Samed Düzçay：在 Tori Finance 获取机构级收益策略

Today, we have Samed Düzçay from Tory, myself, Yan, and Can from Delphi Ventures. Tory is a yield protocol that brings institutional-grade delta-neutral strategies on-chain, starting with dollar-hedged carry trades in emerging markets. It’s important to note that Delphi Ventures is a lead investor in Tory, so we wanted to get that out there immediately.

To kick things off, I’d love to learn about Samed. Tell us a bit more about yourself and walk us through the journey that brought you to building Tory Finance. What gaps did you see in the market that made Tory worth building?

Sure, happy to. I’m Sam, founder of Tory. My path here has been a winding one, so let me give you the short version. I was actually mining Bitcoin as a kid, when it was still under $10. No, I wasn’t smarter or patient enough to hold any of it, so I wasn’t one of those crazy stories you’ve heard online, where people found thousands of Bitcoins on a USB stick somewhere and became crazy rich overnight. I wasn’t any of that, but I’ll be making peace with it for the rest of my life.

That was my real first experience with crypto. Fast-forward to university: I spent a summer in Zurich at Google, and my roommate at the time was writing Solidity contracts for companies. If I remember correctly, it was for an insurance company. This was around 2017, so still pretty early days. DeFi was really just at the beginning of its, let’s say, run-up. That’s when I got properly introduced to Ethereum and basically the whole DeFi scene.

I thought it was super interesting, but honestly, my real passion back then was software, and software as a service specifically. I wanted to build a software company, so that’s what I did. I worked at companies of very different sizes, from small startups to giants like Google and many others in Europe and the United States. Eventually, I built my own company. It was a software-as-a-service company, and I sold it to BtcTurk, the biggest crypto exchange in Turkey.

That whole journey—going through COVID, multiple wars, market crashes, and still managing to exit successfully on the other side—was a pretty unique experience and taught me a lot, honestly. It was really only after 2020 that I got serious about crypto. Since then, DeFi has been a huge part of my day-to-day. I’ve invested in and been a part of many protocols as an angel, as an early LP, and as a regular user sometimes—farming yield, farming points, basically everything you can do in DeFi. Some failed literally miserably, while others became giants, as we all know today.

1. The yield gap: Why recycling crypto-native capital isn't enough

Basically, for the better part of the last decade, I’ve been sitting at the intersection of both TradFi and crypto, managing sizable capital at both ends of the table. That’s me, basically, and the Tory piece comes from what I kept noticing while doing all of that. Stablecoins are now a multihundred-billion-dollar market—more than $300 billion today—but the yield most holders earn on-chain is frankly pretty commodity-like, even below risk-free these days. It’s mostly 4% lending and LP positions that recycle crypto-native capital, with basically nothing new coming on-chain.

Meanwhile, in the real world, especially in fixed-income strategies, there are whole categories of yield strategies running at high-single-digit to mid-teen percentages that have funded many pension funds, private banks, sovereign funds, and so on. This is a huge market, and it’s completely gated off from anyone outside private wealth management and basically the institutions with the highest amount of capital on their balance sheets. The carry trade is the cleanest example of all that. It’s been around for maybe more than 50 years, scales to literally hundreds of billions of dollars, and is basically inaccessible unless you have an 8- to 9-figure account at a top-tier global bank or happen to be in the right place with the right infrastructure at the right time, which is generally hard to build because the majority of these markets are very hard to access.

We asked the obvious question: Can we package this institutional-grade execution, hedge it back to USD, basically remove the local-currency risk, and bring it on-chain in a way that’s actually transparent and verifiable? That’s basically Tory.

2. Carry Trade 101: Borrowing low, lending high

Thanks for the overview, Sam. When I mention Tory to my friends, the number one question I hear is basically, where does the yield come from? It’s the famous question now for anyone bridging TradFi to DeFi. I want to ask that of you, but maybe first, for those unfamiliar, if you could explain what a carry trade even is in the first place, that would be helpful. Then, please explain where the yield comes from.

Very good question, actually. Let’s start at the very basics, because this is where a lot of people get lost. The core strategy is the global carry trade, right? What is a carry trade? In its simplest form, you borrow a currency where the rates are low—for example, the U.S. dollar—and lend or invest in a currency where the rates are higher, usually emerging-market currencies. Think of the Turkish lira, the Egyptian pound, and others. The difference between those rates is your yield.

Assume there’s a currency that gets you 40% a year—in this case, the Turkish lira—or assume 20% to 25%, as with the Egyptian pound. On the other hand, assume a developed-market currency like the U.S. dollar, where you earn 4%. The yield differential from that is the yield you get. That’s basically a carry trade. It’s one of the oldest and most studied trades in global finance, and it’s been around for more than 50 years. It’s not something exotic. Obviously, there are lots of other questions, but I’ll let you go on with that.

3. Covered Interest Parity (CIP) and why spreads still exist

Yeah, I mean, the follow-up would be: You mentioned these carry trades are being hedged back to dollars, so you’re not taking FX risk here. The natural question sophisticated listeners would have is: If you’re hedging to USD, why does the spread exist? In theory, the reason you have a higher rate is that you’re taking the risk of this higher-risk currency, right? So why doesn’t the hedge eat out the spread, basically?

Yes, that’s basic financial theory. Let’s call it covered interest parity, or CIP. In a perfectly efficient market, yes, it should, and it does. In developed markets around the world, there is no spread between those rates, and if there is a spread, that’s basically credit risk, which is something you take. But in reality, in these markets on the ground, it’s a very different environment.

First of all, there’s a really high entry barrier into these local markets. You can’t easily get in and get out. Getting in is a huge thing, basically: You have to go through all the regulation, banking requirements, tax IDs, and everything, so it’s very hard. Central banks in a lot of these places actively manage FX and local rates as a policy tool. They actively participate in the market using their own reserves, set rules that limit who can play offshore and sometimes onshore, and shape how local liquidity is priced. The FX forward curve isn’t always set by pure arbitrage, so it’s not like the FX hedge eats into the whole yield.

On top of that, in many of these jurisdictions, most natural participants don’t hedge their currency exposure because it’s not the smartest thing to do. Personally, I’ve been participating in these markets for the good part of the last 5 to 10 years, and I’ve almost never hedged my local-currency exposure because, risk-reward-wise, it doesn’t make sense for me personally. The locals and most local institutions—even most global institutions—don’t either. That’s actually the better strategy, right? If you don’t hedge your currency exposure, you’re getting 5 to 6 times more yield sometimes, even 7 times more yield. And since the central bank actively controls the market, actively sets rates, and uses the tools at its hand, you’re basically better off by not hedging. There is really no reason for a local participant to pay to hedge. Sometimes they literally can’t even do it.

That means the buy side of the FX forwards is structurally thin, right? Nobody’s really bidding for them. The result is that even after fully hedging back to USD, a meaningful spread still survives. In practice, over the last 5 years, we’ve seen anywhere from 3%—for example, after the Iran war started a month ago, it went down to 3% to 4% levels—but up to 18% to 20% yield levels. Overall, it’s a very volatile, very changing, living market, but the rates are again very profitable over the longer term.

4. Security of the hedge: Counterparty risk and credit risk

The opportunity exists because the FX hedging market is structurally inefficient in the places that we operate, and that’s not a temporary thing. It’s a function of how monetary policy and these central banks are run in these markets, which doesn’t change overnight.

Yeah, and just to close the loop on the position itself, it would be worth touching on the security of the hedge, right? If we’re saying that the position exists and you’re not worried about the local currency falling out on you because of the hedge...

So, then naturally, the next key point becomes the hedge. Can we just touch on that component and the safety that exists in it?

Overall, the counterparties that you work with are multihundred-billion-dollar banks, both local and global. Think of the biggest banks in the local jurisdictions, and globally, think of banks like JPMorgan. There are multiple large institutions already in these markets, already running these trades at up to $10 billion, $20 billion, $30 billion, $40 billion, or $50 billion levels.

The counterparties you work with aren’t the smaller players managing hundreds of millions of dollars. Here, they manage tens of billions of dollars. On the OTC side, the banks we’re dealing with are pretty huge.

There are different markets for hedging operations. There are spot markets, global markets, and local markets. Basically, access here is key. Having access to more and more places brings you both stability and better pricing, which is the real alpha here.

Makes sense. To rehash, you have 2 currencies: 1 that you borrow in, which is lower cost, and 1 that you deposit in, which is higher yield. Typically, that’s the case.

This is the case because these are 2 different currencies. You’re borrowing in a stable one that’s lower risk, so you pay a lower yield—the dollar. You’re borrowing in a risky one that pays a higher yield because the local government is typically trying to help support its price, so the Fed there is paying a high interest rate to support demand for the currency. But the risk is that the currency is weakening.

You need to hedge the currency. That hedge eats into the yield of the higher-risk currency. Then it becomes, “Okay, the security of the hedge is the important part.”

What you’re hedging is the principal, right? In an event where the trade goes south, what goes unhedged is the yield, and that’s okay because it just means there’s a compression in the yield spread. It likely means it’s time to unwind the trade.

5. Tail risk scenarios: How hedged positions survive 30% currency drops

Ultimately, what you want to make sure you’re protecting is the principal. The risk there is to this multihundred-billion-dollar or trillion-dollar-capitalized institution that’s usually supported by the local government and has never really gone under. That’s effectively the credit risk of your hedge, and it’s what gives you comfort in knowing that, at the very least, the principal portion of this exposure will be protected.

Exactly. To add on top of that, when you’re unhedged, obviously the currencies are depreciating. But in tail-risk scenarios—which happen almost every year these days, so I don’t know if it’s wise to call them tail scenarios anymore—the local currencies can depreciate 10% to 20%, or even 30%, overnight.

If you only bring the local currency on-chain without hedging the local-currency risk in these markets, you’re taking a huge risk. The main things DeFi offers are lending, borrowing, and leverage. If you’re onboarding a local currency in that lending market, you’re taking immense risk when it’s unhedged because that currency can literally depreciate 20% to 30% overnight.

That’s 1 of the reasons it’s wiser to tokenize and bring something on-chain when it’s completely hedged, especially in markets like these. As you said, the credit risk you’re taking is minimal because you’re dealing with banks that have been around not just for decades, but for 50 or 100 years.

As you said, even if something happens, the governments usually bail them out because these institutions are so large that 1 of them going down affects the whole economy—not just that market, but the global economy. In a very, very, very tail-risk scenario, like Credit Suisse or Silicon Valley Bank, it’s better to float them back up rather than let them die and go under.

Even in that scenario, even if the worst case happens, in our case we’re dealing not with cash instruments, but with papers and basically things we can take back from the custodian. Even if the custodian goes down, if the biggest bank in that jurisdiction goes down with our assets on its balance sheet, since we’re dealing with bonds and papers, we can take them back. It’s obviously a very illiquid scenario, and it’s something we definitely don’t want, but even in that scenario, it’s not the end of the world.

Makes sense. Sam, we touched upon the design of the strategy, right? Your goal is basically to stay delta-neutral; you don’t want to take directional risk. You’re also hedging these positions, so you’re not taking FX risk.

6. Execution Mandates: Why Tori separates design from implementation

But it’s 1 thing to target this as a design principle and another thing to implement it. Could you give us some insight into how you’re executing these trades—the actual execution of the trades—and give us more insight into your implementation? Poor-quality execution can mean you have these targets but don’t necessarily achieve them.

Exactly. It’s a very good question—the right question to ask. I want to draw a line there. The way to think about it is that it’s actually hybrid.

Tory is a strategy manager, right? Tory brings something that’s off-chain and brings it on-chain. Tory defines the mandate and the risk parameters, defines what it tokenizes, and defines the trades that are in scope. But the execution isn’t done by Tory. The execution runs through institutional execution desks in each of these markets.

Assume a market in Turkey, Egypt, or any part of the world. The execution is done by a team that’s regulated and, in many cases, state-backed or partnered with the leading institutions—all the pension funds and all the other banks in their local jurisdictions. They’re doing billions in volume, they work with premier global banks, and they have multidecade track records—more than 20 or 30 years. They also have more than $10 billion or $20 billion in assets under management.

1 of our partners, for example, has more than 25 years of experience executing similar strategies for pension funds and trust funds. These execution desks operate strictly under our mandate, so they cannot deviate. They execute what Tory prescribes and basically nothing else.

Why this structure? There’s a clear distinction between strategy design and execution. As you said, on paper you can design a perfectly delta-neutral strategy with no FX risk, no crypto beta, no market risk, and nothing directional. But design and implementation aren’t the same thing.

A strategy can be market-neutral and delta-neutral on paper, but still deliver some kind of directional risk in practice if the hedge is imperfect or if the execution isn’t done correctly. Assume, for example, that you off-ramp USD to your local account, and it sits there in the local currency for a day or 2. Overnight, something happens. That’s something that can happen if a team isn’t executing properly.

So, we separate the 2. Tory defines the strategy, and institutions that have been running these same strategies for decades, whose core competency is execution, do the execution. We pay a fee for that, but it’s minimal. The trade-off is that the fee we’re paying is exchanged for the safest possible execution.

We could trade everything ourselves, but we choose not to because there’s no world in which our internal execution is going to beat a desk that’s been doing this for the last 30 years, with hundreds of people on its trading team.

That’s also something I want to make really clear: this isn’t the same as Tory sending money to a fund manager and hoping for the best. That’s something that has failed multiple times in the past. I don’t want to give names, but people know what protocols they are, and that’s not what we do.

Our partners execute under the same tight constraints, with full reporting, defined risk limits, and no discretion outside the mandate. Overall, they do what we say, and only what we say, but they do it with a team that’s been doing this for decades.

Nice. That seems like a sensible trade-off, right? You’re paying a fee to these execution desks to execute the trades on your behalf. You’re setting the mandate and keeping track of the trades, but you’re not trying to do this yourself, where a hedge could be imperfect or there could be deviations from the strategy.

It only makes sense. I think it’s a very sensible trade-off.

Exactly. Paying 20 or 30 bps, or something similar, a year to have perfect execution is a trade-off that everyone in the industry should make, to be honest.

Yeah. And we’ve seen that it’s failed when people or teams haven’t done that in the past.

Yeah, no, it makes sense. I think throughout the pod, and just from the perspective of listeners, both generally and more acutely based on things that have taken place over the past couple of months with exploits and stuff like that, the natural questions people want to ask are how this is put on, why this exists, and where the true opportunity is coming from. I think just getting to that part would be good.

7. The "Access Edge": Why you need an 8-9 figure balance sheet to play

And then, in terms of whether this yield exists because of a situation that you guys have found, is it an edge, or is it accessibility? Is it a combination of all of the above, or maybe something else? We’d love to give people a better understanding of why this yield exists, because naturally, at the moment, people are looking for it in crypto in particular because there isn’t much. Whenever it does exist, people are naturally skeptical because they think that there’s potentially unaccounted-for or hidden risk that isn’t clearly reflected, but that’s what allows the yield to be where it is.

The edge is really access, not really something else. It’s mostly access. The trade itself isn’t proprietary. Any institutional LP doing serious diligence can see exactly how it works. The hard part is actually getting into these markets as foreign capital.

Think about what’s involved operationally. You need a local bank account in each jurisdiction. You need custody arrangements, tax IDs, regulatory clearances, and KYC/KYB documentation that gets reviewed locally and very diligently. You’re looking at months, or sometimes even years, to onboard into each of these markets. Realistically, to be taken seriously by the top-tier desks, you basically need a nice balance sheet. Think of JPM or others: you’ll need at least an 8- to 9-figure balance sheet just to sit at the table.

Even once you do get in, there’s a second layer, which is pricing. The big counterparties capture most of the spread. If the gross opportunity is 8% to 9%, a smaller player might walk away with 5% or 6%. That’s what happens when you work with a PB, like a prime broker, globally.

If you’re trying to run this trade from Europe or the US, where you don’t have any direct local market access, for the same underlying and the same everything, you basically get 5% or 6%, whereas in reality, if you had direct market access, you could get 8%, 9%, or even better rates. So, that’s 30% to 40% less yield for the same thing.

The edge here is structural. We have direct market access in each jurisdiction that we operate in, plus multiple lines across different counterparties. Because we have multiple lines, we can shop rates day by day and capture more of that spread for the same underlying. One desk on a given day can give you a much better price than another desk, and it could be reversed the next day. Access and having different options is the real edge here.

The OTC desks give bigger players better pricing precisely because of the volume that they put through them. Access plus volume gets you better economics than a typical participant, especially one trying to access these markets from global jurisdictions rather than from the direct market itself.

8. Tokenomics: The two-token model (T-R-U-S-T and receipt tokens)

Yeah. Access and volume—abstracting all of that away from the end user—that all makes sense. In an alternative world, you could have just as well operated this as a traditional fund structure, but you didn’t do that, right? You also tokenized these positions and put them on-chain. Could you walk us through the benefits of tokenizing here? Where does the on-chain part come into play, and how does it benefit the whole project?

That’s also a very good question because the tokenization piece is where everything compounds. Building up from scratch, Tory has 2 tokens. The first one is what you get when you deposit USDC or USDT. Think of it as a synthetic dollar product that represents $1 on-chain and is redeemable. The second one is what you get when you stake the first token. Staking is what earns you the yield.

The basic flow is: you put in USDC or USDT, mint the receipt token, which is tRSD, stake it, and earn yield. Four steps, very easy.

What tokenization unlocks is that the staked token is liquid and composable. You can take it to a lending market and use it as collateral, borrow USDT, USDC, or any other stablecoin available from the lending market, deposit that back into Tory, stake again, and basically loop it. You can repeat that several times. That’s basic lending-market principles on-chain.

When you put the numbers on it, let’s say the DeFi borrow rate is 5% and the staked token is yielding 10%. You’re taking a carry trade from global markets, literally a traditional market, which gets you 10%. You put it on-chain and get another carry trade from the on-chain component itself. So, there’s a 5% to 6% yield differential on-chain. Each loop captures 5% to 6% more. Loop it a few times, and your effective yield goes above 20%, 30%, or even 40%, after accounting for the borrow costs and the yield itself.

A traditional fund structure literally cannot do this because most of these assets—money-market instruments—aren’t able to be collateralized in traditional markets. You can’t take, for example, an LP interest in a hedge fund or somewhere else and use it as collateral to get a loan against it. You’re locked into redemption windows and regulatory requirements, and that’s the yield you get: 9% to 10%. That’s it. You can’t compose it. You can’t do anything with it.

There are some trade-offs. By design, our oracle is going to be priced at NAV, not at market price. There’s no cascading liquidation risk from a market depeg because these things can depeg on-chain. Anyone can manipulate the price on-chain if they have enough stake, bring the price down, and use it to their own advantage. That won’t be possible with Tory because we use NAV pricing in the oracle itself.

9. NAV Oracles vs. DEX Market Price: Preventing debt spirals

That’s really important because if the underlying yield ever dropped below the borrow rate—which is again unlikely for structural reasons—users would have to unloop. Each unloop step normally takes 7 days to unstake the staked token, stRSD. Loops are a tool for sophisticated users who understand the timing and the secondary-market pricing dynamics.

One last thing to mention is that Tory does not take leverage internally. The protocol itself is completely unlevered. The yields you get are from unlevered money-market instruments and FX forwards, basically hedged money-market rates. The looping itself on-chain is a user choice, not the protocol’s choice. We don’t take any leverage on behalf of anyone or in the protocol itself. The tools are there for users to take advantage of at their own will and within their own risk frameworks.

Yeah, just to reiterate why the 2 are so synergistic, aside from the economics: you’re combining 2 products. On one hand, it’s access to the highest-tier institutions to put on a trade that’s usually gatekept by a combination of relationships and capital. On the crypto side, the tokenization component enables a utility that was previously completely unavailable to those putting on the trade in TradFi.

That means if you are putting on the trade in TradFi, you have a better setup to do it if you pivot that money to crypto. So, it’s not just about access. It’s actually improving an existing, very large market, which makes it very attractive.

In particular, because the crypto component can be so yield-enhancing, when you’re building the TradFi component, you can opt for the safest and most rigid structure, which potentially might be paying a slightly lower yield than someone putting on the trade in a slightly riskier way. It makes sense for you to do that because you can enhance your yield via crypto.

You get to take the best part of the TradFi setup—the most trusted, longest-standing, most durable setup for it—and then use the crypto component to take on no additional TradFi risk while enhancing the crypto yield.

Then, on the crypto side, the NAV component is really the big one. When you see a lot of these unwinds, it’s because the assets are priced based on the DeFi price in crypto, and that is manipulatable by a large sell, like you mentioned. Whereas if it’s based on NAV, the NAV price reflects the hedge.

The amount that the NAV price can go down is very gradual. If there’s a world where there’s a negative yield, then, with a small negative yield, the amount it goes down by each day is the yield divided by 365. What that means is that you don’t have these large, one-off down marks in price, and that’s what you’re really afraid of.

And so, what that allows you to do is take on even a modest amount of leverage, where you still need this insane event that’s basically never happened on a hedged position to take place for there to be an unwind. You can actually enhance your risk pretty materially, and everyone can take on their own amount of risk, right? In the end, if everyone has taken on a certain degree of leverage and the price comes down, you’re not taking on any additional market risk from anyone else’s leverage because, in the world where they unwind, that will never force your position to unwind.

So, when you’re taking on leverage, all you need to think about is the NAV price coming down, not some liquidation cascade. I think that gives people isolated exposure to the risk, and it makes it a much more comfortable position. The idea is you can borrow, and your collateral is this dollar-hedged position that can only go down gradually when there’s a negative yield. You borrow in a much cheaper currency, and you’re basically putting on a second carry trade in crypto where you’re borrowing in cheaper USDC to deposit in higher-yielding Tory.

Yeah, [laughter] I feel like—yeah. Nice. Exactly. You explained it better than me, to be honest.

No, not at all. Appreciate it, yeah. And so, you know, go ahead.

Yeah, I wanted to also shift gears a bit to transparency and auditability. When we were due diligencing you, I think a big question in our heads was that there are lots of operations happening off-chain. How are people going to feel comfortable depositing into this?

10. Transparency: Real-time on-chain balance sheets via Accountable

I want to give you an opportunity to explain some of the things you’re doing on that front. You’re abstracting a lot away, right? But in doing so, that requires a bit more trust in the Tory structure. How transparent can you be? What can users verify through Tory in real time, and what part still requires trust in Tory and its counterparties? It would be helpful to walk us through that.

This is one of the most important things in the infrastructure, as you said, because this is something off-chain and we are bringing it on-chain. We have to make it very transparent and visible, and as close to real time as possible. That’s something we’ve worked on heavily.

We’re going to be working with Accountable. Accountable is a third-party attestation provider that is fully independent. They run a server in a trusted execution environment that literally no one can touch—not the Tory team, not the Accountable team, not the infrastructure provider, literally no one. That server has direct access to all of Tory’s custodian bank accounts and asset balances across every venue that Tory operates in, either off-chain or on-chain; it doesn’t matter.

In real time, Accountable fetches balances from every source, on-chain and off-chain, and constructs an on-chain balance sheet. They use zero-knowledge proofs, so the underlying position data is privacy-preserving while the aggregate is fully verifiable on-chain. The strategy overviews and breakdowns, the collateral, all the liabilities—which is also very important—and basically everything off-chain, not the tradable details, but anything beyond that, is fully transparent on-chain.

What does that mean for users? Anyone—the team, investors, users, everyone—can verify in real time on-chain that reserves match liabilities dollar for dollar and that the hedging ratio is correct. Positions are genuinely delta-neutral. The system genuinely doesn’t take local-currency risk or any kind of market-directional risk. Off-chain positions are reflected on-chain, so there is no off-balance-sheet risk. We’re not, for example, getting a loan from someone we’re not telling anyone about.

This isn’t a weekly snapshot, monthly snapshot, or quarterly attestation. It’s continuous, real-time, very verifiable, and on-chain. What still requires trust? The strategy execution itself. You’re trusting that our mandate is being followed, that our counterparty selection is sound, and that our risk parameters are being respected.

We mitigate all of that by working with regulated institutions with more than 20 or 30 years of track records, limiting any single counterparty’s exposure, and making it all subject to a policy. The execution layer is where trust lives, but that’s true of any RWA product that you may interact with on-chain or even off-chain; it doesn’t matter.

The Accountable part is a really big thing, and that’s why I think most products these days are more focused on off-chain strategies, because there aren’t many opportunities that still remain on-chain. Accountable and similar solutions are going to be a very big thing going forward. Without that layer, on-chain RWA yield is just trust-me-bro tech. With it, you can verify the things that matter and limit trust to the things that you actually have to trust. It’s a perfect solution for products like Tory.

11. Unwinding scenarios: Fixed yields vs. new capital risk

Makes sense. Appreciate it. Since we have some historical precedent on these carry trades, if we get comfortable around some of the other risks, the other natural one is how these trades typically play out and where the risks are in the scenarios when they inevitably begin to unwind and the position is no longer appealing.

There are different drawdowns in different scenarios where a drawdown might or might not happen. When a carry trade unwinds, if you’re unhedged, obviously you’re taking a drawdown. You’re taking a loss on the carry trade itself because people will be fleeing the local currency, the local currency will depreciate, and you’re going to take a loss.

That’s what happens when you’re running the trade unhedged. That’s the risk people take for the higher yield. Again, to give you an example, in Turkey you might get these days, like, 45% APY yearly, right? If you’re running it unhedged, in U.S. dollar terms that could be 15% or 20%, depending on the inflation and TRY depreciation. But that’s the risk you take. If someday a war happens, a policy changes, or something else happens, you can lose 20%, 30%, or 40% of your money overnight.

It has happened in the past. We’ve seen events where the currency has depreciated more than 20% or 30% overnight, and if you’re unhedged, you basically take that loss. But when you’re hedged, you’re basically not taking any loss on the local-currency side because, on the nominal side, if your currency depreciates, your forward—your hedging instrument’s price—basically increases at the same rate.

You are delta-neutral. When you’re taking a position and taking an inverse position on the other side, if one of them appreciates in price, the other one depreciates. By structurally building a position like that, you eliminate that risk.

What happens in that scenario to products like Tory, where the market risks aren’t there and the instruments are hedged? You’re only taking a risk on the future capital and on that capital’s yield—not the yield if you have fixed it. When you enter a position, you fix the yield.

Assume you buy a fixed-income instrument, like a government bond, that gives you 20%, and assume you buy a forward that hedges that local-currency exposure, which is tenor-matched, so they’re expiring at the same time. Assume they’re both expiring in 3 months, and assume that costs you 5% or 10% for the year. So, there’s a 10% differential. That 10% yield is what you get over the next 3 months, no matter what.

If, for whatever reason, something happens in those 3 months—the currency depreciates, the yield spread changes, forward instruments’ prices go up, or the local yield goes down—you don’t care. The yield is fixed for you, and you get that rate for the next 3 months. But any new capital that you put in carries a risk on the yield side. The yield might be lower or higher; it’s a volatile market condition.

If you’re hedged, you’re not taking a risk on the capital you put in. Your only risk is on the new capital and on the yield side of things, which might narrow or go down. It might go from 8%, 9%, or 10% down to 3% or 4% in tail scenarios, like when wars start, but it might also go up. If the market is better than it was in the past, or if the central bank changes its policy and increases interest rates, then it might go up to 12%, 13%, 14%, or even 15%, which happened over the last few years.

Yeah, that delta part, I think, is the really important part. Using just round numbers, if you use $10 to borrow 100 Turkish lira, your forward contract is just saying, “I get to sell this 100 Turkish lira at this predetermined price.” So, if the Turkish lira nukes, your forward, like you said, increases in value at the same rate as your Turkish lira position depreciates. Those 2 offset, and all you’re really losing out on is the yield portion.

These forward contracts are extremely liquid, right? So, in a world where the yield is really coming down and it’s just not an attractive position to have, but your hedge is still going to last for another month and a half, you have the ability to exit both positions because they are incredibly liquid, and you don’t have to be in a position where you are taking on negative yield. So, you have maximum flexibility in that situation.

Exactly. Once you buy the instruments, you fix the yield, basically.

So, you’re not taking any negative-yield risk for the duration of that instrument. When the market is at a negative yield, for whatever reason it might be—which doesn’t happen that often—it’s a very, very, very tail scenario. But in that scenario, you just won’t enter the position. You always have eurobonds; you always have US T-bills. So, there are always other options to fall back on.

That’s also why it matters to be flexible and be a multistrategy company where you’re not depending on a single country, a single asset, or a single strategy, but you have fallbacks that you can depend on. That’s also something important which we haven’t mentioned, but after the question, I think it made sense to explain. But yes, exactly as you said. The only risk you take is for the new capital, and on the new capital, you’re fixing the yield, basically, and not the capital itself. Yeah.

12. Lessons from Drift, Resolve, and AU hacks

Sam, I also want to get your thoughts on recent DeFi hacks, which made for a very scary few weeks for a lot of people. It started with—I forgot the order—but basically, Drift and Resolv were hacked, and very recently Cap DAO was hacked. In total, those 3, I think, account for more than $600 million.

Somewhere around that, yeah. Yeah, of a loss. Do you have any lessons learned from them, and how are you thinking about security at Tory in the face of all of this?

Yeah. There are lots of lessons learned, not just for Tory, but for many products and protocols on-chain. That should be a wake-up call for the whole industry, because all 3 products had passed audits. My takeaway from that, which I wrote publicly about, is that audits check only the contract logic. They don’t check key management, signers, infrastructure, or whatever you built on top of those contracts.

Both Drift, Resolv, and afterwards Cap DAO failed on the operational layers, not on the contract layers. How do we do things differently? I don’t want to obviously compare any protocol or say that any protocol is superior to another, but I just want to explain what Tory does.

Our minting contract enforces 1-to-1 collateralization, so you can’t mint an unbacked token even if you control any of the keys. The contract will simply not allow you. I can give you all my private keys, all the signers, everything, and then you can go to the contract and you won’t be able to mint a single TRYSD that’s not backed by 1 USDC, USDT, or any other accepted collateral.

On top of that, every contract upgrade goes through a timelock that is currently 24 hours, which might be increased in the future, and there’s no fast path. So, that’s the Drift scenario. Drift’s multisig signers were exploited. I don’t want to go into details, but the hackers got access to those signers, made a malicious update to the software, and were then able to manipulate the markets and get more than hundreds of millions. That’s what happened.

With the Resolv case, the issue was basically that you were able to mint unbacked tokens if you had the right access. So, that’s a structural thing, not a contract-level thing, but that’s usually something operational that audits don’t cover. They check it, but they don’t basically penalize you for it.

Also, we enforce least privilege at the role level. The minter can only mint, the pauser can only pause, and the upgrader can only upgrade. So, there’s no super-admin kind of thing that does everything. Compromising a single role is bounded by that role’s abilities. That decreases the blast radius if something were to happen.

In our case, on the contract level, everything is limited. Any person, even the team, can’t do much, but in any case, if something is exploited, if something is out there, then the blast radius is as low as possible. Off-chain, it’s 2FA on everything, no single person with access to anything, no stale credentials, and multiparty production infrastructure. We’re doing whatever we can to protect that off-chain infrastructure as well.

On the on-chain side, we’ve been audited by Sherlock and Nethermind—maybe the top 2 teams out of 5 or 10. The Nethermind audit and the Sherlock audit are both public in our documentation. We will have a $1 million bug bounty, which is probably going to help with some of the hacks as well.

No system is unbreakable. There’s always a way to break systems. The goal is just to make it as hard as possible. The difference between Tory and what we saw in those exploits is simply layers. We added the layers that audits usually don’t cover: timelocks, monitoring, scoped roles, hygiene both off-chain and on-chain, and limits on everything.

Again, for example, in the last hack, Cap DAO had no limits on the bridge side. It was protected by a wallet with 1 signer. Again, that’s something operational. I don’t want to go into details on that, but overall, putting limits and scoping everywhere is what you can do. But then again, no system is unbreakable. You can always find something.

Your role as a founder, as an engineer, is just to make sure that it’s as hard as possible and, even if something happens, the blast radius is as low as possible. So, always think of when something happens, not if something happens, because it could happen. Your job is to make sure that if it happens—or when it happens—the blast radius is low, it’s not affecting the whole system, and it’s not crashing everything down to 0.

13. Stress Tests: Handling mass exits and secondary market de-pegs

We’ve touched on this briefly before in the context of some other questions, but I think it would be good to discuss it a bit more directly. Naturally, in these protocols, based on what’s been happening recently, stress tests are an important thing to think through. One of them is specific to Tori, and it’s one where you have a lot of people who want to run for the door, whether they want to unstake or sell the asset on the DEX if they don’t want to deal with the unstaking time.

Can you walk us through that stress test and how Tori is set up to deal with it?

Definitely. That’s a very good question to ask. There are different scenarios to that. The first scenario would be the depeg without a drawdown. The setup is that the strategy is fine, there are no losses, but for whatever reason there’s contagion from another protocol, a rumor, or a mass exit, and users want out at once.

Assume 10% or 20% of the users want out and don’t want to wait for the full 7-day period. So, they start selling on DEXs, and the token trades below NAV in the secondary market. What happens? The first thing to understand is that this is a secondary-market event, not a reserve-health event. The reserves are intact, the strategy is intact, and the market price is just decoupled from the peg based on NAV.

Then this really important design choice kicks in. The lending-market oracles for the token check Accountable’s proof-of-reserves data, which is real-time, showing what the reserves are and showing the valuation of the tokens, not the DEX market price. So, collateral valuations on lending markets hold that NAV. There are no cascading liquidations. Recursive borrowing and looping positions are safe precisely because of that. That’s the whole point of pricing off NAV.

Actually, the protocol, the users, and institutional participants can monetize that situation, that dislocation. Users can buy the tokens back from the market at a discount, and then they can sell them to the protocol at a profit. That is a primary-secondary-market arb that’s been done in the past by many institutions and many participants. I’ve done it multiple times with different tokens, and that’s something users can benefit from easily. That’s something that anyone can do.

Beyond that, there’s going to be 2% to 3% of TVL active on Tori smart contracts to enable instant redemptions, and there are going to be active credit lines and liquid backstop provisions, again to prevent any secondary-market dislocation like that from happening. But again, there can’t be an infinite amount of money sitting on-chain idly.

So, if that were ever to happen, if a dislocation ever happens, participants can profit from that heavily because the reserves are literally real-time. People can do the math and basically jump in at their own will. Practically, in a market depeg without a loss, the system holds. Lending positions are unaffected, and the protocol and the users can profit a nice amount by buying back the tokens at a discount. Eventually, the arb activity pulls the secondary price back to NAV.

The reason that it matters is that there’s a difference between a controlled event and a death spiral. Most stablecoins, most liquid tokens, fail because of structural failures. They’re like liquidation cascades from market-price oracles. We basically designed the system to limit and minimize that risk as much as possible.

The second scenario—an actual drawdown—is the worst-case scenario, an ugly scenario. The reserves are no longer fully backing what’s been minted. A real loss happened in the underlying, due to some execution or counterparty-default scenario.

14. The Drawdown Protocol: Reserve funds and redemption controls

We have a layered defense. The first line is the reserve fund. We capitalize the reserve fund out of protocol revenues exactly for that purpose. In a small drawdown—say, 20 basis points, 30 basis points, or whatever falls below the reserve fund—the reserve fund absorbs the losses fully, and the protocol reserves remain fully protected. No one ever notices anything or sees anything. Obviously, there’s communication, but the protocol is unaffected.

If the loss exceeds the reserve fund, then the NAV reduces, and that’s reflected in the price of the staked tokens. The user’s principal is impacted only to the extent of the gap. What does the user experience look like on-chain? Yield continues first, then the system pauses if necessary while the protocol assesses the risks and the situation. Redemptions move to a controlled mode, and the Accountable feed continues to show the reserves, real liabilities, and everything else in real time.

Who takes the losses? The reserve fund first, and then the NAV adjusts proportionally on the staked-token side. If, for whatever reason, a huge tail scenario happens and more than the staked-token holdings are affected, then obviously the whole system is affected. By design, that normally shouldn’t happen. That would be a very catastrophic scenario, but even if it happens, that’s when the whole protocol’s reserves are affected.

We’ve also documented separate protocols for distinct scenarios, such as a depeg protocol, a drawdown protocol, and a hack-incident protocol. These aren’t small or insignificant playbooks. They’re predefined sequences of actions that show everyone what to do in each scenario.

That matters because, in times of stress, the worst thing you can do is improvise and act randomly. We’re also taking the right steps before anything happens, because the philosophy is not if, but when something happens. We’re always cautiously pessimistic, thinking ahead and trying to protect whatever is at stake before the situation happens.

In the worst-case scenario you mentioned, where there’s a drawdown in the NAV and an actual loss, the decision is with the user because they can see the actual loss. Let’s say the loss is 10%. They see that they can redeem 90 cents for every dollar they deposited. Then they can decide whether they can find a better price in the secondary market and sell, or simply wait to redeem at that new redemption value.

15. Roadmap: Ethereum mainnet launch and audits

Sam, thanks for this walkthrough. I think it was really helpful to talk very openly about a lot of this. My final question to you would be: where is Tori in terms of its product roadmap right now? In the next few weeks, what’s top of your mind? What should people expect from Tori in the near future?

We’re getting ready for the launch, hopefully in a few weeks. Within the next month, we’re going to be live on Ethereum mainnet. That is going to be published very soon, and the contracts will be live very soon. Again, they’ve both been audited by the Sherlock and Nethermind teams.

The Accountable dashboard is going to go live with real-time proof of reserves, and the full architecture I’ve just described is going to be shipped live. On partnerships, we have institutional execution desks across markets, on-chain and off-chain credit-line facilities that are being set up, and active negotiations with different protocols, lending markets, and on- and off-chain partners.

Structurally, there’s going to be a clear two-token architecture, which is also documented in the protocol. Everything should be ready to go live very soon. Obviously, I can’t share much here, but it’s coming very soon.

Awesome. I’m looking forward to doing another round of this in a few months after you launch. It’s always great to see the progress and how things change since we last discussed it. Thanks for coming and walking us through Tori. Thanks so much for joining.

Thank you so much for having me.