01 / OVERVIEW
AI decides the price. Contracts control the money.
The AI agent is the product's decision layer: it combines live Aave V3 evidence with a cited incident corpus, performs two independent risk assessments, and returns an attributable signed decision. It never controls user funds. Wallets authorize every transfer, while contracts enforce the recorded decision, full underwriting backing, position lifecycle, and deterministic claim rules.
01ReadLive Aave V3 reserve and pool state
02PriceAI-signed quote or refusal
03EnforceAtomic vault, backed pool, and resolver
02 / POLICY NFT
The XCOVER NFT is the on-chain cover certificate.
Every successful covered deposit immediately mints an ERC-721 named xCover Policy, symbol XCOVER. Its token ID is the policy ID. The associated on-chain record fixes the owner, reserve, covered amount, start and end blocks, premium rate, signed-quote hash, terms hash, and lifecycle state.
What the buyer receivesLinked vault shares for the Aave-supplied USDT position and one XCOVER policy NFT for its cover terms.
On-chain artwork and metadataThe tokenURI returns Base64 JSON with an embedded Base64 SVG. Wallets and explorers can render it without depending on an xCover metadata server.
When it is mintedIn the same atomic transaction that supplies USDT to Aave and reserves matching underwriting capacity—not after 24 hours.
What happens after 24 hoursNo new token appears. The existing policy becomes eligible for deterministic claim evaluation once sufficient observations exist.
What a valid claim paysThe resolver marks the existing policy Claimable and settles the covered amount due in USDT from the underwriting pool; the claim is not another token.
What does not happenThe NFT is not sold, transferable, burned, or exchanged for the payout. After settlement it remains in the owner's wallet with state Paid.
Why it cannot transferThe NFT and address-keyed vault position must stay under the same owner so withdrawal and cover cannot diverge.
What exit doesAn immediate full exit is allowed. It unwinds the Aave position and changes an untriggered policy to Cancelled while preserving its on-chain history.
LifecycleActive (waiting) → evaluation eligible → Claimable → Paid. An untriggered policy can instead end as Expired or Cancelled. Evaluation eligible is not the same as having a payable claim.
03 / EXISTING AAVE SUPPLIERS
Move the amount you want protected into a linked position.
An existing Aave V3 supplier can redeem the amount they want to protect from their direct Aave position back to USDT, request an xCover decision for that amount, and reopen it through xCover. The result is still a real Aave V3 supply position, but its owner, signed quote, premium, policy, and underwriting reservation are now linked by the xCover contracts.
- Redeem from the direct Aave position. Withdraw the chosen amount from Aave back to USDT in the user's wallet.
- Request and record an xCover decision. The agent prices the live reserve and the PricingRegistry makes the signed result public.
- Open through xCover. The vault resupplies that USDT to Aave and atomically attaches the policy and matching pool reservation.
Current boundaryThe deployed build does not attach cover in place to an arbitrary aUSDT balance held outside xCover. It requires the protected amount to open through xCover so the contracts can bind, size, and unwind the position honestly. In-place external aToken wrapping is a future extension.
04 / DEPOSITOR FLOW
Open a covered USDT deposit.
- Connect on X Layer. The dashboard checks the wallet network and offers to add or switch to chain 196.
- Request AI pricing. The service reads the live Aave V3 reserve, pool capacity, oracle state, and cited risk evidence, then returns a signed price or a signed refusal with reasons.
- Record the signed decision. The wallet submits it to the PricingRegistry, making the decision public, attributable, and binding for the next step.
- Approve and open atomically. The vault pulls the buyer's USDT, supplies it to the real Aave V3 venue, consumes the quote, mints the policy, and reserves matching pool capital in one covered-deposit transaction.
- Respect quote expiry. A quote is valid only until its recorded block and can be consumed only once for the exact asset and amount it priced.
- Read or exit. The dashboard reads the position and lets its owner exit the full position; an untriggered policy releases its pool reservation when it exits.
05 / UNDERWRITING
Capital stands behind the cover.
Underwriters approve USDT to the pool and deposit capital for pool shares. The pool is fully backed: capital must always cover outstanding cover, and new policies cannot reserve more than free capital. Premium from covered positions returns to the pool.
How the money movesThe buyer's USDT goes to Aave as the covered position. Underwriter USDT stays in CoverPool as reserved claim capital. If a covered trigger is proven, the resolver tells CoverPool to pay USDT to the XCOVER owner. If no claim occurs, the reservation is released and accrued premium increases pool capital and provider-share value.
Underwriter economicsProviders earn the premium paid by covered positions, but their capital is at risk if a valid claim pays. The current build has no separate xCover protocol or treasury fee; premiums go to the underwriting pool.
Two transactionsApprove USDT, then add pool funds.One exit pathWithdraw shares when capital is free.
06 / AI PRICING
The agent recommends; deterministic code and contracts enforce.
The pricing service reads the live Aave reserve, oracle, liquidity, utilization, reserve configuration, pool capital, and outstanding cover. It retrieves cited evidence and runs two independent model assessments. Those assessments produce hazard factors, uncertainty, confidence, concerns, missing facts, and cited conclusions; deterministic code computes the premium and applies the configured operating bounds.
Signed decisionEvery price or refusal is signed under EIP-712 by a key restricted to PRICER_ROLE.
Canonical reasoningThe decision commits to a canonical JSON document through a public decision hash.
Public refusalsDeclines are recorded in the same registry history as accepted quotes instead of being hidden.
No custodyThe pricing key cannot transfer assets, reserve capital, mint policies, alter claim evidence, or pay claims.
07 / CLAIMS
Observations create the evidence trail.
Anyone can publish a fresh reserve observation. The resolver reads the venue and Aave state itself, so the observer chooses when to sample but cannot choose the values. The deterministic resolver evaluates the recorded evidence against the policy terms and pays according to the covered trigger; an AI model or privileged keeper does not decide whether a claim is valid.
In plain languageAn observation is one contract-read snapshot of Aave's deficit, price, redeemable liquidity, and supplied assets. Anyone can publish it with Update reserve, but cannot choose the values. Mainnet cover waits approximately 24 hours in blocks before activation, then requires an approximately 30-minute window with at least 30 samples.
What counts as a triggerWaiting alone is not a claim. A trigger means the required samples prove a material reserve deficit, sustained inability to redeem, or sustained oracle/depeg condition. If Aave remains healthy, the resolver reports no covered trigger and pays nothing.
Reserve deficitA material Aave deficit is measured as a share of total supplied assets and pays the policy's pro-rata shortfall.
Redemption failureSustained liquidity below the policy threshold triggers the deployed full-cover redemption-failure path.
Oracle failure/depegA sustained below-bound or implausible price pays the shortfall fixed by the policy terms.
What the dashboard showsReserve liquidity, deficit, supplied assets, pool capital, outstanding cover, public registry counters, policy state, and the claim controls for the connected position. Eligibility is read-only; evaluation and payout require signed transactions.
08 / CONTROLS
Refusal is a valid outcome.
Live Aave V3 integrationMainnet positions are supplied to the configured Aave V3 USDT reserve and reserve conditions are read from live sources.
Fully backed underwritingCapital must cover outstanding cover; withdrawal is bounded by free capital.
Atomic covered depositSupply, quote consumption, policy minting, and capital reservation succeed together or revert together.
Quote expiryEach signed decision expires at a block, is tied to an exact amount, and can back only one policy.
Daily capacity limitNew cover per reserve is capped per day, limiting concentration even when pool capacity remains.
Waiting-period protectionCover activates only after the block-based waiting period, reducing adverse selection.
Permissionless observationsAnyone may submit a fresh sample; the resolver reads the values directly from Aave and the venue.
Deterministic claimsFixed terms, observation windows, and on-chain reserve evidence determine whether and how much a claim pays.
Contract separationThe pricer signs decisions; it cannot move pool funds, mint policies, or settle claims.
Live pricing is currently marked provisional and unaudited while calibration continues. Treat the dashboard as a working protocol interface, not a promise of loss coverage.
09 / LIVE DEPLOYMENT
Verify what you are using.
These addresses are loaded from the same deployment record that powers the dashboard.
Loading live contract addresses…