Hexproof's Bond Protocol is a private credit infrastructure platform that enables lenders to issue unsecured loans (with recourse) to DeFi protocols, crypto-native companies, and off-chain businesses. The platform facilitates new points on the risk-return tradeoff curve for private credit by offering novel repayment schedules and return profiles for the loans and bonds issued on the protocol.

At its core, Bond Protocol is a fintech product with two faces. For lenders — primarily financial institutions — the platform provides an experience that is familiar and congruous with their existing credit workflows, ideally delivering attractive IRR and MOIC. For borrowers — protocols and companies seeking capital — the platform provides a flexible, programmatic, low-friction alternative to current private credit processes, ideally at a lower cost. The platform is flexible enough to facilitate the correct point on the risk-return curve for any particular borrower-lender pair.

The platform facilitates the complete loan/bond lifecycle: from discovery, to negotiation (of terms such as revenue commitment %, interest rate, cap structure), to initialization (lender-side funding), to signing (borrower-side acceptance and revenue integration), to locking/delay, to receipt token issuance, to the ongoing repayment loop, to principal recycling and proceeds withdrawal from escrow. Additional steps include KYC/compliance gating, default surveillance, and secondary market trading eligibility.

The Traditional Capital Stack — Background

To understand the platform's structural innovation, it helps to start with the traditional capital stack waterfall in a default or liquidation scenario:

1. Senior secured debt — first claim on assets; typically includes a negative pledge clause (covenant restricting the borrower from taking on additional debt that would dilute existing creditors' claims)
2. Senior unsecured debt — second priority; no collateral backing but contractual seniority
3. Subordinated / junior debt — lower priority; higher yield to compensate for increased risk
4. Other liabilities — trade payables, accrued obligations
5. Preferred equity — dividends to senior equity tranche
6. Common equity — residual claims; last in line

Hexproof's Bond Protocol introduces top-of-line repayments that sit above this entire waterfall. Revenue is diverted programmatically — via automated integrations and smart contract-level spending approvals — before the borrower's capital stack is even relevant. By the time a default or liquidation waterfall kicks in, lenders on the platform have already been partially (or fully) repaid through ongoing automated revenue diversion. This reframes the lender's position: rather than relying on waterfall priority in a distress scenario, the lender has already been extracting value from the top of the revenue stream continuously.

Why On-Chain Lending Infrastructure

Reduced Duration Risk — Automated repayment infrastructure — including options like top-of-waterfall diversion, programmatic cash flow routing, and high-frequency repayment schedules — enables faster capital recycling and principal amortization. This reduces duration risk by compressing the time lenders' capital is exposed, rather than relying on annual or biannual repayment cycles that are standard in traditional private credit.

Reduced Operational Overhead — A combination of automatic integrations and third-party service providers handle cash flow computation and reporting, minimizing (though not eliminating) manual back-office processes. Repayment routing, pro-rata distribution, and default monitoring all execute programmatically — reducing cost, human error, and the administrative friction that makes small-to-mid-size credit deals uneconomical in traditional markets.

Reduced Fraud Risk — Fraud risk is not eliminated, but the detection window collapses from quarters or years to days or hours. All fund movements — escrow funding, disbursement, repayment, and secondary trading — flow through monitored, integrated revenue channels. When fraud does occur, it manifests as a visible disruption: funds being forked or completely diverted away from the integrated and monitored revenue pipelines. In traditional credit markets, fraud like revenue misrepresentation can go undetected for extended periods (Wirecard concealed €1.9B for years). In Bond Protocol's system, any diversion from the monitored flow is immediately transparent and flagged.

Reduced Counterparty Risk — Automated integrations route cash flows in accordance with pre-agreed loan terms directly to escrow. The borrower authorizes the revenue integration at deal inception; from that point, repayment follows the agreed schedule without requiring borrower action or discretion.

Target-Rate Dynamic Caps (Optional Deal Term) — One option in the menu of potential deal terms: if the repayment schedule drags — revenue coming in slower than projected — the repayment cap can be dynamically raised (triggered by real-time monitoring) to increase the percentage of cash flow routed to escrow. This creates a self-correcting mechanism: underperforming deals automatically adjust to protect lender IRR rather than requiring manual renegotiation. Dynamic caps are one of several configurable deal parameters, not a platform-wide default.

Product Spectrum

The platform's architecture allows every deal to be structured at any point along two independent spectrums, creating a configurable product space that accommodates the needs of each specific borrower-lender pair.

Spectrum 1: Exposure (Deal Structure) — Ranges from pure debt to full revenue participation. Left-to-right represents increasing lender exposure to borrower performance:

Spectrum 2: Repayment Frequency — Ranges from real-time to traditional cadences. Left-to-right represents decreasing frequency, with current market standards on the right:

The platform's value proposition is opening the entire left side of both spectrums — repayment structures and frequencies that traditional private credit infrastructure cannot support. Every deal is a point on both axes simultaneously.

Transaction Types & Borrower Fit

Rather than segmenting borrowers by on-chain vs. off-chain, the platform supports multiple transaction types, each suited to different borrower profiles:

Debt vs. Preferred Equity — Structural Advantage

A key part of the platform's pitch to lenders is the structural superiority of debt over preferred equity:

• Covenant protection: Credit agreements allow covenants (leverage tests, debt incurrence tests, free cash flow tests) that prevent the borrower from layering on additional debt above the lender's position
• Anti-layering: Preferred stockholders have no ability to prevent the company from taking on senior debt above them. Debt holders do — even unsecured bonds typically include some form of incurrence test
• Programmatic claims: With on-chain infrastructure, the lender has a direct programmatic claim on cash flows as they come in — not just a contractual promise, but an automated enforcement mechanism

Lender Types

• On-chain: Credit facilities, liquid funds, stablecoin vaults, and any source of on-chain capital seeking novel yield
• Off-chain: Credit funds, family offices, institutional underwriters — onboarded via third-party custodians (e.g., Anchorage Digital, BitGo, Fidelity Digital Assets)

Capital Flow Diagram

The following illustrates how capital flows through the platform for both on-chain and off-chain participants:

                      LENDER SIDE                              BORROWER SIDE
               ┌─────────────────────┐                  ┌─────────────────────┐
               │  Off-chain Lender   │                  │  On-chain Borrower  │
               │  (credit fund,      │                  │  (DeFi protocol,    │
               │   family office)    │                  │   crypto company)   │
               └────────┬────────────┘                  └──────────┬──────────┘
                        │                                          ▲
                   via custodian                                   │
                   (onramp to chain)                               │
                        │                                          │
                        ▼                                          │
               ┌─────────────────────┐    loan proceeds   ┌───────┴───────────┐
               │  On-chain Lender    │ ─────────────────> │                   │
               │  (vault, credit     │                    │   ON-CHAIN        │
               │   facility, fund)   │                    │   ESCROW          │
               │                     │ <───────────────── │                   │
               │                     │   repayment flow   │                   │
               └─────────────────────┘                    └───────┬───────────┘
                                                                  │
                                                          loan proceeds
                                                          (optional: offramp
                                                           to off-chain)
                                                                  │
                                                                  ▼
                                                         ┌─────────────────────┐
                                                         │  Off-chain Borrower │
                                                         │  (data center,      │
                                                         │   energy farm)      │
                                                         └────────┬────────────┘
                                                                  │
                                                         cash flow routes back
                                                         on-chain via payment
                                                         integrations (Stripe,
                                                         Visa, Plaid, Paxos,
                                                         stablecoin rails)
                                                                  │
                                                                  ▼
                                                           back to escrow
                                                         → lender proceeds

Off-Chain Revenue Integration Strategy

For off-chain revenue sources, the platform's strategy is to integrate as far upstream in the borrower's revenue waterfall as possible by forming direct integrations with payment infrastructure providers: Stripe, Visa, Venmo, PayPal, banks, clearinghouses, Plaid, and others. The platform works with borrowers to facilitate integrations that route cash flows through stablecoins and payment chains — even if funds only touch on-chain rails briefly.

In the near term, the platform would partner with established financial infrastructure providers (e.g., Paxos, and similar large-scale payment and settlement providers) to leverage existing rails, compliance infrastructure, and connectivity out of the gate. Over time, the platform would build proprietary financial infrastructure to reduce dependency on third parties.

Borrowers (Protocols / Companies)

Requirements / Role:

• Revenue-generating protocols, crypto companies, or off-chain businesses seeking capital through loan/bond issuance
• Active revenue generation with integration capability for automated repayment routing
• For on-chain borrowers: smart contract spending approval or revenue address integration
• For off-chain borrowers: payment infrastructure integration (Stripe, Visa, Plaid, etc.) enabling cash flow routing through stablecoin/payment chain rails
• A defined percentage of revenue or cash flow dedicated to loan repayment per agreed terms
• Legal guarantor identification (required especially for DAOs or non-entity structures)
• KYC completion and entity/protocol documentation

Capabilities / Outputs:

• Issuer details and use of proceeds statement
• Revenue pipeline integration and verification (on-chain query, payment provider integration, or third-party service provider verification)
• Repayment routing mechanism verification
• Minimum revenue threshold (default trigger floor)
• Existing revenue obligations to other loans/bonds (seniority disclosure)

Lenders (Institutional & On-Chain Sources)

Requirements / Role:

• KYC-verified institutional Qualified Institutional Buyers (QIBs) — no natural persons in Phase I
• On-chain credit facilities, liquid funds, stablecoin vaults, and other on-chain capital sources seeking novel yield
• Wallet verification for allocation and trading wallets
• Proof of capital for bid/commitment submission

Capabilities / Outputs:

• Allocate funds to deals and submit bids during negotiation windows
• Hold receipt tokens and receive pro-rata repayment distributions
• Trade receipt tokens on the platform exchange (subject to assignment fee)
• Set notification preferences for deal types and borrower characteristics

Platform (Hexproof's Bond Protocol — Central Infrastructure Operator)

Requirements / Role:

• Owns and operates the issuance portal and secondary exchange
• Handles KYC verification, deal vetting, matching, and clearing
• Deploys and manages smart contracts for escrow logic, repayment routing, and token operations
• Coordinates with custodial partners for off-chain lender onboarding
• Enforces compliance and operational rules across the lifecycle

Capabilities / Outputs:

• Gatekeeping: KYC, compliance, verification
• Operations: issuance, matching, clearing, escrow management
• Market-making: liquidity provision, transfer enforcement
• Surveillance: real-time monitoring and enforcement triggers via automated integrations and third-party service providers

Protocol Developer / LabCo (Development Entity / Legal Guarantor)

Requirements / Role:

• The development entity or lab company associated with a protocol
• Provides legal guarantees and receives upstream funds
• Bridges decentralized protocol operations and traditional legal frameworks

Capabilities / Outputs:

• Legal backing for loan/bond obligations
• Upstream fund management to protocol treasury
• Critical role for DAO borrowers where no traditional legal entity exists

The lifecycle is structured as a linear flow with ongoing loops for repayment and principal recycling:

Discovery → Negotiation → Initialization (lender) → Signing (borrower) → Locking/Delay → Receipt Token Issuance → Repayment Loop (ongoing) → Principal Recycling / Proceeds Withdrawal (ongoing)

Step 1: Discovery

Borrowers and lenders are matched through the platform. In Phase I, this is a curated process — borrowers approach the platform directly or are selectively recruited, and lenders are hand-picked QIBs and on-chain capital sources. The platform facilitates introductions and provides deal structuring guidance to find the appropriate point on the risk-return curve for each pair.

Step 2: Negotiation

Borrower and lender negotiate economic terms off-chain. The platform provides tooling, modular contract templates, and structuring guidance, but the negotiation is between the parties. The platform's modular contract framework (see Cost Compression below) significantly reduces legal costs and negotiation friction.

Key Terms Negotiated:

• Revenue commitment % (portion of cash flow routed to repayment)
• Interest rate and/or OID (Original Issue Discount)
• Cap structure (fixed cap, dynamic cap, uncapped)
• Deal structure (where on the exposure spectrum — see Section 01)
• Repayment cadence (where on the frequency spectrum — see Section 01)
• Notional amount (total face value)
• Use of proceeds
• Maturity and amortization schedule
• Default trigger thresholds
• Legal guarantor identity and enforcement terms
• SPV structure (see Deal Structures below)

Deal Structures (SPV Models):

OID (Original Issue Discount) Structure: The primary pricing mechanism for Phase I. Loan at $0.90 on the dollar with no coupon — the "interest" is baked into the discount. The borrower repays par over time.

• Pitch to lender: Higher IRR from faster capital recycling. No coupon payment timing risk.
• Pitch to borrower: No interest rate risk. No floating coupon that can spike and trigger default. You can't default unless you violate the legal agreement — no rate-driven defaults.

Price Discovery (one mechanism among several): For deals using OID pricing, the platform supports sealed-bid price discovery — lenders bid a price below par they're willing to pay for face-value bonds. This is one pricing mechanism; direct negotiation, batch auctions, and other mechanisms are also supported depending on deal structure.

Step 3: Initialization (Lender Side)

Once terms are agreed, lenders commit capital. They have a funding window to transfer capital to escrow. Each deal has a unique escrow address (never reused).

Allocation Priority (for multi-lender deals) — Weighted priority system: bid level (primary), timestamp (secondary), and loyalty score (tertiary — historical deal volume and activity).

Step 4: Signing (Borrower Side)

The borrower formally accepts the deal terms and authorizes the revenue integration:

• For on-chain borrowers: grants spending approval (e.g., transferFrom rights) to the escrow/repayment contract on their revenue-collecting address
• For off-chain borrowers: completes payment infrastructure integration (Stripe, Visa, Plaid, etc.) enabling automated cash flow routing through stablecoin/payment chain rails
• Legal agreements executed
• Revenue integration verified via platform healthcheck

Step 5: Locking / Delay

Once both sides have committed — lender capital is in escrow and borrower has signed and authorized revenue integration — there is a lock-up/delay period. During this window:

• Platform performs final verification: revenue pipeline connectivity, KYC completeness, legal document review
• Escrow balances may begin earning yield (via tokenized Treasuries or institutional yield products)
• Neither party can unilaterally withdraw

Step 6: Receipt Token Issuance

Upon successful verification, an atomic operation executes:

• Receipt tokens are minted to lender wallets (representing their claim on future cash flows)
• Loan proceeds are released to the borrower (notional minus platform fees)
• Platform fees are deducted and routed to the platform treasury

                  Funding window
Lender Capital ────────────────────────> On-Chain Escrow
                                                │
                                         Revenue integration
                                         verified ✓
                                                │
                              ┌─────────────────┼──────────────────┐
                              │                 │                  │
                              ▼                 ▼                  ▼
                    ┌─────────────────┐ ┌───────────────┐ ┌───────────────┐
                    │ Borrower        │ │ Platform      │ │ Lender Wallets│
                    │ (proceeds       │ │ Treasury      │ │ (receipt      │
                    │  minus fees)    │ │ (tiered fee)  │ │  tokens       │
                    │                 │ │               │ │  minted)      │
                    └─────────────────┘ └───────────────┘ └───────────────┘

Fund Flow Summary:

Step 7: Repayment Loop (Ongoing)

Cash flows are routed in accordance with pre-agreed loan terms:

┌──────────────┐   automated integration   ┌──────────────────┐
│ Borrower     │ ────────────────────────> │ Repayment Logic  │
│ Revenue /    │   cash flows routed per   │ Smart Contract   │
│ Cash Flows   │   agreed terms            │                  │
└──────────────┘                           └────────┬─────────┘
                                                    │
                                       configured schedule
                                       (streaming/daily/weekly/monthly/etc.)
                                                    │
                                                    ▼
                                           ┌────────────────┐
                                           │ Escrow /       │
                                           │ Repayment      │
                                           │ Account        │
                                           └───────┬────────┘
                                                   │
                                  ┌────────────────┼────────────────┐
                                  │                │                │
                                  ▼                ▼                ▼
                         ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
                         │ Platform     │ │ Pro-rata     │ │ Real-time    │
                         │ Surveillance │ │ Distribution │ │ Monitoring   │
                         │ (confirm +   │ │ to Lender    │ │ (anomaly     │
                         │  reporting)  │ │ Proceeds     │ │  detection)  │
                         └──────────────┘ └──────────────┘ └──────────────┘

Cash flow computation and reporting are handled by a combination of automatic integrations and third-party service providers. The platform monitors repayment health in real-time and alerts for anomalies. Default detection is algorithmic.

The loan is fully satisfied when cumulative repayments equal the notional amount; excess funds return to the borrower. Receipt tokens are burned.

Step 8: Principal Recycling / Proceeds Withdrawal (Ongoing)

As repayments accumulate in escrow, lenders can withdraw their proceeds on a rolling basis. The platform supports both automated distribution (per the agreed schedule) and manual claim as a fallback. During idle time between revenue receipt and distribution, escrow balances may earn yield via tokenized Treasuries or institutional yield products.

Secondary Trading

Receipt tokens are eligible for secondary market trading post-issuance. Trading is restricted to KYC-verified participants only. All trades settle on-chain.

┌────────────────┐                    ┌────────────────┐
│ Lender (Seller)│   receipt tokens   │ Exchange Hub   │   receipt tokens  ┌────────────────┐
│                │ ─────────────────> │ (On-chain      │ ────────────────> │ Lender (Buyer) │
│                │                    │  Settlement)   │                   │ Acquires pos.  │
│                │ <───────────────── │ KYC-verified   │ <──────────────── │                │
│                │   proceeds         │ only           │   payment         │                │
└────────────────┘                    └────────────────┘                   └────────────────┘
                                             ▲
                                             │ enter market
                                      ┌──────────────┐
                                      │ New Lender   │
                                      │ (Secondary   │
                                      │  Market)     │
                                      └──────────────┘

The platform may restrict trading of defaulted or disputed bonds. For thin order books, consider a Pendle-style time-decay AMM rather than a traditional order book — this provides continuous liquidity with mathematically determined pricing based on time to maturity and implied yield.

Each deal produces a unique set of fungible receipt tokens representing the lender's claim on future cash flows. Tokens are fungible within a single deal only (not across deals) and are transferable only to KYC-verified wallets.

Token Properties

Token Architecture

Primary Issuance Layer — Compliance-controlled, tranche-partitioned issuance with KYC/AML hooks, transfer restrictions, and operator roles. Deployed via upgradeable proxy pattern for future compliance rule updates without redeployment.

Secondary Trading Layer — ERC-20-compatible wrappers for exchange compatibility and DeFi composability. Standard wallet compatibility.

Streaming Layer — Super Token wrappers (Superfluid-compatible) for continuous repayment flows when configured for streaming cadence. Enables per-second revenue diversion directly into repayment contracts.

Escrow Vault Standard

Escrow vaults follow the ERC-4626 tokenized vault standard for standardized deposit/withdrawal interfaces. This enables composability with existing DeFi infrastructure and simplifies the audit surface.

Repayment is the core mechanism that differentiates Hexproof's Bond Protocol from existing credit infrastructure. Rather than relying on borrower discipline to service debt, the platform uses automated integrations to route cash flows in accordance with pre-agreed loan terms directly to escrow — positioning lenders at the top of the borrower's revenue waterfall (see Section 01: Traditional Capital Stack).

Repayment Flow

1. Cash Flow Routing: Automated integrations pull or route the designated cash flows from the borrower's revenue stream. For on-chain borrowers, this is via smart contract spending approvals. For off-chain borrowers, this is via payment infrastructure integrations (Stripe, Visa, Plaid, etc.) routing through stablecoin/payment chain rails.
2. Repayment Logic: The repayment logic contract routes funds on the configured schedule (streaming, daily, weekly, monthly, etc.) to the escrow/repayment account.
3. Surveillance & Confirmation: Real-time monitoring tracks repayment health and flags anomalies. Cash flow computation and reporting are handled by a combination of automatic integrations and third-party service providers. Default detection is algorithmic.
4. Pro-rata Distribution: Pro-rata distributions flow to all verified receipt token holders' proceeds accounts. Distribution is proportional to token holdings at the time of each payment.
5. Loan Satisfaction: The loan is fully satisfied when cumulative repayments equal the notional amount. Excess funds return to the borrower. Receipt tokens are burned.

Dynamic Repayment Caps (Optional Deal Term)

For deals that include a dynamic cap provision, the repayment cap can be automatically adjusted when real-time monitoring detects that the repayment schedule is significantly behind projections.

Example Configuration:

• Trigger: Cumulative repayments >10% behind projected amortization schedule for 30+ consecutive days
• Action: Revenue commitment percentage increased by a pre-agreed step (e.g., 500bps / 5% increments)
• Constraints: Maximum cap defined per deal at inception (e.g., 50% of revenue); minimum 30-day cooldown between adjustments; borrower and lenders receive notification
• Reversal: If repayments return to ≤5% behind schedule for 60 consecutive days, cap reverts one step down

Revenue Integration by Borrower Type

On-chain borrowers — Smart contract spending approvals (e.g., transferFrom rights) against protocol revenue addresses. Revenue is verifiable directly on-chain via DefiLlama, Dune Analytics, or direct contract queries. Real-time monitoring provides continuous healthcheck.

Off-chain borrowers — Direct integrations with payment infrastructure providers, aiming to integrate as far upstream in the revenue waterfall as possible. Partnerships with Stripe, Visa, Venmo, PayPal, banks, clearinghouses, and Plaid enable automated cash flow routing through stablecoin and payment chain rails. In the near term, established financial infrastructure providers (e.g., Paxos) provide existing rails and compliance infrastructure; over time, proprietary infrastructure reduces third-party dependency.

Disbursement Mechanics

The design supports automated distribution with manual claim as fallback. During idle time between revenue receipt and disbursement, escrow balances may earn yield via tokenized Treasuries or institutional yield products (4-5% baseline). The escrow yield share represents an additional revenue stream for the platform.

An Event of Default occurs when either of the following conditions is met:

Payment Default — Revenue exists but no funds are received in the disbursement escrow for 2 consecutive payment periods.

Revenue Default — Revenue falls below the agreed minimum monthly threshold for 2 consecutive months.

Default Threshold Scaling

For streaming deals, the threshold is defined as a sustained revenue flow deficit rather than discrete missed payments. Real-time monitoring tracks the flow rate and triggers the default cascade when the deficit condition persists.

Enforcement Cascade

Upon default, the following enforcement sequence is triggered automatically:

1. Automated Detection: Real-time monitoring detects default condition. On-chain event emitted.
2. Notification: Borrower, lenders, and trustee receive notification. 7-day remediation window begins.
3. Remediation Window (7 days): Borrower may cure the default by bringing repayments current. If cured, DefaultCured(bondId) event emitted, normal operations resume.
4. Default Flagging: If uncured after 7 days, receipt tokens are flagged as "in default." Trading restrictions activated.
5. Dynamic Cap Escalation (if applicable): Revenue commitment percentage immediately raised to contractual maximum to maximize recovery.
6. Guarantor Enforcement: Guarantor enforcement triggers activate — contractual and legal remedies are pursued through the legal guarantor/LabCo entity.
7. Trading Restriction: Secondary market trading of defaulted receipt tokens paused. May be resumed for distressed debt trading after platform review.

Security Architecture

Audit Requirements:

• Minimum two independent audits from top-tier firms (recommended: Certora for formal verification + Trail of Bits or OpenZeppelin for manual review)
• Estimated security budget: $300K–$500K for initial audit cycle (based on 2026 market rates for mid-complexity DeFi protocols)
• Sherlock or Code4rena public security contest ($100K+ prize pool) post-audit
• Bug bounty program via Immunefi: $500K maximum bounty (scaling to $1M at $100M+ TVL)

Smart Contract Patterns:

• Proxy pattern: UUPS (EIP-1822) for upgradeability — OpenZeppelin recommended, ~100 gas overhead
• Access control: OpenZeppelin AccessControl with role-based permissions (ADMIN, OPERATOR, PAUSER, KEEPER)
• Reentrancy protection: OpenZeppelin ReentrancyGuard on all external-facing functions
• Circuit breakers: Automated pause triggers — authorized pausers can freeze escrow, trading, or minting within 1-2 blocks
• Timelock: Governance operations require timelocks — 1 day (routine) / 7 days (sensitive parameter changes)

Emergency Shutdown Module:

• Trigger: 3-of-5 multisig (platform operators + independent security council members)
• Effect: Halts all new issuances, pauses trading, freezes escrow disbursements
• Recovery: Orderly settlement — all escrow balances returned to last-known-good lender addresses proportionally
• Irreversible without governance vote to restart

Governance:

• Phase I: 3-of-5 multisig (Gnosis Safe) for admin operations
• Parameter changes (fee rates, supported stablecoins, KYC rules): 7-day timelock
• Emergency pause: any 1 of 3 authorized pausers (different security zones, per Aave V4 model)
• Phase II: Transition to on-chain governance (Governor Bravo pattern) with guardian cancellation authority

Escrow Architecture

Every deal has a unique escrow account (never reused). The platform deploys escrow logic contracts that issue instructions to the custodial partner. The platform never directly holds or controls funds.

Three-phase escrow lifecycle:

1. Funding phase: Collecting lender capital during the funding window
2. Disbursement phase: Releasing proceeds to borrower minus fees upon full funding + revenue integration healthcheck
3. Repayment phase: Collecting cash flow repayments and distributing pro-rata to receipt token holders

Order Book Architecture

Position Exchange — Platform-operated marketplace for receipt token trading. All tokens automatically listed post-issuance. Only KYC-verified participants may trade. All trades settle on-chain.

Liquidity mechanism: For thin order books, implement a Pendle-style time-decay AMM with yield curves (proven at $800M single-pool liquidity). This provides continuous pricing without requiring market makers.

Option Order Book — DEFERRED to Phase III. May trigger CFTC jurisdiction under Dodd-Frank Title VII. Revenue swaps may be classified as "swaps." Phase I excludes all derivative features to minimize regulatory surface area.

Offchain / Onchain Split

A deliberate architectural decision separates negotiation from settlement.

Offchain: Discovery, negotiation (OID/interest rate, notional, deal structure, terms), borrower signoff, legal signatures, KYC processing

Onchain: Escrow funding, receipt token issuance, repayment routing, pro-rata distributions, secondary market trades, default detection events

Settlement Infrastructure

• Chains (Phase I): Ethereum mainnet or Arbitrum (for lower gas costs). Single chain per deal.
• Cross-chain (Phase II+): Atomic cross-chain settlement for multi-chain receipt token transfers.
• Stablecoin Rails: USDC (Circle — OCC conditional approval Dec 2025, 46 state licenses) as primary. USDT as secondary.
• Stablecoin Compliance: All rails must use GENIUS Act-compliant issuers (enacted July 18, 2025): 1:1 reserve backing, interest payments on payment stablecoins prohibited, stablecoin holder priority in insolvency.

Streaming Infrastructure

Superfluid (TVL: ~$12M) — CFA (Constant Flow Agreement) primitives for per-second revenue diversion. Production-ready on Polygon, Arbitrum, Optimism, Base, Avalanche, and BNB Chain. No major exploits disclosed; active Sherlock audit program.

Sablier (TVL: ~$250M, 297K+ users, 552K+ streams) — Stream-as-NFT model. Lockup streams are immutable and predictable; Flow streams are dynamic and updatable. OVRFLO project demonstrates Sablier streams as yield bonds (beta). Stream NFTs are collateralizable.

Cost Compression Thesis

Traditional private credit deals cost ~$500K to close, forcing minimum deal sizes of $75M+. Hexproof's Bond Protocol targets ~$100K deal costs through:

• Modular contract framework: Standardized, templatized credit agreements reduce lawyer hours dramatically. If improving a term by 20% isn't worth the negotiation cost, don't negotiate it — get both parties thinking in terms of term upside net of negotiation cost
• AI-accelerated diligence: Financial diligence, document processing, and communication overhead that have historically been rate-limiting can be handled by AI, letting credit funds do more deals and smaller deals without more headcount
• Platform standardization: Having the platform's own capital arm anchoring deals gives leverage to standardize terms. Lead check sets the structure
• Programmatic servicing: Automated cash flow routing, monitoring, and reporting replace manual back-office processes

Net effect: The minimum reasonable deal size shrinks, opening entirely new market segments that were previously uneconomical to serve.

Revenue Model

Capital Retention Economics

Drawing from platform economics principles — the goal is to keep capital sticky on the platform:

• Cheap / free ingress: Make it as easy and cheap as possible to get money in. Potentially subsidize onboarding
• Expensive egress: Make withdrawal slow, costly, or friction-heavy. Tax money leaving the platform
• Light internal tax: Minimal fee on capital flowing between deals within the platform
• Capital recycling: When a lender's deal repays, immediately offer the ability to roll into the next deal. Reduce friction to keep capital playing
• Don't charge on internal profits: Charge only when money leaves or when someone realizes a profit and withdraws

Market Pricing Benchmarks

Current market pricing for comparable lending segments (from investor / market participant conversations):

Borrower internal IRRs range from 15-80%+ depending on operation. If a borrower is running at 80%+ IRR and can borrow at 20%, they'll take that trade all day.

OID Pricing

Bonds/loans are priced via Original Issue Discount — the loan is issued at $0.90 on the dollar with no coupon. The "interest" is baked into the discount. The borrower repays par over time. This structure eliminates interest rate risk for the borrower (no floating coupon that can spike and trigger default) and provides higher IRR for the lender from faster capital recycling.

IRR Sensitivity Table

Lender IRR based on bond size (as % of annual revenue) and revenue commitment percentage. Assumes 0% coupon, 85 OID.

Deal Sizing Example

A protocol with $60M/year revenue and a 5% revenue commitment generates $3M/year in repayment capacity. At conservative 40% LTV of $240M (4× revenue) = $96M total bond capacity. This can be structured as $6M series, each with approximately 2-year payback.

Tax Treatment

The IRS typically treats revenue-based financing as "contingent payment debt instruments" under the Non-Contingent Bond Method (NCBM). Borrower payments are generally deductible as interest if classified as debt; non-deductible dividends if reclassified as equity. Lenders face potential "phantom income" — tax liability in early years exceeding actual cash received.

Addressable Borrower Universe

Phase I target borrowers: data center operators (new equipment, H100 GPUs), frontier AI/tech companies, survivors of the AI consolidation wave, and DeFi protocols with stable recurring revenues (Aave: $122M fees Q2 2025, Uniswap, Lido: $27.5B TVL, Hyperliquid: $1B+, Jupiter: $1.1B). More volatile protocols (Meteora, Pump.fun) suit Phase II+ revenue-swap structures. The off-chain addressable market (global private credit: ~$2T AUM) is a massive expansion opportunity.

Securities Classification

Hexproof's Bond Protocol receipt tokens constitute investment contracts under Howey. The platform operates within recognized exemptions.

Money Transmitter Risk — Resolved

Hexproof's Bond Protocol routes all escrow funds through a custodial partner with an appropriate banking charter (e.g., OCC-chartered federal bank). The custodian's banking charter covers money transmission. The platform operates as a technology provider / marketplace operator and never directly holds or controls funds.

Why not alternatives:

• Non-custodial smart contract escrow: FinCEN has explicitly rejected this defense for platforms with identifiable administrators. Paxful penalized $3.5M (Dec 2025).
• Full MSB registration: 47+ state licenses, $500K-2M+ compliance cost, 12-18 month timeline. Unnecessary given custodial pass-through path.

Derivatives & Broker-Dealer

Option order book: DEFERRED to Phase III. Revenue swaps may be classified as "swaps" under Dodd-Frank Title VII, triggering CFTC jurisdiction. Phase I excludes all derivative features.

ATS registration: Required for operating a secondary market for tokenized securities. Options: (a) Register as ATS (6-12 months, ~$500K+ annual compliance), or (b) Partner with an existing ATS operator (e.g., tZERO, Securitize Markets) to list receipt tokens on their existing infrastructure.

Capital Stack & Custodial Partners

Anchorage Digital — OCC-chartered federal bank (Jan 2021, consent order lifted Aug 2025). Atlas settlement network (~600 participants, tens of billions processed). Acquired Securitize For Advisors ($4B+ tokenized AUM). $4.2B valuation.

BitGo — OCC national trust bank (conditional approval Dec 2025). $90B+ AUC. NYSE IPO completed Jan 2026 ($18/share, $2.08B valuation, 24.6% first-day pop). Zero hacking losses in 10+ years.

Fidelity Digital Assets — OCC national trust charter (converted Dec 2025). Backed by $4T+ AUM parent. Launched FIDD stablecoin. Advocating for explicit ATS standards for tokenized securities (March 2026).

Stablecoin & On-Ramp Compliance

Primary settlement: Circle USDC (OCC conditional bank charter Dec 2025, 46 state licenses, MiCA compliant, Chainlink Proof of Reserve on Avalanche for real-time verification). Secondary: Paxos USDP. All integrations must use GENIUS Act-compliant issuers: 1:1 reserve backing required, interest payments on payment stablecoins prohibited, stablecoin holders have priority in insolvency.

The platform follows a three-phase strategic arc, each phase building on the last and unlocking a higher valuation multiple:

Phase 1: Origination

Connect borrowers with established lenders through SPV structures. The technology handles onboarding, document management, deal facilitation, and servicing. An initial tokenization/lender onboarding partner (e.g., Securitize or similar) handles the token infrastructure.

North star: Successful repayments, not revenue. Reputation and trust are everything at this stage.

Lenders: Only Qualified Institutional Buyers (QIBs) and on-chain credit facilities. No natural persons. Already seeing inbound interest from established lenders — investors line up if there's a good opportunity.

Borrowers: Data center operators (new equipment, H100 GPUs), frontier AI/tech companies, survivors of the AI consolidation. Blue-chip DeFi protocols with natively verifiable revenue. Founders known to the team.

Structure: 0% interest amortizing bonds, issued at OID. Minimum amortization + cash flow sweep. 10-year maturity. Revenue swap product for borrowers who want equity-like upside without dilution.

Revenue: Platform fee charged to the lender. Borrower costs kept deliberately low.

Marketing: No public marketing — hand-picked lenders. Borrowers approach directly or selectively recruited.

Custody: Partner with established custodians for off-chain lender onboarding.

Chain: Ethereum mainnet or Arbitrum.

Phase 2: Credit Exchange

Build a secondary market for credit instruments originated on the platform. The current OTC process for trading private credit is absurdly manual: call your banker, they call contacts without naming names, sign NDAs, exchange docs one at a time.

• Valuation multiple advantage: Exchange businesses trade at 30-35x earnings. Asset management trades at 5-10x. The long-run target is clearly the exchange model
• Historical precedent: During the LBO/Milken era of the 1980s, high-yield bonds were highly liquid. That liquidity dried up post-crisis. Proof that these instruments can be made liquid with the right market structure
• Expand lender base: Reg D 506(c) — general solicitation with verified accreditation
• Deepen payment integrations: Broader provider coverage, proprietary routing infrastructure
• Proprietary ATS for secondary trading (or ATS registration / partnership)
• Cross-chain settlement for multi-chain receipt token transfers
• Revenue royalty and RBF deal structures added to product spectrum

Phase 3: Data & Pricing Authority

Network effects from deal flow compound into proprietary data: pricing benchmarks, deal structures, payment schedules, creditworthiness patterns. Over time, this becomes a pricing oracle for the market.

• Analog: Optum Health. Started as a pricing registry (pulling equipment/service price lists from hospitals). Eventually became the price-setter. Became so embedded that you can't do deals without it. Think "Bloomberg terminal for private credit." Optum was later acquired by UnitedHealth.
• The data moat builds from back-and-forth on deals: structures, documents, payment schedules, what works, what doesn't. This compounds into better instrument design, better pricing, and better integration with borrowers
• Reg A+ for non-accredited access opens the broadest possible investor base
• Full product spectrum: Option order book (with CFTC counsel), bond pooling / tranching, total return swaps, perpetual bond instruments
• Decentralized governance transition as appropriate

Market Timing — Why Now

• Equity drought: Appetite for equity fundraising is down. VCs sitting on hands, doubling down on existing winners. For everything else, dry mouths. This improves demand for debt/alternative funding
• Distressed asset window: If AI demand collapses or markets crash, generational distressed asset opportunities could emerge in 6-10 months. The platform can fund acquirers of those assets and help consolidate or repurpose using AI
• Private credit liquidity crisis: Fund-level gating is happening in slow motion. Forced sellers hold performing loans but can't exit because their fund is underwater. These assets could trade on the platform at a discount (e.g., $0.80 on the dollar): the borrower gets credit enhancement, the buyer gets a better asset, the seller gets it off their books

Competitive Context

First-mover dynamics: Move fast, set the standard, build the data moat before others show up. Window is narrow.

MVP Milestone Tracker

• ✓KYC + Wallet Verification
• ✓Bond Request Order Model
• ✓Bid Engine + Clearing Logic
• ✓Escrow + Tokenization Smart Contracts
• ○Repayment Routing Infrastructure (on-chain + payment provider integrations)
• ○Secondary Trading Venue (ATS partnership)
• ○Real-time Monitoring Integration (revenue healthcheck + default detection)
• ○Security Audit Cycle (formal verification + manual review + bug bounty)
• ○Trustee Enforcement Framework
• ○Default/Dispute Protocols

Resolved in This Version

Remaining Open Questions

Architecture:

• Cross-chain settlement for Phase II — Needs evaluation for receipt token bridging across chains
• Payment processor ToS — Legal review needed for Stripe/Square/Visa terms regarding cash flow routing to on-chain escrow
• Payment infrastructure partnerships — Which providers (Paxos, etc.) to partner with for initial off-chain borrower rails

Credit & Underwriting:

• Underwriting model — Phase I uses team-vetted borrowers (human judgment). Phase II needs a scalable model: Maple's pool delegate pattern, algorithmic scoring, or hybrid?
▲ Open Item
Underwriting — The Core Risk
Phase I uses team-vetted borrowers (human judgment) — appropriate for early stage. But scaling requires a model. Maple's pool delegates have a track record. Goldfinch's community auditors + backers model failed ($18M in defaults). Credora provides DeFi credit assessment but is unproven at institutional scale. The underwriting model decision will define Phase II's risk profile. DeFi protocol design and credit risk assessment are fundamentally different skills — does the team have credit underwriting experience? — Critique §VII (Question 10); Background Research §I
• Internal credit ratings — Build in-house or partner with Credora (DeFi credit assessment)?
• Seniority rules — How do multiple bonds from the same borrower interact? Pari passu or waterfall?

Legal Structure:

• Entity wrapper — SPV per deal, master trust, or series LLC?
• Trustee structure — Who serves as trustee? What enforcement powers?
• Legal guarantor enforcement — Jurisdiction, mechanisms, and effectiveness for DAO borrowers

Product Design:

• Callable debt — Should borrowers have early repayment options? Impact on IRR?
• Debt buyback — Can protocols repurchase bonds on secondary market?
• Bond pooling — Phase III tranching: senior/junior structure with first-loss capital?
• Collateralization — Optional governance token lockup as additional credit enhancement?

Economic Design:

• Escrow yield risk management — How aggressively to deploy idle capital? (Conservative: Treasuries only. Aggressive: money market protocols.)
• Insurance integration — Nexus Mutual for smart contract risk? First-loss tranche structure for credit risk?
◆ Research
Insurance & Risk Tranching
Nexus Mutual: $190M capital pool, coverage cost <1% APY. Covers smart contract risk. For credit risk: traditional bond insurance uses senior/junior tranching where junior tranches absorb first losses. Goldfinch's backer model (first-loss structure) remains structurally sound despite their defaults. NAIC Principles-based Bond Project (effective Jan 2025) provides regulatory framework. Market projection: $5-8B insurance TVL by late 2026. Consider: Nexus Mutual for smart contract risk + first-loss tranche structure for credit risk. — Background Research §VII
• Capital retention optimization — Exact ingress/egress fee structure and internal recycling incentives
• Platform capital arm — Should the platform anchor deals with its own capital to set terms and build deal flow?

Business Development:

• Tokenization partner — Securitize or similar for Phase 1 token infrastructure?
• First deal pipeline — Which data center operators / AI companies are in active conversations?
• Lender pipeline — Which institutional lenders have expressed inbound interest?