The hedge book

Every backed coin's pool is margin on a real market. The hedge book is that, added up — the account all the pairings amount to, stated the way an exchange states one — and, underneath it, who actually holds the positions and what the chain can prove about them.

It is public, at /hedge.

Where the hedge lives, in plain words

The positions are held on edgeX, an order-book perpetuals exchange. Its accounts live on edgeX's own chain, not on Arc, and a smart contract cannot own one. So a tracker's vault cannot hold its own position. Instead:

• the protocol runs a hedge wallet — an ordinary wallet, not a contract — that is an edgeX user;
• each tracker gets its own edgeX account under that wallet, so one tracker's losses never touch another's;
• the vault stores the wallet's address as its hedgeFunder, and that is the only address the vault can ever send hedge money to.

That is the honest shape of it: the dollars behind a bonded coin leave Arc, sit in an exchange account, and are controlled by a wallet key the protocol holds. The rest of this page is what bounds that, and what you still have to trust.

How the money moves

   vault ──fundHedge──▶ hedge wallet ──deposit──▶ EdgexBridge ──▶ tracker's edgeX account
     ▲                  (one hop, same pass)        (on Arc)                 │
     └───────────── withdrawal, recipient = the vault, paid by EdgexBridge ─┘

• Out. LTVault.fundHedge(amount) sends USDC to the hedge wallet and nowhere else. It is capped on chain at fundableUsdc() — the vault's idle USDC above its redemption floor, protocol fees excluded — it refuses before the tracker has bonded, and it refuses while the vault is paused. Only the vault owner or the hedge wallet itself can call it, and neither chooses the destination.
• One hop. The keeper deposits exactly that amount into the tracker's edgeX account in the same pass: it asks edgeX for the deposit instructions, checks they are a plain deposit(USDC, amount) on edgeX's bridge on Arc (EdgexBridge, 0x61A7EBc69A34e72005a195B42b5d5577C20032aD) for that exact amount, approves exactly that amount, and sends it. Instructions that do not check out are refused and the dollars go straight back to the vault. edgeX's minimum deposit is 10 USDC; smaller amounts simply wait in the vault.
• Back. To return money, the keeper first shrinks the position so the equity left keeps the stated multiple, then asks edgeX for a withdrawal whose recipient is the vault. edgeX's bridge pays the vault directly on Arc, about a minute later (withdrawals above 500,000 USDC in an hour wait a further 24 hours). The hedge wallet never holds the returning dollars. edgeX's minimum withdrawal is 2 USDC, and it charges a small fee per withdrawal.
• Nothing counted twice, nothing lost. While a leg is open, the dollars are in none of the obvious places — not in the vault, not yet in the account. The keeper books every leg per tracker (sent to the wallet, deposited but not yet credited, withdrawn but not yet paid), keeps those books on disk across restarts, and counts each dollar exactly once in NAV. A withdrawal is only marked paid when a matching USDC transfer from edgeX lands in the vault.

The keys

The hedge wallet key has to be online on the keeper's machine, because deposits and recalls happen automatically, around the clock. It is a separate wallet from the protocol owner's.

The switches

• Kill switch. The vault owner calls setHedgeFunder(address(0)): from that block, fundHedge reverts for everyone. No further dollar can leave that vault for the venue.
• Pause. setPaused(true) stops fundHedge too, along with minting and redeeming.
• Rotation. A new hedge wallet is: withdraw the edgeX balance to the vault with the old key, then setHedgeFunder(new wallet).

Neither switch can reach money that is already on edgeX. There is no on-chain request a vault can send to edgeX, and edgeX offers no forced withdrawal: dollars on the venue come back only through the hedge wallet's key.

What you are trusting

• The hedge wallet key. The keeper's code only ever withdraws to the vault. A thief holding the key would not be bound by that code: the recipient of a withdrawal is a field the key signs, and nothing on edgeX is known to force it back to the vault (whether edgeX offers a withdrawal-address allowlist is not confirmed yet). The same key can also call fundHedge, so until the owner pulls the kill switch, a stolen key reaches everything on the tracker's edgeX account and the vault's fundable USDC. The key lives on the keeper machine only, and is a wallet of its own, never the owner key (the deployment script warns if the two are the same).
• edgeX's custody. Deposits sit with edgeX. Its bridge on Arc belongs to a 3-of-5 multisig that can pause it, upgrade it and move its funds, and edgeX V2 has no escape hatch — no way for an account holder to force a withdrawal through a contract if the venue stops answering.
• The keeper. It trades the accounts and signs NAV. A keeper that stops rebalancing, or trades badly, costs the trackers; the order-only key cannot move money out of an account, but it can lose it in the market.

Some edgeX details are still being confirmed with edgeX before any money moves — how many accounts one wallet may hold, which keys may sign withdrawals, the exact permissions of the order-only key. Where this page states them, it states what edgeX's public API and SDK show today.

One position per tracker, not per coin

A tracker carries a single position in its one edgeX account, on one market. Every coin bonded onto NVDAx5 puts its backing behind the same Nvidia exposure, so the book sums their backing before it computes anything:

margin(u)   = sum of the backing of every coin on tracker u
size(u)     = margin(u) · leverage / entry
notional(u) = size(u) · mark
PnL(u)      = size(u) · (mark − entry) · (+1 long, −1 short)

Each row opens to show which coins are behind it and what share of the position each one owns — split pro rata on backing, because a pooled position carrying one averaged entry has no other honest way to attribute itself.

This table is the position the coins' backing amounts to — what the hedge wallet is meant to carry — computed from the chain and marked at edgeX's price. It is not a read of the edgeX accounts, which are not public.

What each column means

Below the positions, a second table lists every tracker's hedge wallet, what its vault could send right now, and every HedgeFunded payment it has made, each linked on Arc's explorer.

The account behind each row

Each tracker's edgeX account is cross-margined: one USDC balance backs the position, and leverage is simply notional divided by equity. Keeping the multiple is therefore a matter of trading the difference — when the position gains, the keeper buys a little more; when it loses, it sells a little down with a reduce-only order — rather than closing and reopening anything.

The keeper never sizes past 90% of the leverage edgeX allows for the position's risk tier, nor past the market's maximum position size. It only sends immediate-or-cancel limit orders, priced off edgeX's oracle within 0.5%; while the underlying stock market is closed it clamps them into the price band edgeX allows, and an order that does not fill is tried again on the next pass.

Liquidation

edgeX liquidates an account when its equity falls below its maintenance margin: the position's notional times the market's maintenance margin rate m (2.5% on its 20× markets, 5% on its 10× markets, 1.67% on silver and WTI, 1% on gold, for a position in the first risk tier). With E the entry and L the leverage, a single position reaches that point at:

long    P_liq = E · (1 − 1/L) / (1 − m)
short   P_liq = E · (1 + 1/L) / (1 + m)

The size cancels out entirely, which is why a leg's liquidation depends only on its entry, its leverage and its market — and why adding backing at a new mark moves it, through the averaged entry.

These are moves from entry before funding and fees, for a position nobody rebalances. The keeper de-levers long before that point. edgeX's own liquidation price for an account is the authoritative one.

Why the account leverage is not exactly the stated multiple

Notional is divided by equity, and equity moves with unrealised PnL. A book losing money carries more leverage than it opened with, and the number goes up — which is precisely the thing worth seeing. A book showing a flat 5× through a drawdown would be hiding it.

Checking it yourself

What the chain proves — every dollar that left for the venue and every dollar that came back:

LTFactory.venueRouting(lt)     → (marketId, trader)   // edgeX contract id; trader = the hedge wallet
LTVault.hedgeFunder()          → the only address fundHedge can pay; 0x0 = cut off
LTVault.fundableUsdc()         → what the vault could send it right now
LTVault.bonded()               → false: NAV pinned at 1.0, nothing can leave for the venue
LTVault.paused()               → true: nothing leaves, nothing mints or redeems
HedgeFunded(to, amount)        → emitted by the vault for every dollar sent to the hedge wallet
NAVOracle.hedgeEquityUsd()     → the account equity the keeper signed with the last NAV

Dollars coming back arrive as ordinary USDC transfers into the vault from edgeX's bridge. On Arc every USDC movement is logged twice — by the USDC contract at 0x3600…0000 (6 decimals) and by a system address (18 decimals) — so count only the first.

The venue side is public for markets, not for accounts. edgeX's public API gives any market's prices and funding with no key — for Nvidia, https://edgex-prod-v2.edgex.exchange/api/v2/public/quote/getTicker?contractId=30000020, and …/getMarketStatus?contractId=30000020 for whether the underlying is open and the band limit orders must respect. An account's balances and positions are only readable with that account's credentials; until edgeX offers a public view, the venue side of each tracker rests on the keeper's signed equity and on the withdrawals that land back in the vault.

Live, and honestly so

Marks are edgeX's oracle price, refreshed about every 15 seconds, so the book moves as the market moves. The positions themselves — margin, size, entry — are re-read from the chain, because they only change when someone trades a coin. Funding is settled on edgeX every 4 hours and shows up in each account's equity, not in the table.

edgeX lists its stock, index and commodity markets around the clock, so the book keeps marking through nights and weekends — but while an underlying stock market is closed, the venue's mark can only drift within a band, and orders are restricted to it. A market the venue halts cannot be resized until it resumes. When a market the venue cannot quote appears, its leg says so and is left out of the totals rather than counted as flat. An unknown price is not a zero.