Summary
This proposal authorizes the relaunch of the Junior Tranche system (jrDOLA) on an updated and freshly deployed contract suite. Following jrDOLA’s first live period and its absorption of a bad-debt event in a covered market, the system was paused while the design was reviewed. The relaunch carries forward the original architecture while introducing one substantive change: a bounded, governance-controlled withdrawal pause that allows the protocol to hold the insurance layer in place during an active stress event. The proposal sets initial operational parameters and allocates a DBR reward budget to rebuild liquidity through a measured, slow-churn approach. A follow-up proposal will enable FiRM market coverage, designed to execute in parallel, pending governance approval.
Background
jrDOLA introduces a market-driven insurance layer that addresses a fundamental limitation in Inverse Finance’s risk model. As FiRM continues to scale, the protocol absorbs all bad debt directly into DOLA backing, creating concentration risk that constrains growth potential. This model works adequately at current scale but becomes increasingly fragile as total debt exposure grows.
jrDOLA solves this by creating a first-loss capital buffer where depositors voluntarily accept bad debt risk in exchange for increased yield. When FiRM positions become insolvent, the slashing mechanism draws from jrDOLA deposits to repay bad debt before it impacts DOLA backing. This protects DOLA solvency by establishing a dedicated absorption layer, enables protocol scaling with reduced systemic risk, provides DOLA holders with a new product that earns both sDOLA base yield and DBR rewards, and establishes permissionless bad debt resolution that requires no manual governance action during stress events.
The initial live deployment validated the core mechanism in production: when a covered market sustained losses, jrDOLA absorbed the resulting bad debt exactly as designed, shielding DOLA backing. That episode also surfaced a structural gap. Depositors retained the ability to exit a distressed market before the relevant oracle had repriced and before slashing could be executed. A coordinated, rational exit during the window between a loss becoming likely and that loss becoming enforceable would let depositors escape the very risk they were paid to underwrite, leaving the remaining stakers and ultimately DOLA holders to absorb it. The relaunch closes this gap.
The remedy mirrors the approach taken by Aave’s Umbrella safety system in its response to the rETH depeg event: governance gains the ability to temporarily freeze withdrawals so the insurance layer cannot drain ahead of a crystallizing loss. The capability is deliberately constrained. It can hold withdrawals for a maximum of ninety days, it requires continuous, affirmative governance support to persist rather than locking funds indefinitely, and governance can lift it at any time. It exists to preserve the integrity of the buffer during the narrow window where slashing is pending, not to trap depositor capital.
The jrDOLA codebase underwent rigorous security scrutiny through a dual-audit process with Sherlock: a private audit with researchers Hash and Osidian focused on ERC-4626 vault mechanics, slashing logic, and withdrawal queue edge cases, followed by a public audit contest open to Sherlock’s broader researcher community. The final reports are posted here. The withdrawal-pause change introduced for the relaunch was implemented and reviewed separately, approved, and fork-tested across deposit, withdraw, and slash flows prior to redeployment.
Technical Implementation
Deployed Contracts
The relaunch is built on a newly deployed contract suite on Ethereum mainnet. Addresses below supersede the original launch deployment:
JuniorDola (jrDOLA) — 0x6f80a22a57C7F0257094eA8D426AF3F747defbC7 The main ERC-4626 vault representing user deposits. All deposits are in sDOLA to provide a base yield layer. The contract integrates an xy=k auction mechanism that converts DBR rewards into DOLA-denominated yield, allowing depositors to earn returns without directly holding or managing DBR tokens.
WithdrawalEscrow — 0x8554d8a6Bcc5B6D6Eb7bEA2189e6a8F8d24c7e45 Manages the delayed withdrawal queue. The per-withdrawal cooldown duration and exit window are still snapshotted and locked at the moment a withdrawal is queued and cannot be retroactively worsened for users already in the queue. The relaunch adds a bounded, governance-controlled pause over the queue (described under Governance Controls); outside of an active pause, behavior is unchanged. Users continue earning rewards during cooldown since their funds remain slashable.
LinearInterpolationDelayModel — 0x75FdA12cB3341CcCD41b77C2515F0DA716119B07 Calculates withdrawal delays based on queue utilization, interpolating linearly between the minimum delay (empty queue) and the maximum delay (at the governance-defined threshold). The contract is upgradeable by governance, but active withdrawals continue using the delay parameters from their queue time.
FiRMSlashingModule — 0x316a01f878AA6d5A4C7ea2080D64D364F9538aa2 Implements the permissionless slashing mechanism for FiRM bad debt. Anyone can call the slashing function when a position becomes insolvent. Protective parameters include:
◦ maxCollateralValue: prevents slashing positions with significant collateral, forcing liquidators to handle those first.
◦ minDebt: prevents dust positions from spamming slashing events
◦ activationDelay: requires newly added markets to wait before becoming eligible for coverage
A guardian multisig can cancel pending market additions during the delay window.
Helper — 0xcb1cf17F0e579e520458A3a3aa72ECA65eB8560C Implements helper functions for interacting with the DBR auction in the JuniorDola contract.
Two price feeds support integrations and downstream risk tooling:
jrDOLA/DOLA feed — 0x6B6e969ED13061058820BFcbaeAd5AB85411AFD6
jrDOLA/USD feed — 0x830A0be197F927ca1673355a85DB5E715F4Ce621
Initial Parameters
JuniorDola (auction parameters)
These four values seed and govern the xy=k DBR auction. They are the core economic levers of the relaunch and are carried forward from the original launch calibration as a starting point.
• dbrReserve: [200,000e18] DBR — virtual reserves for the xy=k auction
• dolaReserve: [5,670e18] sDOLA — virtual reserves for the xy=k auction (value used at original launch)
• yearlyRewardBudget: [500,000] DBR — initial annual allocation (operator-controlled)
• maxYearlyRewardBudget: 5,000,000 DBR — governance ceiling
• operator: Treasury Working Group multisig
The dbrReserve/dolaReserve ratio sets the auction’s opening DBR price. At the original launch the ratio implied ≈ 0.0285 sDOLA per DBR; current DBR trades around $0.0410
WithdrawalEscrow
• withdrawFee: 5 bps — creates friction against cycling behavior; paid to remaining depositors
• exitWindow: 2 days (48 hours) — time to claim a withdrawal after cooldown completes
LinearInterpolationDelayModel
• minDelay: 1 day — minimum withdrawal delay when the queue is empty
• maxDelay: 10 days — applies when queue utilization reaches the threshold (aligned with Aave Umbrella)
• maxDelayThreshold: 10,000 bps — delay scales linearly from min to max as the queue fills from 0% to 100% of supply
FiRMSlashingModule
• maxCollateralValue: $100 — positions above this must be liquidated normally
• minDebt: $5 — minimum debt for slashing eligibility
• activationDelay: 7 days — review window for new market additions
• guardian: Policy Committee multisig
Governance Controls
The relaunch revises the control surface in exactly one respect: governance gains a bounded withdrawal pause. All other guarantees are preserved.
Governance CAN:
• Add or remove FiRM markets for coverage (new markets subject to the activation delay)
• Increase the maxYearlyRewardBudget ceiling
• Replace the LinearInterpolationDelayModel contract
• Adjust FiRMSlashingModule parameters
• Change the guardian address
• Pause withdrawals — freeze both queued and new withdrawals for up to a maximum of ninety days during an active stress event. The pause requires continuous governance support to persist and can be lifted by governance at any time.
Governance CANNOT:
• Hold a pause beyond the ninety-day maximum without renewed, affirmative governance action
• Worsen the cooldown or exit-window terms snapshotted for users already in the queue
• Access deposited funds except through legitimate slashing
• Bypass market activation delays
Operator (TWG multisig) CAN:
• Adjust yearlyRewardBudget within the governance-set ceiling
Operator CANNOT:
• Exceed the governance-approved ceiling
• Access deposited funds
• Modify withdrawal or slashing parameters
Guardian CAN:
• Remove markets from slashing protection before the activation period has elapsed
Guardian CANNOT:
• Interfere with operations of actively protected markets
Operational Mechanics
For Depositors
Depositing into jrDOLA follows standard ERC-4626 vault interactions. Users approve sDOLA to the jrDOLA contract and call either deposit(amount, receiver) or mint(shares, receiver). Upon deposit, users receive jrDOLA shares representing their proportional claim on the vault and begin earning DBR rewards distributed through the xy=k auction, which automatically converts DBR into DOLA-denominated yield without requiring direct DBR interaction.
Withdrawing follows a multi-step process designed to provide security during stress while maintaining a reasonable experience during normal operations. Users first call queueWithdrawal(shares) to enter the queue. At that moment the system snapshots their withdrawal parameters — cooldown duration and exit window — and applies the withdrawal fee, which is distributed to remaining depositors. Users then wait for the cooldown, which ranges from the minimum to the maximum delay based on current queue utilization. During cooldown, users continue earning rewards because their funds remain in the vault and continue to provide slashable coverage. After cooldown, users enter their exit window and claim by calling the claim function, receiving sDOLA equal to their original deposit plus accrued yield, minus any slashing events that occurred while deposited, minus the withdrawal fee. Users may also cancel during cooldown and return to the active pool. Should governance invoke the withdrawal pause during an active stress event, claims and new exits are held for the duration of the pause; queued positions retain their place and resume on lift.
For the Protocol
Bad debt coverage operates through a permissionless slashing process. When a FiRM position becomes insolvent such that debt value exceeds collateral value based on oracle pricing, anyone can call slash(market, borrower) on the FiRMSlashingModule. The module verifies insolvency by checking current debt and collateral values, then applies protective checks — collateral value below maxCollateralValue (so positions that should be liquidated normally are excluded) and debt above minDebt (so economically insignificant positions are ignored). If all checks pass, the module calculates the DOLA required to restore the position’s debt-to-collateral ratio to parity and triggers a pro-rata slash against the jrDOLA vault, where all depositors’ share values decrease proportionally to socialize the loss. The recovered DOLA repays the bad debt in the FiRM market, removing the insolvency and protecting DOLA backing before it reaches core reserves.
Reward distribution operates through an ongoing auction integrated into the jrDOLA contract. The protocol allocates DBR according to the yearlyRewardBudget, within governance-set limits. These DBR enter an xy=k constant-product market maker with virtual DOLA reserves, creating a permissionless auction where anyone can swap sDOLA for DBR. This increases the vault’s total assets without changing share supply, raising the sDOLA-per-share exchange rate. Depositors thus earn DOLA-denominated yield without ever directly interacting with DBR, while the auction provides continuous price discovery and self-adjusting reward distribution based on DBR market dynamics.
Budget Request
The budget operates within a controlled structure. The maxYearlyRewardBudget of 5,000,000 DBR is a governance-enforced ceiling that can only be raised through a full governance proposal. Within that ceiling, the yearlyRewardBudget represents the initial active budget upon approval and is controlled by the operator (Treasury Working Group multisig), which can adjust it up to the ceiling without additional votes — enabling responsive calibration to market conditions while preserving ultimate governance control.
Given that the relaunch deliberately rebuilds liquidity through a measured, slow-churn approach rather than an aggressive bootstrap, the initial yearlyRewardBudget should be calibrated to attract first-loss capital at a sustainable cost rather than to maximize early TVL.
On-Chain Actions
JuniorDola (setOperator, initialize, setSlashingModule, setMaxYearlyRewardBudget, setYearlyRewardBudget) · WithdrawalEscrow (initialize, setWithdrawFee, setExitWindow) · LinearInterpolationDelayModel (setMinDelay, setMaxDelay, setMaxDelayThresholdBps) · FiRMSlashingModule (setGuardian, setMaxCollateralValue, setMinDebt, setActivationDelay) · DBR (addMinter)