Deposit Guard

One modifier that refuses an allocation when the horizon is shorter than the lock it would sit through.

Argued in full in the whitepaper at §11, surfaces 2, 6, 7.

The guard#

Vault.sol

import { ICleatonRegistry } from "cleaton/ICleatonRegistry.sol";

contract Vault {
    ICleatonRegistry constant REGISTRY = ICleatonRegistry(0x...);

    uint16 constant MIN_CONFIDENCE = 6000; // 0.60
    uint32 constant LOCK_DAYS      = 14;

    modifier durable(address pool) {
        (uint32 horizon, uint16 conf, uint8 flags) = REGISTRY.attestationOf(pool);

        // Compare against YOUR lock, not a generic threshold.
        require(horizon >= LOCK_DAYS,      "horizon shorter than lock");
        require(conf    >= MIN_CONFIDENCE, "confidence below policy");
        require(flags & OUT_OF_SUPPORT == 0, "no calibration precedent");
        _;
    }

    function allocate(address pool, uint256 amount) external durable(pool) {
        _deposit(pool, amount);
    }
}

A worked case from the paper: a vault on a fourteen-day rebalance cycle choosing between two stablecoin pools with near-identical advertised APY, one paying 340 basis points more. Pool A returns 62 days at 0.81. Pool B returns 6 days at 0.74 — its campaign expires in eight days and its downward elasticity is 3.1. The guard rejects B, and the durability-adjusted yield confirms why: the expected slippage on a forced exit into a thinning book exceeds the eight days of excess yield it would collect.

Horizon-scaled LTV#

A lending market taking LP positions as collateral at a uniform ratio discovers the difference at the worst possible moment — when the campaign ends, depth collapses, and the liquidation executes into a book that no longer exists.

Position	Horizon	Uniform LTV	Horizon-scaled (H_ref 90, ψ 1.5)
$10M LP	120 days	65%	65%
$10M LP	5 days	65%	≈ 0.85% — effectively rejected

The second position was never really 65% collateralised. The market simply had no way to observe that.

The exposure ceiling#

A consuming contract is expected to read bondOf(attester) and gatedExposure(attester) and reject an attestation where its own position would push gated exposure above the bond-implied ceiling.

Measuring an absence#

When the guard works, nothing happens. The vault never takes the loss, so nothing appears in its performance record — the value is realised as absence and is chronically underestimated by the people it protects.

Cleaton publishes counterfactual outcomes for pools the guard rejected, so the avoided loss is visible somewhere even though it is invisible in any individual book.