Insurance
Product Overview
Insurance in crypto usually looks like a subscription: you prepay a lump sum for a fixed term, hope nothing happens, and then repeat. FT Insurance takes a different path. It treats protection like a lending market. Instead of buying a block of coverage time, you open a position in a pool and pay a running premium only while you want protection. Capital providers supply the pool and accrue those premiums; buyers "borrow" protection capacity and can scale it up or down in minutes. The effect is a protection system that breathes with the market: liquidity flows in when returns are attractive, coverage grows where demand appears, and users can align what they pay with the risk they actually face.
Insurance poolInsurance poolA capital pool that backs exploit coverage; buyers pay usage‑based premiums, and providers accrue yield from those premiums. Claims depend on event verification.View glossary entry mechanics for buyers and liquidity providers.
Protection as a market, not a contract
The core of FT Insurance is a pooled backstop denominated in highly liquid assets (e.g., USDCUSDCStablecoins accepted in PCA contributions and used across products; each has distinct risk/peg mechanics.View glossary entry). When you contribute capital, you receive a pool token (e.g., FT_exploit_insurance) that tracks your share of the pool's assets and premiums. When you want protection, you post collateralcollateralAssets allowed as collateral and the maximum per‑asset size configured to manage concentration and risk.View glossary entry and open a coverage position against that pool, functionally "borrowing" the right to claim if a covered event is confirmed. As long as the position is open, you pay a continuous premium rate. Close the position, and the meter stops. There is no up‑front prepayment and no need to guess the perfect term length.
If an exploit occurs, an external verifier (e.g., UMA's optimistic oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry) confirms whether the event meets the on‑chain criteria for coverage. Once confirmed, addresses with active coverage can settle: the system accepts the relevant insurance token and pays out 1:1 in USDCUSDCStablecoins accepted in PCA contributions and used across products; each has distinct risk/peg mechanics.View glossary entry from the pool up to the covered amount. If no exploit occurs, buyers simply withdraw their coverage when they no longer need it; capital providers keep the streamed premiums for the time coverage was active.
How pricing and capacity emerge
Because protection behaves like borrowing from a pool, premiums resemble an interest rate. The rate responds to utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry (how much of the pool is spoken for), to risk conditions around the covered protocol, and to market‑wide signals (volatility, recent incidents, liquidity). High demand for coverage or elevated risk drives the rate up; new capital entering the pool drives it down. Coverage caps per protocol and global limits prevent concentration. You can see the live rate before you open a position, and adjust coverage size as conditions change, scaling up during a contentious upgrade and scaling down when risk subsides.
What it feels like to use
As a buyer, you decide how much coverage you want and for how long you want to keep it open. You post a small amount of collateralcollateralAssets allowed as collateral and the maximum per‑asset size configured to manage concentration and risk.View glossary entry, open the position, and watch a live premium accrue while the protection is active. If conditions worsen (rates rise), you can trim coverage; if you need more for a specific window, you can add to your position. If an incident occurs and is verified, you present your active coverage and claim at par from the pool. If nothing happens, you close the position and stop paying.
As a capital provider, you supply USDCUSDCStablecoins accepted in PCA contributions and used across products; each has distinct risk/peg mechanics.View glossary entry to the pool, receive the pool token, and begin accruing a share of all active premiums. Your exposure is diversified across buyers and covered protocols, in accordance with the pool policy. You can increase or decrease your stake; withdrawals may be subject to short cooldowns when utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry is high or while claims are settling. Returns are variable: high utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry and elevated risk raise premiums; calm markets lower them.
Claims and verification
Coverage is only as strong as its adjudication. FT Insurance relies on an external oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry process to confirm whether a claimed event meets predefined on-chain criteria (for example, a smart-contract exploit on a named protocol within a time window and loss threshold). An optimistic‑oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry model introduces a challenge period: if the community disagrees with the proposed resolution, they can dispute it. Once the outcome finalizes, settlement opens for addresses with active coverage during the incident window. This split of responsibilities (market‑based pricing on one side, external verification on the other) keeps the pool accountable to transparent rules.
How it fits the rest of Flying Tulip
Insurance is plugged into the same spine as trading and lending. The Spot provides the pricing context that informs risk signals; Lend provides cross‑collateralcross‑collateralUsing one deposit as collateral across multiple markets or products simultaneously (e.g., lending, CLOB, futures).View glossary entry so the same deposit can back lending, orders, futures, and insurance coverage simultaneously. Data about utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry, incident frequency, and claim resolutions feed back into the broader risk model. And because Flying Tulip is token‑first, a policy share of insurance premiums flows into the FT buyback pipeline; when revenue‑funded, those buybacks drive the unlock logic explained in the FT overview.
The economics under the hood
Premiums are streamed from buyers to the pool in real time and split between providers and the protocol, per policy. Provider share accrues to pool assets; protocol share participates in FT buybacks. Because rates reflect utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry and risk, capital naturally migrates: if returns fall, providers can reduce exposure; if demand spikes, new capital is attracted by higher yields. The pool is not a black box; balances, utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry, premium rates, pending claims, and historical settlements are visible on‑chain.
Risk, plainly stated
Insurance shifts risk; it does not delete it. Providers bear the risk that a verified exploit will trigger payouts from the pool; that is the service for which they accrue premiums. Buyers bear the risk that a suspected event is ultimately not verified by the oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry. Both sides face smart‑contract and integration risks typical of any DeFiDeFiFinancial services built on public blockchains using smart contracts rather than centralized intermediaries.View glossary entry system, and liquidity can tighten temporarily during heavy utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry or while claims are being processed. Coverage scopes and exclusions matter; each market specifies what counts as a covered event before you open a position. The Risks, Security & Audits page explains the guardrails: caps, cooldowns, pausingpausingTemporarily halting token transfers or protocol operations via admin roles for safety.View glossary entry, change management, and what users can do to protect themselves.
How‑to (overview)
Open coverage. Choose a covered protocol/market, enter the coverage amount, review the live premium rate and terms, post the required collateralcollateralAssets allowed as collateral and the maximum per‑asset size configured to manage concentration and risk.View glossary entry, and open. Premiums accrue only while the position is active. You can increase, decrease, or close coverage at any time.
Provide capital. Deposit USDCUSDCStablecoins accepted in PCA contributions and used across products; each has distinct risk/peg mechanics.View glossary entry to the insurance poolinsurance poolA capital pool that backs exploit coverage; buyers pay usage‑based premiums, and providers accrue yield from those premiums. Claims depend on event verification.View glossary entry to receive the pool token (FT_exploit_insurance). Your share of premiums accrues automatically to the pool's assets. You may withdraw, subject to utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry and any configured cooldown.
File a claim. If an incident occurs, the UIUIThe visual interface through which users interact with an app or product.View glossary entry shows the verification status. Once the oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry confirms the event, submit your claim: present your active coverage for the incident window and claim 1:1 from the pool up to your covered amount.
FAQs
What counts as an "exploit" or covered event?
Each market defines its scope (affected contracts, chains, thresholds, time window). The oracleoracleExternal feed of asset prices. Flying Tulip futures derive pricing/settlement from in‑house trading activity to avoid oracle lag/manipulation.View glossary entry confirms whether the incident meets that scope before settlement opens.
Do I pay premiums even if there's no incident?
Yes, premiums are pay‑as‑you‑go while coverage is active. If no incident occurs, you can close coverage and stop paying immediately.
Can providers lose principal?
Yes, if a verified event triggers payouts, the pool pays claims and its asset balance decreases. Premiums exist to compensate providers for bearing that risk.
How are premiums set?
Rates respond to utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry, market risk signals, and per‑market policy. High demand or elevated risk → higher rate; fresh capital or calmer conditions → lower rate.
Can I use the same collateralcollateralAssets allowed as collateral and the maximum per‑asset size configured to manage concentration and risk.View glossary entry I use elsewhere?
In the permissioned environment, yes. Cross‑collateralCross‑collateralUsing one deposit as collateral across multiple markets or products simultaneously (e.g., lending, CLOB, futures).View glossary entry lets a single deposit back lending, orders, futures, and insurance coverage simultaneously, subject to health checks.
Where do protocol fees go?
A policy share of premiums is routed to the FT buyback pipeline. When revenue‑funded, those buybacks drive the unlock mechanics (40:40:20) described in the FT docs.
Is coverage transferable?
Coverage positions are account‑bound to avoid moral‑hazard games. Close and reopen if you need to change ownership.
What happens if the pool is highly utilized during a claim?
Withdrawals by providers may be rate‑limited during settlement. Once claims are paid and utilizationutilizationThe share of a pool’s assets that are currently borrowed or in active use.View glossary entry normalizes, withdrawals resume under the usual rules.
Related pages
- FT Spot: price and depth windows that inform risk
- FT Lend: cross‑collateralcross‑collateralUsing one deposit as collateral across multiple markets or products simultaneously (e.g., lending, CLOB, futures).View glossary entry and portfolio health that power insurance positions
- ftUSD: stable settlement currencysettlement currencyftUSD is used as the settlement currency; opt‑in LPs deposit ftUSD to settlement pools and accrue fees.View glossary entry used across markets
- FT Token: token‑first revenue flows and buyback pipeline
- Risks, Security & Audits: platform‑wide risks and operational safeguards
- How‑to Guides: Open/Close Coverage, Provide Capital, File a Claim (coming soon)