Flow Credit Markets (FCM) -- Technical Architecture¶

This page covers the technical architecture of Flow Credit Markets. For the consumer product built on FCM, see Peak Money.

What FCM Is¶

From the FCM Primer:

"Flow Credit Markets (FCM) solves the fundamental dilemma of traditional DeFi lending: capital efficiency vs. liquidation risk. In traditional lending protocols, even simple borrowing is a risky activity where market volatility demands excessive collateral buffers, locking away value that could otherwise be productive. FCM fundamentally inverts this by continuously adjusting your positions, buying and selling investment assets to maintain ideal leverage."

"In simple terms: FCM allows you to increase your returns, while dramatically reducing the risk of liquidation."

FCM is the DeFi primitive that powers all consumer finance products at Dapper. Peak Money is a consumer skin over FCM. Users never interact with FCM directly.

Three Core Components: ALP + FYV + MOET¶

FCM launches with three intertwined systems. From the Primer:

1. Flow Automated Lending Protocol (ALP)¶

"The Flow Automated Lending Protocol (ALP) represents a fundamental advancement in DeFi lending infrastructure, introducing active rebalancing as a superior alternative to traditional liquidation mechanisms. Built on Flow's powerful Scheduled Transactions [SchedTrans], ALP eliminates the reactive liquidation model that has dominated lending protocols, replacing it with proactive position management that preserves user capital and maximizes protocol efficiency."

ALP is the lending layer. It replaces the standard DeFi model (static positions + liquidation bots) with continuous automated rebalancing using Flow's native scheduled transaction capability.

Key distinction from established protocols:

"Established lending protocols often try to improve their capital efficiency by hand-tuning an overwhelmingly large number of parameters, in an attempt to tighten intrinsically large safety margins as much as possible while providing low liquidation probabilities at the same time. However, lending protocols almost universally consider the token balances at the time the user last tuned their positions as a static base line."

"FCM brings a paradigm shift to DeFi investing: FCM considers the ratio of collateral to loan value as a dynamic baseline specified by the user (depending on their risk tolerance), while it dynamically adjusts the token balances automatically based on market conditions."

2. Flow Yield Vaults (FYV)¶

"Flow Yield Vaults (FYV) offers consumers extremely aggressive LTV while protecting their collateral automatically, without the risk or costs of off-chain keepers and third-party providers."

FYV sits on top of ALP. It is the product layer that users (via Peak Money) actually deposit into. FYV manages positions by distinguishing between principal (user's deposited collateral) and investment (yield-bearing assets acquired through leverage).

The rebalancing logic:

"Defensive Rebalancing: In the event of collateral depreciation, the system is programmed to sell investment, rather than the underlying collateral, to pay down debt. This preserves the user's core principal during market downturns."

"Investment Compounding: Conversely, when collateral appreciates, the system detects the improved health factor and automatically reinvests the excess equity, acquiring additional investment to compound returns without manual intervention."

Performance claim from agent-based simulations:

"Our agent-based simulations demonstrate that the active rebalancing by Flow Yield Vaults (FYV) delivers 99.8% cost savings compared to traditional liquidation protocols, with 100% liquidation prevention during historical market stress events (based on five years of BTC hourly price data)."

"Under periods of extreme market stress (50% collateral drawdowns) FYV supported up to 17.5:1 capital efficiency (TVL to Yield Token pools)."

3. MOET (Medium of Exchange Token)¶

"FCM supports asset-agnostic yields through a medium of exchange token: MOET, which lowers costs compared to direct stablecoin borrowing. MOET is backed 1:1 with a basket of reputable stables or minted on top of 125% overcollateralized notional value of established crypto assets (BTC, ETH, FLOW)."

MOET decouples borrowing costs from external stablecoin market dynamics:

"Functioning as a protocol-native settlement layer, MOET decouples borrowing costs from external stablecoin market dynamics. This architecture enables FCM to offer borrowing rates that are structurally lower than market averages, preserving the spread between yield earned and interest paid."

MOET is NOT a user-facing product in V1. From the MSCW doc, MOET minting fees and MOET as a user-facing product are explicitly in the "Won't Have in V1" category.

The Health Factor System¶

The Primer defines the Health Factor as the core algorithmic objective:

"A user's Health Factor is the ratio of their effective collateral to effective debt value."

Where effective collateral = ci * pi * Xi (collateral units x price x collateral factor) and effective debt = dj * pj / Xij (debt units x price / debt factor).

"For a position with health value 1, the risk-adjusted collateral and debt have the same value at that point in time. At health below one, a position is undercollateralized and will be automatically liquidated by the ALP, with just enough collateral being sold to get the position back to a health value greater one."

Tri-Level Health Management (The Zero-Liquidation Design)¶

This is the core innovation. From the Primer:

"For the health factor we define the following three thresholds."

Efficiency Threshold (default: 1.15): When health exceeds this, the position is too conservative. ALP borrows additional yield tokens to move health down toward the target.

Target Health Factor (default: 1.10): The level ALP aims to reach when rebalancing. Set between the efficiency and safety thresholds to avoid rapid oscillation.

Safety Threshold (default: 1.05): When health falls below this, ALP sells yield-bearing assets to repay debt, preemptively reducing liquidation risk.

"This tri-level health management strategy creates a sophisticated early warning and intervention system that prevents positions from reaching critical liquidation zones."

The key insight: instead of liquidation as a crisis event (standard DeFi), FCM treats position management as continuous automated rebalancing. Micro-adjustments happen on a timescale of seconds to minutes via Flow's scheduled transactions.

Automated Rebalancing vs. Traditional Liquidation¶

Standard DeFi (Aave, Compound): User deposits collateral, borrows, and the position is static until the user manually rebalances or gets liquidated by external bots. Liquidation is a catastrophic event -- typically 5-10% penalty on the entire collateral position.

FCM (ALP): Positions are continuously monitored and rebalanced by the protocol itself, using Flow's native scheduled transactions. No external keepers or liquidation bots required.

"The Flow network, with its scheduled transaction feature, is well-equipped to execute the ALP's auto-rebalancing workload. To the best of our knowledge, the Flow blockchain is the only blockchain at the time of writing (Feb 2026) offering the capacity for hundreds of TPS to be scheduled as automatic, virtually time-triggered computation to run natively on-chain."

Scheduled Transactions: Flow's Unique Capability¶

Flow's scheduled transactions (SchedTrans) are the architectural enabler. From the Primer:

"The transaction scheduler runs natively on Flow, similar to the cron daemon on linux. This architecture guarantees atomicity and deterministic responsiveness of FCM to balance and protect user assets even in challenging market conditions."

This is the technical moat. Other chains require off-chain keepers (bots) to trigger rebalancing, which introduces latency, gas competition, and single points of failure. Flow executes rebalancing as scheduled on-chain computation.

Current rebalancing cadence from the MSCW doc: automated rebalancing every 10 minutes with supervisor-based recovery.

V1 Technical Release Plan¶

From the MSCW document:

Must Have (V1)¶

Protocol: - PYUSD0 as collateral for the syWFLOW Flow looping vault (syWFLOW) - FLOW as collateral for the FUSDEV vault - Automated rebalancing every 10 minutes with supervisor-based recovery - Insurance fees 5% collected - Observability: number of positions, TVL, positions health factor

Frontend (vaults.flow.com): - Gated access: connect wallet -> whitelist check -> one-time access code -> dashboard - Support for both Flow Native (FCL) and EVM (MetaMask) wallets - Dashboard: FUSDEV Vault and syWFLOW Vault - $10K per-vault USD deposit cap, remotely configurable without redeployment

Should Have (NOT in V1)¶

WETH and WBTC as additional collateral types
Per-vault expanded view: APY history, yield source explanation, projected earnings
Global activity feed: deposits, withdrawals, yield accrual, protocol events
Three revenue levers via WrapperVault: Vault Performance Fee (performance-only, % based), Early Withdrawal Fee (% based, time decayed), Stability Fee (live at 5%, to be calibrated)

Won't Have in V1¶

MOET minting fee
MOET as a user-facing product

Oracle Architecture¶

From the FCM Q&A, the oracle setup as of launch:

Provider	Flow FVM	Flow EVM	FLOW/USDC
Pyth	No	Yes (30min)	Yes
Band	Yes (1h)	No	Yes
Chainlink	No	No	No

AMM price sources:

Provider	Chain	Liquidity
KittyPunch	EVM	$5M
Uniswap v3	EVM	$3.3M
Increment	FVM	$1.3M

Oracle aggregation uses trimmed average (removing min and max). Oracle spread calculated via Pessimistic Relative Spread. Short-term gradient upper-bounded by governance-defined constant.

Guard rail: 300 bps max DEX-to-oracle deviation guard.

From Q&A: Band oracle is assumed not to abort/panic for V1. Long-term fix involves cached oracle values via scheduled transactions or push-based oracle design.

Audit Status¶

QuantStamp is the auditor (NOT Trail of Bits).

From the MSCW timeline:

Milestone	Date	Status
QuantStamp review of FYV contract begins	Mar 11	Completed
QuantStamp FYV contract review ends	Mar 18	Completed
QuantStamp review of FYV EVM + Flow begins	Mar 18	Completed
QuantStamp review of FYV EVM + Flow ends	Apr 3	Completed

Key Findings from QuantStamp (from Q&A)¶

FLO-7 (Medium, Unresolved at time of Q&A): Minimum Position Balance Invariant Can Be Circumvented via Deposits. The _depositEffectsOnly() path does not validate minimum balance thresholds, allowing dust balances. Recommendation: enforce minimum balance invariant at end of deposit flow.

FLO-9 (Medium, Unresolved at time of Q&A): regenerateDepositCapacity() permanently inflates the depositCapacityCap. The rate-limiting token-bucket model is broken because generated capacity is added to the cap instead of the available capacity. Mitigation: implement absolute hard cap, rename depositCapacityCap for clarity.

Known Technical Risks¶

Risk	Mitigation
Oracle manipulation	300 bps max DEX-to-oracle deviation guard
Band oracle panic blocks protocol	Assumed safe for V1; long-term: cached values via ST
Deposit capacity inflation (FLO-9)	Absolute hard cap to be implemented
Dust balance exploit (FLO-7)	Enforce minimum balance in deposit path
Rebalancer buying more yield tokens on price drop increases risk	Under investigation (flagged by Leo Zhang)
Round-trip swap inefficiency on yield token price increase	Known cost; monitoring planned

From Q&A on rebalancer risk:

"When yield token price drops, the rebalancer will end up buying more yield tokens, which brings more risk to the profile" -- Leo Zhang

"When yield token price increases, there is round trip swap inefficiency that we sell the exceeding yield tokens to convert into collateral, and later buy more yield tokens back after putting the minted MOET to the yield vault." -- Leo Zhang

Contract Architecture¶

From the Q&A, the FYV strategy architecture:

Strategy -- base abstraction
StrategyFactory -- creates strategy instances
StrategyComposer -- composes strategies
StrategyComposerIssuer -- issues composed strategies
FlowYieldVault -- holds a Strategy

Configuration is nested type maps: {Type: {Type: {Type: {String: AnyStruct}}}}

Key contracts: - FlowALPv1.cdc -- core lending protocol - DeFiActions.Autobalancer -- rebalancing logic (being moved to separate contract) - FlowYieldVaults -- vault layer - Wrapper contract with externalCallback handler

Version control for non-upgradeable contracts uses incremental versioning with RC (release candidate) pattern.

User Balance Calculation¶

From the Q&A, the correct balance shown to users:

Balance = CT + (YV - CD) / CP

Where: - CT = Count of collateral tokens - YV = Value of yield tokens (denominated in MOET) - CD = Current debt amount (denominated in MOET) - CP = Current price of the collateral tokens (denominated in MOET)

Launch Phases¶

Phase	Target	Notes
Milestone 0: Internal Testing	Mar 11-18	Contracts live on mainnet. Internal team only. Parallel QuantStamp audit.
Milestone 1: Gated Public Beta	Apr 3 (40% confidence)	Access codes distributed. $10K deposit cap per vault. Two vaults: FUSDEV and USDCf.
Milestone 2: Open Public Launch	TBD	Access gates removed. Deposit caps raised or lifted.

Interest Rate Model¶

From Q&A: the yearly rate is a nominal rate. Compound interest on high nominal rates can produce dramatically different actual rates (e.g., 400% nominal = ~5500% compounded). No code changes required -- this is a documentation/communication concern.

Utilization curve: 0% simple curve currently for WBTC, WETH, WFLOW. MOET utilization curve TBD.

Utilization function (proposed): - liquidity = reserves[token].balance (tokens available to borrow) - debtOutstanding = sum of true debit balances across all positions - utilization = debtOutstanding / (liquidity + debtOutstanding)