Protocol

Escrow invariant

Everything the protocol could owe is already in its custody.

Statement

for every token T: balanceOf(BarrierCore, T) ≥ Σ obligations in T across all series

Consequences

No payout depends on a later deposit.
No position can be liquidated, because none is borrowed.
A frozen oracle delays settlement but cannot create a shortfall.

Flow of value

Deposits enter subscription buckets, move to live buckets at strike, and to claimable buckets at settlement. Fees leave only through FeeRouter, and only out of amounts already earned.

Bucket transitions

From	To	When
Subscription	Refundable	Strike, unmatched part
Subscription	Live	Strike, matched part
Prefund	Coupon claimable	Each paid observation
Live	Redeemable	Settlement

Rounding

Every division rounds against the claimant and in favour of escrow, so dust stays inside the contract rather than leaving it short.

How it is tested

A stateful fuzz suite checks the inequality after every random action sequence. See Invariants.