CPPI On Solana¶

Issuer: MoonUp · Document version: 1.0 · Date: April 2026 · Classification: Public

Executive Summary¶

Portfolio insurance as a discipline emerged from traditional asset management in the 1980s as a response to a recurring tension in wealth preservation: investors want to participate in market upside while limiting their exposure to catastrophic drawdowns. Classical CPPI, developed by Fischer Black and Robert Jones at Goldman Sachs (1987), offered an analytically rigorous answer — a rules-based framework that dynamically allocates between a risky growth asset and a risk-free reserve in proportion to the distance between the current portfolio value and a pre-defined floor.

The arrival of programmable on-chain settlement infrastructure transforms CPPI from a strategy that requires periodic manual rebalancing — or expensive delegation to a fund manager — into one that can be executed continuously, transparently, and autonomously. Every allocation decision is visible on-chain. Every rebalancing event is recorded immutably. Every dollar of yield earned in the protective leg is earned by the holder, not a counterparty.

MoonUp's CPPI product brings this structural discipline to self-custodied on-chain portfolios. The strategy runs continuously in the background, monitoring positions approximately every ten minutes and executing rebalances on-chain when the allocation has drifted meaningfully from its target. Layered above the rules engine is the AI Guardian — an agentic system that observes macroeconomic, sectorial, and single-name signals in real time and adjusts the strategy's aggressiveness parameter before drift has had a chance to accumulate. The result is a strategy that is simultaneously rule-governed and adaptive.

This white paper describes the full architecture of MoonUp's CPPI product: the mathematical framework, the basket design, the AI Guardian's role and boundaries, the lifecycle of a position, and the risk considerations that any investor should understand before committing capital.

1. Background and Motivation¶

1.1 The Problem CPPI Solves¶

Every investor who seeks capital growth faces a version of the same problem. The assets most likely to generate meaningful long-run returns — equities, growth-oriented tokens, commodity-linked instruments — are also the assets most exposed to severe short-term drawdowns. Sitting entirely in safe assets solves the downside problem but creates a different one: the opportunity cost of not being invested in growth compounds over time.

Most retail and wealth-management solutions to this problem are blunt instruments: fixed-weight portfolios that rebalance on a calendar schedule, stop-loss orders that liquidate entirely if a price threshold is crossed, or option strategies that are expensive, opaque, and expire. CPPI occupies a different class. It does not rebalance on a schedule — it rebalances in response to the distance between the current portfolio value and the floor. In strong markets, this means staying heavily allocated to growth assets. In falling markets, it means systematically rotating into the protective leg before losses breach the declared floor. The allocation is a continuous function of market conditions, not a periodic guess about what the right allocation should be.

1.2 Why On-Chain Execution Changes the Calculus¶

In traditional finance, CPPI is typically implemented through a fund wrapper. The investor delegates execution to a manager, who may rebalance daily or weekly. Execution costs, management fees, and the opacity of the fund structure all reduce the strategy's effective performance. The investor rarely has visibility into whether the rebalance that day moved the allocation by 3% or 30%, or why.

On-chain execution removes these frictions in structurally important ways:

• Settlement is continuous. Swaps execute on-chain within block confirmation time — measured in seconds on modern Layer-2 networks — rather than at end-of-day NAV.
• State is public. Every allocation, every rebalance, and every fee paid is on-chain and independently verifiable.
• Custody remains with the user. Capital is never transferred to a counterparty or fund manager. The user's wallet holds the underlying tokens at all times.
• Yield is direct. Capital held in the protective leg earns yield from on-chain instruments — lending protocols, tokenised treasuries, reinsurance tranches — accruing directly to the position without a fund management layer extracting a margin.

MoonUp's CPPI product is built on these structural properties. It is not a fund. It is a continuously running strategy engine operating on a self-custodied wallet.

2. Strategy Architecture¶

2.1 Core Variables¶

The CPPI strategy operates on three interdependent variables at all times.

Floor \(F\)

The floor is the minimum portfolio value the investor has declared they want to protect. It is expressed as a percentage of current portfolio value at the time it is set:

where \(f\) is the floor percentage chosen by the user (between 50% and 95%) and \(V\) is the total portfolio value at the time of the instruction. The floor is not fixed in dollar terms — if the user raises or lowers \(f\), \(F\) is recalculated against the current \(V\), not the inception value. This means a rising portfolio compounds the floor, giving the investor progressively stronger downside protection as wealth grows.

Cushion \(C\)

The cushion is the capital available for investment in growth assets — the difference between the current portfolio value and the floor:

The cushion is the live risk budget of the strategy. As markets rise, \(V\) increases and \(C\) widens, giving the system more capacity to allocate to the equity basket. As markets fall, \(C\) narrows and the system shifts capital to the yield-generating basket. If \(C\) reaches zero, the floor has been breached and the position pauses automatically.

Equity Allocation \(E\)

The target allocation to the equity basket is the product of the multiplier and the cushion:

where \(m\) is the multiplier — a parameter that controls the aggressiveness of the strategy. A multiplier of 4 on a cushion of $2,000 sets a target equity allocation of $8,000. The remaining capital:

flows to the yield-generating basket.

The multiplier is not user-configurable. It is managed dynamically by the AI Guardian system (Section 3) in response to real-time risk signals. A higher multiplier maximises time-in-market during favourable regimes; a lower multiplier reduces equity exposure ahead of deteriorating conditions.

2.2 Rebalancing Logic¶

The system evaluates every active position approximately every ten minutes. It computes the current values of \(V\), \(F\), \(C\), and the implied target \(E\). If the actual equity allocation has drifted from \(E\) by more than a configured threshold, a rebalance is triggered — two on-chain swaps execute simultaneously to bring both the equity leg and the yield-generating leg back to target.

Not every evaluation results in a trade. The drift threshold exists to avoid excessive transaction costs from minor market fluctuations. A rebalance fires only when the deviation is economically material.

In addition to drift-based triggers, rebalances also fire on: basket recomposition events, scheduled periodic re-anchoring, significant volatility regime changes, floor breach detection, and AI Guardian multiplier adjustments. Full trigger taxonomy is described in Section 7.

2.3 Parameter Summary¶

3. The AI Guardian¶

3.1 What It Is¶

The AI Guardian is MoonUp's agentic AI system — an autonomous, continuously operating agent that monitors market conditions, reasons over incoming signals, and acts on behalf of the user without requiring explicit instruction. It is architecturally distinct from the rules-based polling engine: where the rebalancing engine fires on quantitative drift conditions, the AI Guardian acts on qualitative and contextual intelligence.

The Guardian's primary function within CPPI is multiplier management. By adjusting \(m\) ahead of deteriorating conditions — before significant drift has accumulated — the Guardian allows the strategy to reduce equity exposure proactively rather than reactively. In practice, this means the system moves away from growth assets before market stress propagates into price action, rather than waiting for the cushion to compress.

The Guardian operates in real time. It does not wait for the next ten-minute polling cycle to act. Multiplier adjustments initiated by the Guardian take effect immediately and are recorded in the position's event history with the rationale.

3.2 Signal Taxonomy¶

The AI Guardian monitors signals across four categories:

The Guardian does not apply fixed thresholds to these signals. It interprets them in the context of the user's active position — the basket composition, the current cushion level, the recent multiplier history — and makes a judgment about whether the signal warrants a change, an alert, or no action.

3.3 Autonomous Actions¶

The AI Guardian takes three categories of autonomous or advisory action:

1. Multiplier adjustment

The Guardian lowers \(m\) during periods of elevated risk, reducing the target equity allocation \(E\) before the next drift rebalance would otherwise fire. When conditions normalise, it raises \(m\) to restore equity exposure. Each adjustment is recorded as a REBALANCED event with trigger source SYSTEM and reason ai_guardian. The user receives an in-app notification with the Guardian's reasoning in plain language.

2. News and event alerts

When the Guardian identifies a material macro, sectorial, or single-name event relevant to an active basket, it surfaces an in-app alert with a concise summary of the signal and an explanation of its potential impact on the position. This is informational — no action is required from the user, though the user may choose to adjust their floor or close the position in response.

3. Sector rotation recommendations

If the Guardian identifies a sustained structural rotation away from the equity basket currently held, it surfaces a basket-switch recommendation as an actionable prompt. The recommendation includes the Guardian's reasoning, the suggested alternative basket, and an estimated impact on the current position. Basket changes are always advisory — they require explicit user confirmation and are never executed autonomously.

3.4 Agentic Boundaries¶

The AI Guardian operates within defined constraints that cannot be overridden:

• It does not switch the user between equity baskets without explicit confirmation.
• It does not modify the user-defined floor \(f\).
• It does not close or pause the position except through the standard floor-breach logic.
• It does not guarantee protection against flash crashes or liquidity gaps between execution cycles.
• It does not have access to funds outside the CPPI position it is monitoring.

These boundaries exist to ensure that the Guardian augments user decision-making rather than replacing it on consequential actions. The user retains full authority over capital allocation decisions above the level of intra-strategy multiplier management.

4. Equity Baskets¶

Each CPPI position is anchored to one of four equity baskets. The basket defines the universe of growth assets the strategy will hold and rebalance within. Users invest in the basket as a unit — token selection and weighting within the basket are managed by MoonUp's investment engine, not by the user.

4.1 AI Growth¶

Tokenised exposure to artificial intelligence and semiconductor infrastructure — large-cap technology companies driving AI compute, model deployment, and software integration. This basket is suited to investors with a multi-year structural conviction on AI as an investable theme. It carries the highest expected short-term volatility of the four baskets, which means the CPPI cushion will compress and expand more rapidly. The floor mechanism is particularly well-suited to managing the drawdown profile of this basket.

4.2 World Equities¶

Broad global equity exposure through tokenised stocks spanning multiple geographies and sectors. Lower concentration risk than the thematic baskets. Suited to investors seeking diversified market participation with capital protection. Lower expected volatility relative to AI Growth and Defense means the cushion typically stays wider for longer during moderate market declines, preserving equity exposure.

4.3 Commodities¶

Tokenised exposure to commodity-linked assets across energy, metals, and materials. Commodities are cyclical and often exhibit low or negative correlation with equity markets, making this basket a natural complement for investors who already carry equity exposure in their broader portfolio. Seasonality and geopolitical sensitivity mean rebalancing may fire more frequently than for other baskets.

4.4 Defense¶

Tokenised aerospace and defense sector exposure. Historically resilient in risk-off environments due to the visibility of government contract revenue. Subject to sharp discrete moves around geopolitical events and procurement cycle news, making the floor's protective function particularly relevant.

4.5 Basket Weight Architecture¶

All equity baskets share a three-layer weight representation:

Basket weights are surfaced in the UI refreshed at approximately fifteen-minute intervals.

5. The Yield-Generating Basket¶

The yield-generating basket is the protective leg of every CPPI position, regardless of which equity basket is selected. It is system-defined, fixed in structure for a given version, and shared across all four equity basket variants.

5.1 Purpose¶

Capital in the yield-generating basket is not idle. It earns a return while standing ready to be redeployed into the equity basket when conditions improve. This means the cost of protection — the opportunity cost of holding non-growth assets — is partially offset by the yield generated in the protective leg.

5.2 Composition¶

The yield-generating basket is a dynamically weighted blend across four asset categories:

The weight blend across categories is reviewed and updated by MoonUp periodically, in response to the yield environment, correlation properties relative to the equity baskets, and on-chain liquidity conditions. Composition changes do not interrupt a live CPPI position — the system adapts automatically at the next rebalance event.

The yield-generating basket uses the same three-layer weight architecture (target, effective, lots) as the equity baskets.

6. Position Lifecycle and User Controls¶

6.1 Opening a Position¶

To open a CPPI position, the user specifies three parameters:

1. Equity basket — one of AI Growth, World Equities, Commodities, or Defense
2. Floor percentage — between 50% and 95% of initial capital
3. Capital amount — the total to deploy

On confirmation, the system synchronously: 1. Calls the investment engine to compute the exact allocation split given \(V\), \(f\), and the current \(m\) 2. Executes two on-chain swaps — one to build the equity basket position, one to build the yield-generating basket position 3. Begins monitoring the position on the ten-minute cycle

The position transitions to ACTIVE within seconds of on-chain swap confirmation.

Only one active CPPI per equity basket per wallet is permitted. This constraint prevents inadvertent double-exposure to the same thematic basket and keeps the portfolio view unambiguous.

6.2 Managing an Active Position¶

Adjusting the floor

The floor percentage can be raised or lowered at any time. Changes take effect immediately: the system calls the investment engine synchronously and executes the resulting rebalancing swaps before returning a confirmation to the user.

• Raising the floor (e.g. 80% → 85%): reduces \(C\) → capital moves from equity basket to yield-generating basket. Effective de-risking.
• Lowering the floor (e.g. 80% → 70%): increases \(C\) → capital moves from yield-generating basket to equity basket. Effective increase in growth exposure.

The change and resulting rebalance are logged in the event history with full before/after state.

Adding capital (upsize)

Additional capital can be deposited at any time. The system recomputes the allocation using the existing \(f\) and \(m\) against the new, larger \(V\), and tops up both baskets accordingly. The event is logged as UPSIZED.

Withdrawing capital (downsize)

A partial withdrawal can be requested at any time. The system unwinds the proportional share from both baskets. If the requested withdrawal would reduce \(V\) to at or below \(F\) — making \(C \leq 0\) — the operation is rejected. The user must lower the floor percentage first to create adequate headroom. Withdrawn funds settle to the user's wallet within on-chain confirmation time. The event is logged as DOWNSIZED.

Closing

A full close unwinds both the equity leg and the yield-generating leg through on-chain swaps. Proceeds are returned to the user's wallet. The position transitions to CLOSED and is removed from active monitoring. Closed positions remain fully visible in history. Closing is irreversible — restarting the strategy requires opening a new position, which will be created on the latest algorithm version.

6.3 Position States and Event History¶

Every state change and rebalance event is permanently recorded:

Each event records a timestamp, trigger source (user or system), and a full snapshot of the instruction received from the investment engine.

6.4 Recovering from a Floor Breach¶

When a floor breach is detected, the position pauses automatically. From a PAUSED state, the user has two options:

• Resume — set a new floor percentage that creates a positive cushion against the current (reduced) portfolio value, and reactivate monitoring.
• Close — fully unwind and receive proceeds.

MoonUp does not automatically resume a paused position. The decision to re-enter the strategy, and at what floor level, remains with the user.

7. Rebalancing Engine¶

7.1 Monitoring Architecture¶

The rebalancing engine runs server-side on a continuous ten-minute cycle. It evaluates all active positions regardless of whether the user has the application open. Each evaluation cycle computes the current \(V\), \(F\), \(C\), and the implied target \(E = m \times C\) for each position, and tests each position against the full set of rebalance trigger conditions.

7.2 Trigger Taxonomy¶

7.3 Execution Flow¶

When a rebalance is triggered:

1. The investment engine returns exact lot quantities for both the equity and yield-generating baskets
2. Two sets of on-chain swaps execute simultaneously — one for each leg
3. If a swap fails, it is retried at the next polling cycle; partial execution is recorded in the event history
4. The position's allocation snapshot and rebalanced timestamp are updated

All user-initiated changes — floor adjustments, upsizes, downsizes — trigger an immediate synchronous rebalance, bypassing the ten-minute cycle entirely. The effect is on-chain within block confirmation time.

7.4 Transaction Costs¶

Rebalancing involves on-chain swaps, which incur network gas fees and, where DEX routing is used, trading fees. The UI presents estimated execution costs before any user-initiated action is confirmed. Automated rebalances on the polling cycle do not present confirmations to the user; their costs are reflected in the position's net performance.

8. Governance and Versioning¶

8.1 Algorithm Versioning¶

Each CPPI position is stamped with the version of the MoonUp investment algorithm in use at the time it was opened. The position runs on that version for its entire active lifetime. Algorithm improvements — tighter drift thresholds, updated volatility models, improved basket construction methodology — are released as new versions. Existing positions are not migrated automatically.

8.2 Upgrade Path¶

Users are notified when a materially improved algorithm version becomes available. To adopt the new version, the user closes their existing position and opens a new one. The new position begins on the current version.

This design reflects a deliberate principle: a position opened with a specific risk profile should behave consistently throughout its life. Imposing a mid-flight algorithm change on a live position — even an improvement — would violate the investor's reasonable expectation of strategy continuity.

8.3 Non-User-Configurable Parameters¶

The following parameters are managed exclusively by MoonUp:

9. Risk Considerations¶

MoonUp's CPPI product is designed to manage downside risk structurally. It does not eliminate risk. Investors should understand the following limitations before deploying capital.

10. Reference Parameters¶

Disclaimer¶

MoonUp — Institutional on-chain wealth infrastructure.