How to lend $250M without collateral
We lent $250M with zero collateral and zero shortfalls. It is not unsecured, it is structurally secured. The system itself is the collateral
Our first credit line was issued to solvers: $250M of collateral-free credit. Zero shortfalls. 6-8% clean APY. Growing month over month. No off-chain agreements. No trust-me underwriting. So what's actually happening?
The short answer: it's not unsecured. It's structurally secured. The borrower doesn't post collateral upfront because the system itself is the collateral.
How the solver line works
A solver needs capital to fill user orders across chains. The credit is drawn, used on a specific route, and the proceeds flow back through a repay-first sink. The solver never touches the borrowed capital in a way that could leave the lender uncovered. The "closed system" is literal: the capital enters the route, does its job, and returns.
Duration is short (seconds to minutes). Routes are predefined. Recovery is straightforward (abort and reclaim in-flight assets). This makes the solver use case the cleanest version of what I'm about to describe, and the safest to operate.
The pattern underneath: Closed-System Embedding
What makes this work is a framework we can call Closed-System Embedding (CSE). The idea is simple: if you can control what borrowed capital does, where it goes, and how proceeds are routed back, you don't need a pile of idle collateral sitting in escrow. The enforcement happens through the container, not through a margin account.A CSE has three components:
- a container: the controlled environment the position lives in,
- a policy: the set of permitted actions while debt exists, and
- a recovery module: how the protocol can unwind the position to obtain repayment.
This is not a new idea
Lockbox accounts, controlled disbursement, covenant-triggered step-in rights: project finance has used these structures for decades. The mapping is direct:
- Lockbox / controlled accounts = container egress lock
- Covenants / DSCR triggers = action gating and state transitions
- Step-in rights = protocol recovery
- Waterfall = deterministic priority: repay-first, then surplus
The difference is enforcement. In traditional finance, these are legal agreements backed by courts and auditors. In CSE, they are code-enforced invariants that execute atomically. No 90-day workout. No restructuring committee. The state machine just does its job.
The core invariant
For any external transfer out of the container while debt exists, the system enforces:
In plain English: you cannot take any action that makes the lender less covered. Only surplus escapes.
Three properties enforce this:
Egress lock. While debt is outstanding, no withdrawal, transfer, or beneficiary change can reduce coverage. The borrower can use the capital - that's the whole point - but every exit path routes through repayment first.
Action gating. The system allows actions only if post-action coverage stays above a safety threshold. Not "you promised to behave" but "the contract won't execute anything that degrades coverage."
Recovery right. If coverage drops below a protective threshold, the protocol can unwind the position, route proceeds repay-first, and return only surplus. No negotiation, no legal process. The waterfall is deterministic.
State machine
The position moves through three states:
- A (Unencumbered) - no debt, full freedom.
- B (Encumbered) - debt outstanding, actions permitted if coverage holds.
- C (Protective) - health breach, user restricted, protocol can invoke recovery.
The key asymmetry: the borrower can always improve their position (repay, add margin). The protocol can always protect the lender (freeze, recover). Neither party can unilaterally extract value at the other's expense.
What can be embedded?
Not everything qualifies. A position needs to be closable, liquid, priceable, controllable, and have deterministic priority on proceeds. If any one of these fails, the position can't be safely embedded and needs traditional collateral instead.
What can go wrong
I want to be direct about this: CSE shifts risk from counterparty default to container design and implementation. That's a different risk, not zero risk. If the container has a bug, if the oracle is wrong, if the venue goes down - those are real failure modes that need real mitigants (audits, conservative parameters, circuit breakers, fallback pricing). The container isn't magic; it's engineering. And engineering can fail.
This is also why CSE is harder than it looks. Each position type requires a custom container. You need real-time pricing infrastructure, carefully calibrated thresholds, and recovery paths that actually work under stress. If it were easy, everyone would already be doing it.
Where we are
The solver line was the first proof point. Zero shortfalls across $250M is the container working as designed. But solvers are the easy case: short duration, predictable routes, high frequency.
I think what's most interesting about CSE is what it does to the collateral conversation. The standard DeFi answer to credit risk is "overcollateralize and liquidate." That works, but it's expensive and it limits who can participate. CSE says: if you can make the system closed enough, you can reduce or eliminate upfront collateral requirements while maintaining the same or better loss-given-default profile. The security comes from the structure, not from a hostage deposit.
Stay updated on all things Sprinter, and onchain credit, by following us on X, joining our Telegram, and reading more on our blog.
