Treasury games
Investors Center runs a small games lane in which players bet against the protocol's treasury rather than against each other, and the treasury keeps a fixed edge. It is a second source of income for backing, alongside the bond markets and the fee flywheel.
It is deliberately the smallest thing in the protocol, and almost all of this page is about the limits that keep it that way.
The shape of it
There are three pieces.
| Piece | What it is |
|---|---|
| The house | A bankroll vault. It draws a bounded amount of one reserve asset from the Treasury, escrows player wagers, locks the worst-case payout of every open bet, settles them, and returns bankroll on demand. |
| The games | Small, single-purpose contracts — a coin flip and a dice roll — that decide outcomes and instruct the house. They hold no funds of their own. |
| The registry | A chain-wide allow-list of game code. A game must be vetted there before any house will enable it, and it can be killed there globally in one transaction. |
Two further games sit alongside the house rather than inside it, because they are pooled rather than one-player: a prize draw, where many people buy tickets into a pot and one wins it, and a jackpot, where players deposit native ETH into a short round and the winner is paid out in a randomly chosen tokenized stock. Both escrow their own pot, draw no bankroll at all, and pay their rake to the Treasury. The house's exposure to them is zero.
Outcomes come from a verifiable randomness service using a two-party commit-reveal. A result that never arrives is not a free option for anyone: after three days, anybody can void the round, the player is refunded, and the rake is still charged.
Version one is same-token only
A market is one game paired with one asset, and wagers and payouts are the same asset: USDG in, USDG out. Nothing is converted mid-round.
That single restriction removes most of the risk surface. No price oracle enters a round, so no round can be manipulated through one. The exposure limit is checked in token units before the wager is accepted. And the payout is priced on the wager after the rake is taken, using the same rounding the house uses — so the bankroll's expected value on a fair game is exactly zero and the rake is the treasury's entire edge.
Cross-asset markets — wager in a stablecoin, win a stock token — are deferred. They need manipulation-resistant pricing inside the round, and that work is not done.
How it is bankrolled
The house draws its bankroll from the Treasury under a role that permits managing reserves, and every draw passes three independent limits:
- A risk budget, set by governance per asset, expressed as a fraction of what the Treasury actually holds of that asset right now. It re-evaluates as holdings change, so a budget drawn in full is already over budget once the Treasury holds less.
- The excess-reserves gate. Nothing can be drawn out of the Treasury that is not backed by value above the circulating supply — the same gate that bounds bond mints and staking emissions.
- A rate limit. Cumulative value drawn against any one asset is capped over a rolling multi-day window, so even a fully compromised operational seat cannot empty a position quickly.
On top of that, the house holds a solvency invariant on every path: its balance of an asset is always at least the sum of locked payouts, escrowed wagers and unclaimed winnings. It can never promise more than it holds.
INVEST itself never enters a market. INVEST is not a reserve asset of its own Treasury, and both market creation and round opening require the market asset to be one — so there is no INVEST market to open. The role that would let the house mint INVEST is never granted, and the transfer tax is irrelevant here because no INVEST ever moves through a game.
The limits on a round
Every market carries bounds that a round is checked against as it opens, all of them expressed against the live bankroll rather than a stored number:
- a minimum rake, so a zero-edge house is never a valid configuration, and a minimum wager sized so the rake can never round to zero;
- a maximum rake, capped well below anything predatory;
- a maximum wager and a maximum locked payout per round, each a small fraction of available bankroll;
- a ceiling on how long a shot a game may offer — how large a multiple of the wager a single payout can be;
- and a global exposure ceiling: the sum of all open locked payouts can never exceed most of the live balance.
Players can also pin the terms they are accepting when they place a bet, so a rake change in flight cannot silently worsen an open wager.
Fair odds, and what the player's edge is
Both house games pay true odds on the rake-net stake. A coin flip that wins pays twice the post-rake wager; a dice roll that wins with a chosen probability pays the post-rake wager divided by that probability.
So a player's expected value is exactly minus the rake — no more and no less. That is the criterion a game must satisfy to be vetted at all. The pooled games work the same way: every ticket in a draw has an equal chance, and every wei in the jackpot has an equal chance, with the rake taken once from the pot.
Pausing and unwinding
The lane is designed to be switched off faster than it can be switched on.
| Step | Who | Effect |
|---|---|---|
| Pause the house | the guardian or ops | Stops new rounds and new bankroll draws immediately. |
| Kill a game | the registry owner | Stops that game on every house everywhere. |
| Revoke the Treasury role | the guardian or governance | The house can never draw again. |
| Return the bankroll | ops | Sends un-reserved bankroll back to the Treasury. |
| Revoke the ops seat | governance | Leaves the house inert. |
Pausing blocks new risk only. Settlement, voiding, returning funds and claiming winnings all stay live, so a pause never strands a player's money. And only governance can un-pause — an instant operational key can pause the lane but cannot un-do a timelocked decision to stop it.
A freshly deployed house is inert by construction: no funds, no game enabled, a zero risk budget, and no permission at the Treasury. Every one of those has to be turned on by an executed governance proposal.
The failure modes it is built for
- A payout that cannot be delivered — a recipient that rejects transfers — is credited as a claimable balance instead of blocking the round.
- A randomness result that never arrives ends in a void and a refund after three days, with the rake charged so that withholding a result costs money.
- A rake the Treasury cannot receive is left in the bankroll rather than failing the player's payout.
- A game contract that misbehaves is killed globally at the registry, and in-flight rounds still settle.
Status
The games contracts are written and tested, but like the rest of the protocol, nothing is deployed. The lane also requires an executed governance proposal to grant the house its Treasury role and set its risk budget, so it cannot come into existence quietly.
Version one carries three known gaps, by design: pots cannot be topped up by the house, there is no per-address ticket cap in the prize draw, and players must be externally owned accounts rather than contract wallets.