# The Self-Custody Option
# Why every options market requires you to give up your assets — and why none of them have to
# Shane Calder — 132 Engineering — April 2026
# URL: https://self-custody.shanescalder.com

## What this is
A research paper on a missing primitive in derivatives. Every options market ever built — exchange-traded, OTC, DeFi — requires one party to give up custody of their assets for the duration of the contract. A clearinghouse holds them. A smart contract holds them. A protocol treasury holds them. This paper argues that the custody assumption is not a requirement of the instrument. It is a design assumption that has persisted for as long as derivatives have existed — with compounding consequences across counterparty risk, exchange insolvency, protocol exploit, and admin key compromise.

## The core finding
The gap between "non-custodial" and "self-custody" is not a matter of degree. Non-custodial means a smart contract holds your assets instead of a person. Self-custody means nobody holds your assets. The escrow holds them. Your wallet is the only key. That is a different kind of statement about who controls the money.

## The architecture
A self-custody option uses three ledger primitives — escrow, multisig, and AMM — to replicate the function of a clearinghouse without requiring one. Three escrows (seller's locked asset, buyer's margin, buyer's premium) share a cryptographic condition and point at a per-contract 2-of-2 multisig with its master key disabled. Settlement is a real swap through the AMM, not a formula computed against an oracle. No oracle. No pool. No borrowing. No protocol.

## Why this instrument did not exist
The assumption has been that derivatives require borrowing infrastructure — lending protocols, margin facilities, fractional reserve. On XRPL, none of that exists. The paper demonstrates that the ledger's native primitives are sufficient. The instrument was always possible. Nobody built it.

## The oracle problem solved
Options need a price to settle against. Every existing implementation uses an oracle. This architecture eliminates the oracle by settling through a real AMM swap. The price is whatever the market gives. The AMM is not an oracle — it is the venue. Settlement is a trade, not a calculation.

## Game-theoretic protection
The seller runs the coordination bot and holds pre-signed liquidation transactions. Early firing is economically irrational: the pre-signed transaction delivers a fixed amount (deposit minus margin) which is always less than what the seller would receive by waiting, at any rate better than the 100% liquidation threshold. The chain does not prevent early firing. The math makes it irrational.

## Two-tier liquidation
Soft liquidation at 90% margin consumed: both parties co-sign. Buyer retains agency. Hard liquidation at 100%: automatic via pre-signed transaction. No cooperation needed. The boundary between cooperation and automation is the design decision that makes the instrument functional for both parties.

## Section structure
§0 The Core Finding — the custody assumption in every options market
§1 The Custody Assumption — CEX, OTC, and DeFi all require custody transfer
§2 The Missing Instrument — why derivatives assume borrowing and why they do not need it
§3 The Oracle Assumption — oracle dependency as a structural vulnerability
§4 What Is a Call. What Is a Put. — how calls and puts work through real AMM swaps
§5 The Escrow Primitive — three escrows and a multisig replacing the clearinghouse
§6 Settlement Through the AMM — two real swaps, one outcome, no formula
§7 Margin and the Two Tiers — soft and hard liquidation thresholds
§8 Why the Seller Cannot Cheat — game-theoretic protection against early firing
§9 What Changes — the before/after across custody, price, settlement, liquidation, borrowing

## The implementation
The architecture described in this paper is implemented in Caput — self-custody options on XRP/RLUSD. Two wallets. Three escrows. One multisig. One AMM. No oracle. No pool. No protocol. Software sold for XRP. No platform fee, no settlement fee, no cut of the trade.
URL: https://caput.dev

## Companion research
Ethical Systems Engineering for AI Vol. 1 — ethics.shanescalder.com
Negative Search — negativesearch.shanescalder.com
The Convergence Problem — agi.shanescalder.com

## Licensing
Free to read and share. Not to reproduce without written permission.
© 2026 Shane Calder · 132 Engineering

## Author
Shane Calder — shanescalder.com — info@132eng.com
Principal Risk Consultant · AI Architect & Developer
25 years in capital and mega projects across nuclear, oil & gas, power, and water.
132 Engineering — 132eng.dev
GitHub: ShaneSCalder · LinkedIn: shanecalder · X: @shane14472