On-chain Options Protocols

You already know what an option is: the right (not the obligation) to buy (call) or sell (put) an underlying at a fixed strike, for which the buyer pays a premium, and whose value is governed by the Greeks. You know how an AMM swaps two tokens along a curve. This lesson is about the collision of those two worlds — what happens when you try to encode an option as a smart contract and let a blockchain, rather than a clearinghouse, enforce it.

Spoiler: the math is the easy part. The hard part is that a blockchain is a deterministic machine that can’t look up a price, doesn’t trust anyone, and charges you rent (gas) for every multiplication. An options protocol has to manufacture, on-chain, the three things a TradFi desk takes for granted: a price feed, a volatility input, and a counterparty who won’t run.

From option contract to smart contract

In TradFi, an option is a legal contract standardized by an exchange and guaranteed by a clearinghouse — a central counterparty that steps between buyer and seller, collects margin, and makes you whole if the other side defaults. The clearinghouse is the trust layer.

On-chain, there is no clearinghouse. There’s just code. So a DeFi options protocol turns each option into a token — typically an ERC-20 (the fungible token standard on Ethereum, the same standard a stablecoin or a governance token uses). The original design, popularized by Opyn, called these oTokens: one ERC-20 per unique option series (one underlying + one strike + one expiry + call/put). Holding the token is holding the option; transferring it transfers the position; there’s no DTCC entry, just a balance in your wallet.

The lifecycle has three actors, all enforced by the contract:

1. The writer (seller) deposits collateral into the contract and, in exchange, the contract mints oTokens to them. The writer now has a short option position plus a pile of locked collateral.
2. The buyer acquires the oToken (buys it on an AMM or order book) by paying premium. They now hold a long option.
3. At expiry, the contract reads the settlement price from an oracle (an on-chain price feed — more on its peril later) and computes the payout deterministically. The buyer redeems their oToken for any intrinsic value; the writer reclaims whatever collateral is left.

No human signs off. No clearinghouse calls anyone. The collateral was locked up front precisely because nobody can be chased afterward.

Worked example: minting a covered call

A covered call is the canonical safe write: you own the underlying and sell a call against it, collecting premium in exchange for capping your upside. It’s “covered” because if the call is exercised, you simply hand over the coins you already own — no scramble.

Say ETH spot is $3,000. You hold 1 ETH and want yield on it. You mint a 1-month, $3,500-strike covered call:

Your 1 ETH was locked the entire month. You couldn’t lend it, stake it, or use it elsewhere. That idle capital is the whole story of the next section.

Full collateralization and the capital-inefficiency tax

Here is the rule that defines first-generation DeFi options: they are fully collateralized. Every dollar the option could ever pay out is pre-funded and frozen in the contract.

• Write a call → lock the full underlying (1 ETH per ETH-call), because if it’s exercised you must deliver, and a call’s payoff is unbounded above.
• Write a put → lock the full strike in stablecoins ($3,500 per $3,500 put on 1 ETH), because the worst case is the underlying going to zero and you owing the entire strike.

Compare that to TradFi. There, a market maker runs on portfolio margin (SPAN, the CME’s “Standard Portfolio Analysis of Risk”): the broker stress-tests your whole book across price and vol shocks, lets winning and losing positions net against each other, and requires only enough margin to cover the worst plausible scenario — often a few percent of notional. A desk can be short a thousand options backed by a sliver of capital, because the clearinghouse trusts (and surveils) it.

A smart contract trusts nobody and can liquidate nobody after the fact (the writer might be an anonymous wallet that vanishes). So it demands 100% up front. No netting, no portfolio margin, no IOUs.

Worked example: capital locked per $1 of premium

Let’s quantify the “tax.” Take that 1-ETH covered call: lock $3,000 of ETH to earn $60 of premium over a month.

Annualize it (ignoring compounding for clarity): $2.0\% \times 12 = 24\%$ gross yield on the locked ETH. Not bad — but every cent of that ETH sat idle to earn it.

Now the put side. Write one $3,500 put on ETH, collect $90 premium:

Same option, same premium, 10× the locked capital in DeFi — so one-tenth the return on capital. This is the capital-inefficiency tax, and it’s why on-chain option yields, expressed per dollar of premium, look generous while yields per dollar locked look thin. It also caps how aggressively writers can supply, which thins liquidity and widens spreads.

The frontier is partial-collateral / margined designs: protocols that let writers post less than 100% by adding on-chain risk engines, cross-position netting, and automated liquidations (the same machinery you met in the perps lesson). It’s powerful and dangerous — under-collateralization plus a manipulable oracle is exactly how on-chain blowups happen. Lessons later in this course dig into those liquidation mechanics.

Quoting volatility: AMM vs order book

You can encode the settlement of an option in a contract easily enough. The genuinely hard problem is the price before expiry — what should this option trade for right now? Two architectures have emerged, mirroring the spot-market split you already know.

(a) AMM-quoted vol (Lyra, Premia, early Dopex). An automated market maker prices options off an on-chain volatility surface (the protocol’s stored implied-vol curve across strikes and expiries) plus a pricing model (Black-76 / Black-Scholes baked into the contract). Liquidity providers deposit into a single pool that is the counterparty to every trade. When you buy a call, the AMM:

1. plugs spot (from an oracle), the surface’s IV, and time-to-expiry into its model to get a fair value,
2. adds a spread, and skews the quote based on the net delta the pool already carries — if the pool is already very long the market, it charges you more to make it longer, nudging itself back toward neutral,
3. fills you instantly from the pool. LPs collect fees but inherit the pool’s aggregate Greeks and must be hedged (often via perps — hello, prior course).

(b) Order books (Aevo, and Deribit as the centralized reference that on-chain books imitate). Professional market makers stream live bid/ask quotes at many strikes; you trade against a resting order, not a formula. This is how essentially all TradFi options liquidity works. On-chain, the matching may be off-chain (for speed and gas) with on-chain settlement — a hybrid.

There’s no free lunch. The order book gives tight spreads when makers show up — and an empty book when they don’t. The AMM is always on, but its LPs are passive and end up holding a lumpy bag of Greeks they didn’t choose, so the AMM defends itself with wider, skewed quotes. Capital efficiency, liquidity depth, and who-holds-the-risk are the three dials, and every protocol picks a different setting.

Settlement designs: European cash-settled vs physically-settled

Two independent design axes decide how an on-chain option pays out.

Exercise style — European vs American. A European option can only be exercised at expiry; an American one can be exercised any time up to expiry. On-chain, European dominates, because American early-exercise means the contract must be ready to settle at an arbitrary block — more oracle reads, more gas, more attack surface. One fixed settlement timestamp is vastly simpler to encode and to oracle.

Settlement type — cash vs physical. A physically-settled option delivers the asset: exercise a call and you actually receive 1 ETH for $3,500. A cash-settled option pays the difference in cash: exercise the same call and you just receive spot − 3,500 in a stablecoin — no ETH changes hands. Cash settlement needs only a single trusted number at expiry — the oracle settlement price — making it perfectly suited to a blockchain that reads a feed and does arithmetic.

So the on-chain default is overwhelmingly European + cash-settled: one expiry timestamp, one oracle read, one subtraction, done. (Physically-settled designs exist — they’re appealing for covered calls where you genuinely want to deliver coins you already hold — but they add transfer logic and delivery edge cases.)

Worked example: cash-settling a European call

You hold the $3,500 European call from earlier. Expiry block arrives. The oracle reports the ETH settlement price at $3,900.

The contract pays you $400 in USDC out of the writer’s locked collateral. No ETH is delivered, no exercise notice, no assignment lottery — just max(3900 − 3500, 0) evaluated once, on-chain, at one timestamp. The writer reclaims their remaining collateral. Net of the $60 premium you paid, your profit is 400 − 60, i.e. $340.

Had the oracle reported $3,100 instead, the payout would be max(3100 − 3500, 0), i.e. $0; the option expires worthless, you lose your $60 premium, and the writer keeps 100% of their collateral.

Why pricing an option on-chain is genuinely hard

Step back and compare the two operations the chain is being asked to do.

Swapping two tokens is deterministic and self-contained. The price comes from the pool’s own reserves via $x \cdot y = k$. No outside data, no forecast — just reserves and arithmetic. The curve below is the price; selling more X slides you along it, and you can compute the exact output before you sign. Nothing about tomorrow matters.

Pricing an option needs three inputs the chain cannot conjure from its own state:

1. A live spot price. Black-Scholes needs the current underlying price, $S$. A blockchain has no idea what ETH costs — it must import that number from an oracle, an external price feed pushed on-chain (e.g. Chainlink, or a TWAP read off a DEX pool). And an oracle is a target: if an attacker can nudge the reported price, they can mint or settle options at fraudulent values. Cash settlement makes this worse — the entire payout hinges on one number at one block.
2. An implied-volatility input. Option value is dominated by $\sigma$, expected future volatility — a forward-looking quantity that, by definition, isn’t in any historical on-chain data. The protocol has to source or guess a vol surface, store it, and keep it fresh. Stale or manipulated vol = mispriced options that arbitrageurs (or attackers) drain.
3. Greeks, computed in expensive gas. Black-Scholes involves the normal CDF $N(d_1)$, $N(d_2)$, logs, exponentials, and a square root. Every one of those is costly to compute on the EVM (the Ethereum Virtual Machine), where you pay gas — a fee — for each operation. Protocols resort to polynomial approximations, lookup tables, and off-chain computation with on-chain verification just to make a single quote affordable.

So: a swap is a closed curve you can evaluate for almost free; an option is a forward-looking, data-hungry, manipulable computation. That is why on-chain options lag spot DEXs by years of engineering.

These three pressure points — the oracle, the vol input, and the cost of computation — are the spine of the rest of this course. Lesson 4 dissects oracle design and manipulation; lesson 6 tackles how protocols actually source and stabilize an on-chain volatility surface.