A contract has two parties: a seller and a buyer. The seller holds an asset (XRP or RLUSD) and is willing to lock it for a term in exchange for premium. The buyer wants directional exposure to the XRP/RLUSD pair without holding a position outright — they pay premium, lock margin, and benefit from rate movement during the term.

The bot creates a multisig wallet that both parties co-control. The seller's asset is deposited into the multisig and immediately swapped through the on-ledger AMM into its opposite. That opposite asset sits in the multisig for the term. At settlement, it swaps back. The seller gets exactly what they deposited. The buyer takes whatever surplus or shortfall came out of the round-trip swap, against their margin.

Three real economic actors: the seller offers an opportunity by locking their asset for a term; the buyer takes the opportunity by paying premium and accepting directional risk against margin; the AMM (and its liquidity providers) is the actual venue where the round-trip swap happens. Real assets, real swaps, real value transfer at every step.

A seller holds 1 XRP and is bullish on XRP. They want premium income on top of their hold. They write a put.

Deploy

1. Bot creates a 2-of-2 multisig wallet between seller and buyer.
2. Seller's 1 XRP deposits to the multisig.
3. The 1 XRP swaps via AMM into RLUSD at 0.5421 → 0.5421 RLUSD locked.
4. Buyer pays 0.0163 RLUSD premium (3% of 0.5421) into the multisig.
5. Buyer locks 0.0542 RLUSD margin (10% of 0.5421) into the multisig.

Multisig holds: 0.5421 RLUSD (locked position) + 0.0163 RLUSD (premium, escrowed) + 0.0542 RLUSD (buyer's margin) = 0.6126 RLUSD total.

Hold

For 15 days the position sits. The bot polls the AMM every ~12 seconds. Mark-to-market: at the current rate, what would the 0.5421 RLUSD swap back to in XRP? At 90% margin consumed, soft liquidation fires (both co-sign). At 100%, hard liquidation fires automatically via pre-signed swap-back.

Settle — XRP fell (buyer profits)

At expiry, suppose R_t = 0.4500. The 0.5421 RLUSD swaps back: 0.5421 / 0.4500 = 1.2047 XRP.

1. Seller receives 1 XRP back. Their deposit, made whole.
2. Remaining 0.2047 XRP goes to the buyer as profit.
3. Buyer's 0.0542 RLUSD margin returned untouched (no shortfall).
4. Premium (0.0163 RLUSD) releases to the seller — last, after the rest confirms.

Settle — XRP rose (margin consumed)

If R_t = 0.6500, the swap-back gives 0.5421 / 0.6500 = 0.8340 XRP. Shortfall of 0.1660 XRP from seller's 1 XRP deposit.

The shortfall is covered from the buyer's margin. 0.1660 XRP at the current rate is 0.1079 RLUSD — that exceeds the buyer's 0.0542 RLUSD margin. This is the liquidation case; the bot should have fired the swap-back earlier when margin hit 90% consumed.

If liquidation fired correctly at the soft threshold: seller is made whole from the early swap-back proceeds plus consumed margin, buyer keeps 10% of margin (0.0054 RLUSD) as buffer. Premium still releases to seller. If the rate moved past 100%, hard liquidation would have fired automatically via pre-signed swap-back, delivering (deposit − margin) to the seller with no buyer cooperation needed.

Calls are the mirror of puts. Seller deposits RLUSD. AMM swaps to XRP at deploy. XRP sits locked in the multisig for the term. At settlement, XRP swaps back to RLUSD.

Seller gets their RLUSD deposit back. Buyer gets the surplus (if XRP rose) or eats the shortfall against margin (if XRP fell). Same structure, opposite asset.

Settlement is a sequence of on-chain steps, not an atomic release. In order:

The seller does not face directional risk on their asset. They get their deposit back as the same asset, same amount, regardless of where the rate went.

What the seller actually risks:

• Liquidity cost during the term. Their asset is locked. Cannot deploy elsewhere. Premium compensates, but the opportunity cost is real.
• Operational risk on the bot. Seller protection depends on the bot polling the AMM and coordinating liquidation. Soft liquidation at 90% requires both wallets to co-sign. Hard liquidation at 100% fires automatically via a pre-signed swap-back. The gap between 90% and 100% is where the bot's uptime matters most.
• Venue risk. XRPL outage, AMM exploit, RLUSD issuer freeze (Ripple can freeze RLUSD as an issued token), governance changes affecting AMM behavior.

Premium is paid into escrow at deploy and released to the seller at settlement. Premium is the fee the buyer pays to access the market — it is paid regardless of which direction the underlying moves. Only returns to buyer if the deploy bundle never properly completes.

Margin is locked in escrow at deploy. Drawn down at settlement to cover any shortfall when the locked asset swaps back below the seller's deposit amount. At soft liquidation (90%), buyer keeps 10% buffer. At hard liquidation (100%), margin is fully consumed.

Maximum buyer loss: premium + full margin (at hard liquidation).

The buyer's upside comes from the AMM round-trip — if the rate moved their way during the term, the swap-back gives more than the seller's deposit, and the surplus is theirs. There is no cap on the buyer's upside in the contract structure; the only practical cap is whatever the AMM gives at swap-back time.

3% for 5 days annualizes to roughly 220%. 10% for 30 days annualizes to roughly 120%. These rates look rich relative to traditional equity options, where 1–2% per month is typical for cash-secured puts on liquid names.

The rates are calibrated to the volatility of XRP/RLUSD, which can move 10%+ in a day. At that volatility regime, a 3% premium gives the buyer real exposure to potential moves that justify the cost, while still compensating the seller for the liquidity lock and operational risk.

Premium being seller-favorable does not make this a one-sided market. The buyer's cost is small relative to the volatility-driven upside they're buying access to. Both sides come out ahead in expectation, in different ways.

The bot is the seller's tool. The seller runs it. The buyer never installs anything; they interact via wallet signing on a public URL the seller's bot exposes.

Specifically the bot:

• Generates and serves invitations.
• Constructs the multisig wallet at deploy.
• Constructs and submits the AMM swap at deploy.
• Stores pre-signed hard liquidation variants and escrow fulfillments in encrypted flat-file storage.
• Polls the AMM every ~12 seconds for each open position.
• Computes mark-to-market against margin.
• Announces soft liquidation at 90% and coordinates live co-signing from both wallets.
• Fires hard liquidation automatically at 100% via the pre-signed swap-back.
• Submits EscrowFinish and coordinates settlement at expiry.
• Handles voluntary close requests from buyers.
• Tracks usage: a use is consumed only when an escrow ends.

What the bot does NOT do:

• Pick the price source — there is no oracle. The AMM is the venue.
• Enforce contract terms — those are signed into the multisig at deploy.
• Match buyers and sellers — invitations are shared peer-to-peer.
• Hold private keys — every signing event uses the user's wallet.