What Backs Your Token

We just watched the market maker backfill the reserve behind Maya's trade. But that's the dealer's routine, not Maya's reassurance. Maya has a more basic question: she's holding eTSLA in her wallet - what makes it real? What stops it from being a number on a screen with nothing behind it?

The answer is the two-layer portfolio we sketched in Part 1. Now we can walk through it properly, because you've met all the pieces.

Layer 1: the Reserve Vault

Each asset has a Reserve Vault: a protocol-owned pool holding wrapper tokens - real tokenized stock from regulated issuers - as direct backing for that one asset. Tokenized TSLA sits behind eTSLA, tokenized SPY behind eSPY.

Three properties define it:

• It's protocol-owned, with no claims on it. No LP shares, no yield queues. Wrapper tokens flow in through maker backfills and PSM conversions, and flow out only through redemptions - and every exit is clamped so the remaining reserve still covers the tokens outstanding. Redeeming against the reserve takes nothing from anyone: the backing and the tokens it backs shrink together.
• It moves with the token it backs. The wrapper tracks the same stock the eToken tracks, so when Tesla rallies, the reserve's value rises dollar-for-dollar with the protocol's obligation. A fully reserved eToken carries zero net market risk - which is why it needs no overcollateralization at all. One dollar of reserve honestly backs one dollar of token.
• Its surplus pays holders. Many wrappers reinvest dividends, so a matched reserve slowly drifts above the exposure it backs. That surplus gets skimmed and paid out to eToken holders through a built-in dividend accumulator on the token - your eTSLA collects Tesla's income, not the protocol.

And the failure mode is priced in rather than wished away: if a wrapper depegs or its issuer fails, the reserve is marked down and the uncovered slice instantly reappears in the protocol's risk ledger - where the second layer is waiting for it.

Layer 2: the collateral vaults

The second layer is the pool Maya's trade rode on before the backfill: crypto collateral - USDC earning yield in Aave, staked ETH - deposited by Liquidity Providers into shared collateral vaults, one vault per collateral type, each run by a Vault Manager.

When an LP deposits, they receive vault shares - a claim on their slice of the pool. (This is the standard "tokenized vault" pattern, ERC-4626 if you want the label.) As the vault earns - native yield, lending interest, its cut of the flow - each share quietly becomes worth more. That's the LP's return, and Part 3 is entirely about where it comes from.

Two things about this layer are easy to miss and worth saying plainly:

• It insures; it doesn't get spent. Trader money never passes through these vaults - mints route USDC straight to the maker. The LP collateral just stands behind the system, at risk but untouched, which is exactly why the same capital can simultaneously back a lending market and keep earning its own yield.
• Exits take a beat. LPs withdraw through a request-and-wait queue (72 hours at launch), and an exit only clears if the remaining collateral still comfortably covers the system. Insurance can't run out the door at the exact moment it's needed.

One ledger ties the layers together

So how do two very different layers - per-asset reserves and pooled crypto - add up to one guarantee? Through a single running ledger the protocol maintains onchain, using the oracle marks from Chapter 5 (never trade prices):

   For each asset:   exposure  =  tokens outstanding × mark
                     reserve   =  wrapper tokens held × their mark

   NET EXPOSURE  =  sum over assets of:  max(0, exposure − reserve)

   THE RULE      :  net exposure  ≤  65% of LP collateral

Read it slowly, because this one picture is the whole solvency story:

• A fully reserved asset contributes zero to net exposure. The reserve cancels it dollar-for-dollar. That's the steady state the backfill loop keeps returning the system to - and it's why growth is cheap: a reserved eToken consumes no LP collateral at all.
• A freshly minted, not-yet-backfilled slice - or a depegged wrapper - shows up instantly as positive net exposure, and the rule forces it to be overcollateralized by the LP pool: at least $1.54 of crypto behind every $1 of uncovered exposure (that's the 65% cap read the other way).
• The max(0, ...) is deliberate: a surplus in one asset's reserve can never be counted as backing for a different asset. Every reserve backs its own token, full stop.

The rule is enforced on the same path that mints. When Maya's trade settled, the contract computed what net exposure would become and refused to proceed if it broke the cap. There is no window where a mint is approved but not counted.

Two more caps ride alongside: a per-asset ceiling (each asset has a maximum dollar issuance - $1M per asset at launch - and an asset with no ceiling set simply can't be minted, a fail-safe default), and a concentration cap that can limit how much of the counted collateral any single vault contributes, so no one collateral type quietly becomes the whole backing.

So, what backs Maya's eTSLA?

First, a protocol-owned reserve of real tokenized Tesla, matched 1:1 by value, passing its dividends through to her. Behind that, a pooled reserve of LP crypto that overcollateralizes anything the reserve doesn't cover - checked by a hard solvency rule on every mint, valued only at signed oracle marks, with a cushion that never dips below 35%. Her token isn't a promise floating free. It's a claim on a visible, layered, over-funded portfolio - and in the next chapter we'll see the doors that let her collect on that claim, no matter who else shows up to work.

What just happened

• Layer 1: each asset's Reserve Vault holds real wrapper tokens 1:1 behind the eToken - protocol-owned, moving dollar-for-dollar with the obligation, dividends skimmed to holders via the token's dividend accumulator.
• Layer 2: LPs deposit crypto into collateral vaults (earning vault shares) that insure whatever the reserves don't cover - at risk but never spent, with queued exits so insurance can't flee.
• One onchain ledger nets each asset's reserve against its exposure: net exposure must stay ≤ 65% of LP collateral, checked and committed on the same path that mints.
• Fully reserved tokens consume zero LP collateral; unbackfilled or depegged slices are instantly overcollateralized by the pool.
• Per-asset issuance ceilings (unset = unmintable) and collateral concentration caps bound the risk further - and no valuation ever comes from trade prices, only signed oracle marks.