. Depositors retain premium and underlying up to the strike.

Acknowledgments

The margin and option-token architecture is built on the open-source Opyn Gamma Protocol, which has served as the gold standard for onchain options margin and settlement. The immutable, hash-addressed market design draws inspiration from the minimalist philosophy of other institutional-grade DeFi projects. We thank the institutional market-making partners contributing to auction liquidity and the reviewers of the contracts in progress.