Lune

01 · Overview

Lune issues fixed-term, non-custodial loans in USDC against memecoin collateral. A pawn shop, not a money market: pledge tokens, receive USDC up front, repay by the deadline or forfeit the pledge. There is no health factor, no margin call, and no price-triggered liquidation · time is the only liquidation trigger. Collateral can fall 90% mid-loan and nothing happens; the only condition that closes a loan against you is the clock running out.

The debt is non-recourse. If at the deadline the bag is worth less than the debt, walking away is the rational move and the loss is the lender side’s to absorb · which is why every loan is sized against pool depth and capped per market, not just priced.

02 · Architecture

03 · Tiers & pricing

The fee is taken up front from the disbursed amount; the principal repays flat, with no accrual. Extending (“rolling”) a loan before its deadline resets the clock and costs the fee again · the annualised cost of rolling is shown everywhere the fee is, because that number, not the headline fee, is the real price of staying in the position. Every fee · origination and extension · is split at source: 30% to the protocol treasury and 70% accrued to pool depositors via share price. The owner can adjust the split, hard-capped at 50% treasury. Effective LTV is always min(tier LTV, token cap). Hard caps the owner cannot exceed without new code: LTV ≤ 35%, term ≤ 3 days, fee ≤ 5%.

04 · The oracle

Borrows are priced by an on-chain Uniswap V3 TWAP · no off-chain price server, no signed attestations, no co-signer. Three checks must all pass before a borrow is priced:

1 · cardinality · the pool’s observation buffer must have grown past a per-token minimum; at cardinality 1 there is no TWAP and one swap sets the price. 2 · age · the pool must be able to look back the full TWAP window, which blocks launch-a-token-then-borrow-against-it. 3 · divergence · a slow and a fast window must agree within a deviation cap; a token mid-pump fails this and is unborrowable until it settles.

When both windows pass, the lower quote wins: under-valuing collateral costs the borrower loan size, over-valuing it costs lenders principal, and the asymmetry resolves toward lenders. The app never recomputes this maths · quotes come from LoanManager.quoteLoan(), which runs the same lines openLoan() runs.

05 · Defaults & liquidation

A loan past its deadline can be closed by anyone: post the outstanding principal in USDC and the contract transfers the entire pledged collateral to you · no auction, no partial fill, no price check. The protocol never swaps anything, so there is no router dependency, no slippage risk, and no MEV surface inside the contracts. The keeper’s bounty is implicit: collateral value − principal.

When collateral is worth less than the debt, no keeper acts, and the loan resolves via writeOff after a 7-day grace period, socialising the loss across depositors · the reason the registry’s exposure caps and depth ceilings exist, and the pool’s own utilisation cap alongside them. Repaying still works after the deadline right up until a keeper acts.

06 · Collateral registry

Every listed token carries its own on-chain risk parameters: a max LTV cap, slow/fast TWAP windows and a deviation cap, minimum observation cardinality, a minimum pool depth below which borrowing stops, a loan-to-depth ceiling that sizes each loan against what the pool could actually absorb, and a protocol-wide exposure cap per market. Every one of them is readable on-chain from the registry; the app’s Markets screen surfaces the max LTV, the TWAP windows and deviation cap, live pool depth and exposure against its cap. Listing new collateral is an owner action; a circuit breaker can stop new borrows per token without ever trapping collateral.

07 · Contract addresses

Launching on Arc Network (chain id 5042). The protocol contracts are not deployed yet; addresses appear here once they are. Once live, these will be the only official addresses · treat anything else claiming to be Lune as fraudulent. The contracts are not yet audited; size positions accordingly.

08 · Running a keeper

Liquidation is permissionless and needs no registration. Enumerate loans (ids are dense from 1, bounded by nextLoanId), filter for status == Active && dueAt < block.timestamp · the comparison is strict: at timestamp == dueAt the contract still reverts NotYetDue (and the borrower can still extend) · check the bounty is positive at current prices, approve USDC for the principal, and call liquidate(id). The app’s Keeper screen does exactly this in a browser, including marking underwater loans it would be irrational to act on.

09 · Data access

There is no subgraph yet. All state is readable directly from the contracts with plain view calls · the app itself runs entirely on direct reads: tiers from tiers(), risk parameters from getConfig(), the full loan book by enumerating loans(id). USD figures shown in the app are display-only estimates from Binance and DexScreener; nothing on-chain depends on them.

10 · Security & bug reports

There is no formal bug bounty programme yet. If you believe you have found a vulnerability, report it privately to the maintainers, marked for the security team, and do not disclose publicly until it has been addressed. The code is unaudited; the terms of service spell out what that means for anyone interacting with it.