Liquidity Load Layer (L^3)

L3 scores Cashu mints in real time using Bayesian inference across 11 trust signals, then auto-migrates your Bitcoin away from risky mints via Lightning. Quant-grade risk management for ecash.

Comment

L³ — Liquid Load Layer

⚡ Demo Note: To experience the full ingenuity of L³, navigate to the Wallet tab and switch to Mainnet mode. Send and receive real sats — watch as your funds are automatically load balanced across the safest mints in real time. Every deposit is routed to the highest-scored mint, every withdrawal drains the riskiest mint first, and if a mint degrades mid-session, your funds migrate over Lightning autonomously. The other dashboard features provide context, but the wallet on mainnet is where L³ comes alive.

Inspiration

Every time you send money online, you're trusting a middleman. Venmo, Cash App, your bank — they hold your funds and you hope they don't freeze your account, go insolvent, or get breached. Bitcoin eliminated that with self-custody, but the moment you want fast, private, cheap payments, you're pushed right back into custodial trust.

Cashu — a Chaumian blind-signature ecash protocol — gives you privacy and speed, but the mint operator is holding your real BTC and issuing you bearer tokens. There is zero standardized way to know if that operator is trustworthy, draining reserves, or about to disappear. No credit ratings. No insurance. No on-chain visibility. A mint can have 100% uptime right up until the moment it rugs.

We asked: what if we applied institutional portfolio risk management — Markowitz optimization, Gaussian risk modeling, Value-at-Risk — to custodial trust in ecash?

That's L³.

What it does

L³ is the intelligence layer between your money and the Lightning Network. It continuously:

  1. Scores every mint in real-time across 11 weighted signals from direct health probes and Allium Labs on-chain analytics
  2. Models each score as a Gaussian distribution — capturing both the score and our confidence in it
  3. Allocates funds optimally using Mean-Variance Optimization, penalizing uncertainty quadratically
  4. Migrates funds autonomously over Lightning when a mint degrades — 60-second cycles, no human intervention

Lightning is the highway, ecash mints are the banks along it, and L³ is the risk manager deciding which banks your money sits in before it ever moves.

How we built it

Tech Stack

Frontend: React 19.2, TypeScript 6.0, Vite 8.0, Tailwind CSS 4.2, Recharts 3.8, Lightweight Charts 5.1 (TradingView), Lucide React 1.8, QRCode.react 4.2

Backend: Express 5.2, tsx 4.21, @cashu/cashu-ts 3.6, Node.js ≥22.12

Data Sources: Allium Labs API (wallet transactions, balances, balance history), Cashu Mint endpoints (/v1/info, /v1/keysets), Nostr relays via NIP-87 (relay.primal.net, relay.damus.io, nos.lol)

Infrastructure: Docker (multi-stage build, node:22-slim), Railway

Research / Prototyping: Python, NumPy, Pandas, Matplotlib, Jupyter Notebook

Trust Scoring

Each mint is evaluated across 11 signals — 7 from direct probing (70% weight) and 4 from Allium on-chain data (30% weight). Each signal produces a value and an uncertainty, combined into a composite Gaussian:

$$\mu = \left(\sum_{i=1}^{11} w_i \cdot v_i\right) \times 100 \qquad \sigma = \sqrt{\sum_{i=1}^{11} (w_i \cdot \sigma_i)^2} \times 100$$

This gives us $\text{Score} \sim \mathcal{N}(\mu, \sigma^2)$ — not just a number, but a distribution. A verified mint has $\sigma \approx 5$; an anonymous mint has $\sigma \approx 14.6$.

Probabilistic Grading

Grades are probabilities, not hard cutoffs:

$$p_{\text{safe}} = 1 - \Phi!\left(\frac{75 - \mu}{\sigma}\right) \qquad p_{\text{critical}} = \Phi!\left(\frac{50 - \mu}{\sigma}\right) \qquad p_{\text{warning}} = 1 - p_{\text{safe}} - p_{\text{critical}}$$

A mint scoring 73 with low uncertainty gets graded differently than a mint scoring 73 with high uncertainty. The system doesn't pretend to know more than it does.

Score Momentum

Rewards improving mints, penalizes degrading ones before they cross thresholds:

$$\mu_{\text{adj}} = \text{clamp}(\mu + 0.3 \cdot (\mu_{\text{current}} - \mu_{\text{previous}}),\; 0,\; 100)$$

Portfolio Allocation (MVO)

Funds are spread across mints using the Markowitz tangency portfolio, which penalizes uncertainty quadratically:

$$w_i^* \propto \frac{\mu_{\text{adj},i} - r_f}{\sigma_i^2}$$

Because we divide by $\sigma^2$ (not $\sigma$), a verified mint ($\sigma = 5$) gets $8.52\times$ more allocation than an anonymous mint ($\sigma = 14.6$) at the same score. This is the math enforcing "trust what you can verify."

Kelly Criterion Cross-Check

A second allocation opinion based on grade probabilities:

$$f_i^{\text{Kelly}} = \max!\left(0,\; 2 \cdot p_{\text{safe},i} - 1\right)$$

When MVO and Kelly diverge, it flags that assumptions may not hold for a particular mint. Both enforce a 40% max per mint.

Risk Analytics

VaR — the loss exceeded with only $\alpha$% probability:

$$\text{VaR}\alpha = \mu{\text{loss}} + z_\alpha \cdot \sigma_{\text{loss}}$$

CVaR — the expected loss given you're in the worst $\alpha$%:

$$\text{CVaR}\alpha = \mu{\text{loss}} + \sigma_{\text{loss}} \cdot \frac{\varphi(z_\alpha)}{\alpha}$$

Bayesian Priors for Anonymous Mints

Anonymous mints (no known on-chain identity) receive maximum-entropy priors instead of being dropped from scoring:

$$v_{\text{prior}} = 0.5 \qquad \sigma_{\text{prior}} = 0.45$$

"No evidence it's bad, no evidence it's good." This caps anonymous mints at $\sim$70/100 and ensures MVO allocates proportionally less to them.

Migration Engine

Hysteresis-based — evacuate critical mints ($\mu < 50$), reduce overexposure to warning mints, and never churn between safe mints. A 10-point hysteresis band prevents oscillation. Migration executes atomically over Lightning: burn ecash at source → pay invoice → mint fresh ecash at destination.

Architecture

Server-side wallet engine because ecash proofs are bearer instruments (tab close = funds lost). CORS proxy for mint communication. Allium proxy keeps API keys server-side. Mints discovered via NIP-87 Nostr relays. Docker multi-stage build on Railway.

Challenges we ran into

CORS in the Cashu ecosystem. No mints set CORS headers — every browser-side probe was blocked. We built an Express proxy layer to route all mint communication server-side.

Ecash proof persistence. Proofs are the money. Browser storage is too fragile. We moved the wallet engine server-side with file-based persistence to survive restarts.

Scoring anonymous mints fairly. Dropping on-chain signals would inflate anonymous scores. The Bayesian prior approach was calibrated through 5 simulation scenarios to balance fairness with appropriate caution.

Hysteresis tuning. Without it, borderline mints trigger repeated evacuations burning Lightning fees. The 10-point band was determined empirically through progressive degradation testing.

Allium rate limiting. 6 mints × 3 endpoints × 60-second cycles. Solved with 5-minute caching and exponential backoff.

Accomplishments that we're proud of

The math works in practice. The $8.52\times$ allocation difference between verified and anonymous mints isn't a tuned parameter — it falls directly out of the Markowitz quadratic variance penalty.

End-to-end autonomous migration. L³ doesn't just score — it moves real ecash over Lightning when thresholds are breached, with atomic 5-step migration and proof persistence.

The Three Curves visualization. Proving diversification by showing the L³ portfolio curve is always taller and narrower than any single-mint curve by $1/\sqrt{N}$ — CLT applied to portfolio construction, made visual.

Probabilistic grading. A score of 73 means different things at $\sigma = 3$ versus $\sigma = 15$. Most systems treat them the same. Ours doesn't.

Full-stack in a weekend. React 19 + Express 5 + Cashu wallet + Allium + Nostr discovery + Docker + Railway + 5 simulation scenarios + Discord alerts — wired into a 60-second real-time loop.

What we learned

Uncertainty matters more than the score itself. Modeling as distributions rather than point estimates changed every downstream decision and made the system degrade gracefully under sparse data.

Portfolio theory generalizes beyond stocks. Markowitz optimization applies anywhere you have uncertain outcomes across multiple options. Cashu mints aren't equities, but the risk structure is isomorphic.

On-chain data catches what uptime monitoring misses. A mint can have 100% uptime while draining reserves. The dual-source approach (direct probes + Allium on-chain) is what makes the scoring system robust.

What's next for Liquid Load Layer (L³)

Fedimint integration. Extending scoring to $m$-of-$n$ threshold custody federations — evaluating guardian reliability and threshold resilience.

Automated operator address discovery. Linking mint identity to on-chain activity without relying on self-reported addresses.

Cross-mint atomic swaps. Direct mint-to-mint token transfers to reduce Lightning routing fees.

Institutional API. Scoring-as-a-service and allocation-as-a-service for custodians, exchanges, and wallets holding ecash across multiple mints.

Correlated failure modeling. Introducing a covariance matrix into MVO to capture systemic risk from mints sharing infrastructure or operators.

Sustained mainnet deployment. Real funds, real migrations, real-time alerting under production conditions.

Built for the MIT Bitcoin Hackathon 2026.

Built With

+ 1 more
Share this project:

Updates