Cork has raised $5.5M to build the missing tokenized risk infrastructure for digital assets. Led by @RoadCapMgmt and @a16zcrypto CSX, Cork has raised from investors who recognize the market opportunity of introducing tokenized risk into the digital asset ecosystem.

The same dollar of collateral can back a position on one protocol, get wrapped into a receipt token, and back a second position on an entirely different protocol. Neither protocol is wrong about what it's holding. They're just both betting the other one never gets called at the same time.

"If we had built mortgage-backed securities onchain, 2008 never happens." @Philfog sat down with @TheCryptoMavs to unpack why risk management may be one of the biggest missing pieces in onchain finance.

"Instant withdrawal" is true for exactly as long as you're the only one asking. The morning everyone asks at once, instant just meant first. A protocol that promises instant withdrawals isn't false, it's just describing a pool of available liquidity ready to pay whoever shows up.

Leverage doesn't create risk, it just changes the deadline. An asset can fall 20% over two years and most people holding it outright never feel forced to act, they simply wait. The same 20%, arriving in a single bad week on a leveraged position doesn't leave time to wait. Same risk, same size, wildly different amount of time to respond to it.

A protocol with $10B in TVL and one whale in a loop position doesn't have $10B in liquidity. It has one large, leveraged bet wearing a big number. Loop a position five times and you haven't just multiplied your reported TVL. You've multiplied your exposure to the same underlying asset breaking at every layer.

There's no such thing as a risk-free rate onchain. There's just a rate where the risk hasn't shown up yet. Price it before it does.

Ten tokens, ten different names, ten different logos. If they all redeem into the same underlying asset, they're not ten different risks. That's one risk, split across ten tickers.

A risk market needs two people who disagree. Example: One side holds a yield bearing asset and would pay to stop being exposed to it breaking its peg. The other thinks the peg holds and will take money to carry that risk. Cork puts both in the same market and gives each side a token. The protected side holds cPT, the underwriting side holds cST, and either can sell their position before the term ends rather than waiting it out. The premium is whatever the two of them agree the risk is worth.

Four significant model releases in a week, and the interesting part is how differently they trade off. Fable 5.1 is still the best coder. I run it on low, which now feels comparable to the previous version at max. Astra is stronger at reasoning and planning and weaker at code, so it gets everything that is not code. Cheaper than Fable and about as fast. Gemini Flash is around 100x cheaper and roughly on par with Opus 5, and it is the first Google model I would actually reach for. Muse is in the same class on speed and price. Knowing which model to point at which job has become its own skill.

"The gap is the invariant you forgot to write down. That is what a hacker goes looking for." @Pybast on what "formally verified" actually tells you. It is a real guarantee and a narrow one. A team specifies the rules that must always hold, the code becomes mathematics, and those rules are proven across every possible state rather than the states someone sampled. Anything not on the list is not covered by anything. So when a protocol tells you it is verified, the useful follow up is what they proved, not whether they proved it.

"You tell it that it cheated, and then it says it cannot reproduce it. So there was no issue." @Pybast on a small ritual that has become part of reviewing code at Cork. When someone suspects a bug, the fastest way to find out is to ask the model to attack it. Write the code that actually steals the money. If the theft works, the bug is real, and reading a short attack is much quicker than reading the whole system again to look for it. The catch is that the model wants to succeed. So it sometimes writes an attack that only works because it handed itself a starting position the real system would never give it. A cheat, essentially, in service of a good answer. You point it out, it tries again properly, and nothing happens, which tells you the bug was never there.

Some of what we look at does not belong on a public timeline. The failure post-mortems, the positions nobody wants named, the pricing work that only makes sense at length. That goes to the newsletter. Link below. cork-research.beehiiv.com/p/…

A loop works exactly the way it sounds. You deposit a yield bearing asset, borrow against it, use the proceeds to buy more of the same asset, and repeat. Each turn increases the exposure supported by the same initial capital. That raises the potential yield, while also making every price move in the underlying asset matter more as well. The entire position rests on the asset keeping a stable price. After several loops, even a modest depeg can produce a much larger loss on capital, weaken the collateral, and push the position towards liquidation. Protected Loops add coverage when the position is created. Depeg protection becomes part of the overall yield strategy from the very outset, not treated as a separate transaction to manage. The looping mechanics stay the same; the consequences change.

“Instant liquidity” means something different depending who you talk to. In traditional markets, T-0 or even T-1 (i.e. same-day or next-day settlement) is considered instant liquidity. Onchain, it means settlement in a matter of seconds. This is a gap onchain finance needs to address. The use cases that people want from the assets moving onchain today require much more liquidity than those assets necessarily bring with them. No one is pricing liquidity risk right now. The market needs a mechanism to charge a known liquidity premium to truly enable these offchain assets to function optimally onchain.

A billion dollar liquidity facility can be pulled at any moment. Nothing stops it. @Philfog on the latest Code to C-suite podcast. The facility stands ready to buy the asset at a known price whenever holders want out, and lending markets get built against it on that basis. Nobody contracts for the facility leaving, which it can do exactly when everyone needs it. The commitment lives in a relationship, not in code. Cork puts it inside the contract.