Primitive Finance

Summary

Primitive Finance, founded in 2020 by Alexander Angel, was one of DeFi's most persistent attempts to build derivatives without oracles. It shipped two distinct mechanisms. Primitive V1 (mainnet December 29, 2020) tokenized physically-settled options on any ERC-20 pair, pricing premiums via Uniswap pools of short-option tokens instead of a price feed. After a near-catastrophic vulnerability and whitehat rescue in February 2021, the team pivoted to RMM-01, the first production implementation of a "Replicating Market Maker" — a CFMM whose trading curve is engineered so that LP shares passively replicate a Black-Scholes covered-call payoff, with arbitrageurs (not oracles) keeping the position on-model. RMM-01 ran on Ethereum mainnet for a bit over five months in 2022 before a numerical-approximation error was exploited for roughly $34,000, prompting an accelerated sunset in September 2022. Primitive raised a $3M seed (May 2021) and a $9M Series A led by Bain Capital Crypto (August 2022), then redirected toward the Portfolio AMM protocol and the open-source Arbiter EVM simulation framework. RMM-01's core idea — payoff replication via curvature rather than order matching — became a canonical reference in AMM research.

Design (Mechanism)

Primitive V1 (2020–2021): Options were tokenized as long/short ERC-20 pairs, physically settled (zero default risk), on any two ERC-20s as underlying/quote. There was no oracle anywhere in the pricing path: premiums emerged from the ratio of short-option tokens to underlying in a Uniswap pair, and a "flash exercise" let exercisers receive underlying first and pay within the same transaction (reverting otherwise), enabling atomic arbitrage-style exercise.

RMM-01 (2021–2022): Built directly on the Angeris–Evans–Chitra "Replicating Market Makers" result: for a large class of payoffs there exists a CFMM trading function whose LP value tracks that payoff. RMM-01 instantiated the covered-call curve — a two-asset pool parameterized by strike, implied volatility, and expiry, whose invariant incorporates the Gaussian CDF. As spot moves and time decays, arbitrageurs trade the pool back onto the curve, so LPs end up holding the covered call's value profile at expiry without any oracle, order book, or counterparty. Depositing was equivalent to selling a covered call (earning "theta" as swap fees paid by arbitrageurs); the pool doubled as a spot exchange. Architecture: a PrimitiveFactory deploying per-pair PrimitiveEngine contracts (rmm-core), with a PrimitiveManager periphery (0x54522dA62a15225C95b01bD61fF58b866C50471f on mainnet) handling positions. Because the CDF is transcendental, the contracts relied on fixed-point approximations — a detail that proved decisive.

Outcome

• V1: Live December 2020. On February 20–21, 2021, the Dedaub team found a "confused deputy" flaw in the Uniswap flash-swap integration putting ~$1.2M at immediate risk (more via open approvals). A 48-hour war room coordinated by Immunefi (with Emiliano Bonassi and Dedaub) executed a whitehat rescue, saving over 90% of funds. The design was subsequently retired in favor of RMM-01.
• RMM-01: Testnet late 2021; mainnet in spring 2022; live "over five months." On September 8, 2022, an attacker exploited the CDF approximation error — accurate only outside a window of <65,810 seconds to expiry with spot above strike — extracting ~$34,000 over ten hours, mostly from Primitive-owned liquidity. The team disabled deposits within 42 minutes; the affected pool expired that day. On September 9–20, 2022, Primitive announced an early sunset: the app became withdraw-only, though the immutable contracts remain on-chain. Notably, the approximation gap had already surfaced during audits, but no invariant enforced a safe error bound around it before mainnet launch.
• Company: $9M Series A (Bain Capital Crypto, August 18, 2022) funded a pivot to the Portfolio AMM protocol (in development since April 2022) and Arbiter, a Rust-based EVM simulation/economic-fuzzing framework (2023). Neither achieved RMM-01's visibility; Primitive's later products found limited traction, while the RMM research lineage (e.g., the "Replicating Portfolios" paper) remained influential.

Why it worked

• Oracle-free by construction. Both designs eliminated the largest attack surface in DeFi derivatives — price feeds — by making arbitrage do the pricing. RMM-01 proved on mainnet that a static curve really can replicate an option payoff for passive LPs.
• Theory-to-production pipeline. RMM-01 was arguably the cleanest example of an academic AMM result (Angeris–Evans–Chitra) shipped as verified contracts within a year, complete with SDK, docs, and audits.
• Exceptional incident response. The 2021 whitehat rescue (>90% of funds saved) and the 42-minute response in 2022 kept user losses minimal across two serious incidents — a rare record for an early DeFi team.

Where the design broke

• Transcendental math on the EVM. Replicating Black-Scholes requires the Gaussian CDF; fixed-point approximation error near expiry created a genuine arbitrage against the pool itself. A known-but-dismissed edge case became the terminal incident.
• Product-market mismatch. A covered call sold via passive LP shares is elegant but hard to market: LPs must understand implied volatility, expiries fragment liquidity into many small pools, and 2022's bear market crushed demand for structured yield.
• Compounding pivots. V1 → RMM-01 → Portfolio meant three architectures in three years; each reset integrations, liquidity, and mindshare before network effects formed.
• Security-driven haste, twice. Both flagship products were retired primarily because of vulnerabilities rather than by user choice, denying the mechanism a fair commercial test.

Lessons

• Numerical approximation is consensus-critical code. Any curve using transcendental functions must be adversarially tested precisely in its boundary regimes (near expiry, deep ITM/OTM); "unexploitable in our tests" is not a security argument — this failure directly motivated Primitive to build Arbiter for economic fuzzing.
• Oracle-free ≠ risk-free. Removing the oracle moves trust into the correctness of the invariant math and the assumption of efficient arbitrage; the attack surface changes shape rather than disappearing.
• Payoff replication via LP shares is a real primitive, but it sells a position, not a product. Users buy "yield" or "options," not "a CFMM whose value function is a covered call"; packaging and vault-style UX matter as much as mechanism correctness.
• Fast, transparent incident response preserves optionality. Two incidents with minimal user losses meant Primitive could still raise and pivot; teams that hide incidents rarely get that chance.
• Expiring instruments fragment AMM liquidity. Every strike/expiry pair is its own pool; without a rollover or perpetual variant, liquidity mining costs recur every cycle.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial hypothesis, not a factual claim about Primitive's plans.

A modern RMM-01 would attack its two killers directly. First, replace the on-chain CDF approximation with either (a) a rational approximation with formally verified error bounds enforced as invariant slack (the pool refuses trades whose profitability exceeds the proven approximation error), or (b) exact piecewise curves that dispense with Black-Scholes entirely and target the payoff shape directly, as later "replicating portfolio" work suggests. Second, fix fragmentation by making the covered call perpetual: continuously roll the effective expiry (an "everlasting option" curve) so liquidity concentrates in one pool per pair, with implied volatility set by a funding-style auction between LPs and takers rather than fixed at pool creation. Package the LP share as an ERC-4626 vault labeled plainly as "sell covered calls on ETH," with expiry rollover automated. Finally, institutionalize the lesson Primitive itself drew: gate mainnet launch on agent-based economic fuzzing (Arbiter-style) across the full parameter boundary space, treating near-expiry regimes as the primary test target rather than an afterthought. The RMM idea did not fail on demand for oracle-free options — it failed on numerical edge cases and packaging, both of which are fixable engineering problems.