Annuities On-Chain: How Lucrum's Annuitas Module Works

Status note

Annuitas is a later-phase Lucrum module. Lucrum's Phase 1 launch focuses on three pillars: Vestibulum (the per-chain onboarding gateway), the FRS asset class (a family of FRS-xxx ERC-20s, each paying yield in a specific asset), and Tribunus (the one-address-one-vote DAO built on FOLLIS). Annuitas V1 is a locked spec — this post describes the V1 behavior as specified in the Lucrum whitepaper (version 1.0.0, March 2026). V2 additions — automatic Guard coverage for the Guaranteed tier, dynamic risk-based premium pricing, multi-asset annuities (deposit one asset, receive payments in another), NFT receipts for annuity positions, and a secondary market built on those NFTs — are called out explicitly below.

What is an annuity, minus the jargon

An annuity is a contract: you hand over a lump sum of capital, and in exchange you receive a stream of payments over time. The counterparty manages the capital so the stream is delivered. Payments can be fixed in amount, variable with market performance, or floored at a guaranteed minimum — each variant corresponds to how the counterparty structured the risk.

Annuities have been a TradFi primitive for centuries. The US industry collected roughly $464 billion in premiums in 2024 (up 29% year-over-year), driven by aging demographics, interest-rate volatility, and tax-deferred-growth demand. Zero DeFi protocols currently offer structured annuities.

Annuitas is Lucrum's module that brings this primitive on-chain, with terms encoded in smart-contract code (not 40-page PDFs) and counterparty risk diffused across on-chain yield strategies and insurance backstops.

The three V1 tiers

Variable Annuity

Payment = yield harvested this period. Principal is deployed to yield strategies and preserved indefinitely — principal is never touched. Each period, whatever yield the routers produced is claimable. If yield is zero that period, the payment is zero; the underlying capital stays intact.

Best for: users who want exposure to DeFi yield with zero principal risk
Risk: payment amounts fluctuate with market conditions
Principal: fully preserved indefinitely

Fixed-Term Annuity

Payment = target amount per period, principal amortized. You specify a target payment. The protocol funds each payment from a three-step waterfall:

Yield earned this period
Buffer reserve (accumulated surplus from prior periods when yield > target)
Principal drawdown (when yield + buffer fall short)

The annuity moves to DEPLETED when currentValue + bufferReserve reaches zero (principal is the immutable initial deposit; currentValue is the drawable balance that amortizes over time).

Best for: predictable income; accepts principal depletion
Risk: principal is consumed; annuity has a finite lifespan
Principal: amortized over the annuity's term

Guaranteed Annuity

Payment = max(calculated, minPayment). Identical to Fixed-Term, plus an insurance floor. If yield + buffer + principal cannot deliver the minPayment, the shortfall is tracked in guaranteedShortfall.

V1 behavior: the shortfall is tracked and emits a GuaranteedShortfall event but is not automatically covered. The Guard insurance pool integration is a V2 feature; V1 documents the shortfall so actuarial reserves can price forward and V2 can cover new shortfalls going forward.

V2 behavior: shortfall is automatically drawn from the Guard pool (funded by a Tribunus-governed slice of protocol fees). If the Guard pool is depleted, guaranteed payments gracefully degrade to Fixed-Term behavior rather than halting.

Best for: risk-averse users who need a floor
Risk (V1): shortfall tracked, not covered
Risk (V2): Guard pool solvency risk, mitigated by actuarial reserves

How it's built — singleton architecture

Every Annuitas annuity is a uint256 ID inside one singleton contract (same pattern as Uniswap V4 and Lucrum's own Fideicommissum). No per-annuity contract deployment. Cross-annuity accounting is cheaper; share-based yield isolation prevents Annuity #1 from eating yield owed to Annuity #2.

V1 does not mint an NFT receipt per annuity. NFT wrapping (and the secondary market that enables) is V2 roadmap.

Each annuity's assets are tracked with internal shares per yield strategy — an ERC-4626 pattern with a virtual share offset (VIRTUAL_SHARE_OFFSET = 1e6) that prevents the inflation attack vector of naive 4626 vaults.

IYieldRouter adapters

Annuity assets are deployed to yield strategies through the IYieldRouter interface (shared with Fideicommissum). Three registered adapters at V1:

Strategy	Router	Typical APY	Risk
Conservative	Creditum (lending)	3–5%	lowest
Balanced	Fiscus (managed pools)	5–8%	moderate
Growth	FRS (revenue-share staking)	8–12%	highest

Yield strategy presets

On creation, an annuity picks one of four allocation presets:

Preset	Creditum	Fiscus	FRS
Conservative	100%	0%	0%
Balanced	50%	30%	20%
Growth	30%	50%	20%
Custom	33.3%	33.3%	33.3%

Router snapshot

Router addresses are snapshotted at annuity creation time. If Tribunus later swaps a router to a new contract, the existing annuity keeps using the router that existed when it was created. This prevents a rug-via-router-replacement attack entirely — an important property for instruments that may run for decades.

Payment frequencies

Four fixed intervals at V1:

Frequency	Interval
Monthly	30 days
Quarterly	90 days
Semi-Annual	180 days
Annual	365 days

The buffer reserve smooths volatility

For Fixed-Term and Guaranteed tiers, the buffer reserve absorbs yield shocks:

Period 1: yield = 500, target = 300 → payment = 300, buffer += 200
Period 2: yield = 100, target = 300 → payment = 300, buffer -= 200
Period 3: yield = 0,   target = 300 → payment = 300, buffer = 0, principal -= 300

High-yield periods build the buffer; low-yield periods consume it. The buffer is the first line of defense before principal is touched.

Deferred accumulation — "purchase today, retire later"

An annuity can be created with a future payoutStartTime. Until that timestamp, it sits in the ACCUMULATING state:

Yield is harvested and compounded into currentValue (not paid out). Note: principal is the immutable initial deposit; the compounding happens in currentValue, which is what the payout-phase math then draws against.
No payments are made; the annuitant cannot claim.
When block.timestamp >= payoutStartTime, state transitions to ACTIVE and payments begin at the next frequency interval.

Practically: someone at 55 can buy an annuity that stays in accumulation until age 65. The deferred decade builds a materially larger principal base before payouts start.

Inactivity benefit — the permissionless dead-man's-switch

Each annuity designates a beneficiary address and an inactivityTimeout period. The lastActivityTime is updated whenever the annuitant:

Claims a payment (claimPayment)
Records activity (recordActivity)
Changes the payment destination (setPaymentDestination)

If block.timestamp > lastActivityTime + inactivityTimeout:

Anyone can call triggerInactivityBenefit(annuityId) — fully permissionless
A final harvestYield runs, then currentValue + bufferReserve + freshly-harvested are withdrawn from strategies
The total transfers to the designated beneficiary
State transitions to TERMINATED

This is a decentralized estate-planning primitive. If the annuitant is incapacitated or deceased, the beneficiary receives the remainder without any off-chain legal process — no probate, no will execution, no trustee paperwork. It is also the only reason someone besides the annuitant can move funds out of their annuity.

Payment routing — annuities as composable cash flow

Payments default to the annuitant's wallet, but any address works via setPaymentDestination(annuityId, destination):

Destination	Use case
Direct wallet	Standard income
Usura	Auto-compound payments into another yield strategy
Fideicommissum	Fund an irrevocable trust with annuity income
Any address	Charitable giving, DAO treasury, sub-account

This turns every annuity into a composable cash flow. Three example structures the whitepaper calls out:

Annuity → Usura → Fiscus. Annuity payments are routed to Usura, which auto-compounds them into a managed pool. A portion of each distribution is reinvested rather than taken as income.
Annuity → Fideicommissum. Annuity income funds an irrevocable on-chain trust for beneficiaries — useful for generational giving or funding a structured trust from a yield-bearing position.
FRS → Annuity → Wallet. Revenue-share distributions from an FRS pool fund annuity principal, structuring protocol yield into regular income.

Why on-chain annuities aren't just "DeFi in a costume"

Three honest advantages over TradFi annuities:

Contract transparency

TradFi annuity contracts are dense, intentionally obfuscated, and written for the issuer's optionality at the buyer's expense. Buyers often discover the real terms years in, when a surrender penalty eats their withdrawal.

Annuitas is code. Payment formulas are readable. The fee structure is a public function. The waterfall priorities are explicit. There is no fine print to hide.

No counterparty default

TradFi annuities depend on the insurance company staying solvent for 30+ years. Many haven't. State guaranty associations cap protection below many real balances.

Annuitas positions are backed by on-chain reserves — share-isolated yield strategies, a per-annuity buffer, and (in V2) a publicly-auditable Guard pool. If the protocol is undercollateralized, anyone can see it and act on it. There is no hidden-reserves accounting.

Additional guarantees the contract enforces directly:

The DAO (Tribunus) cannot withdraw annuity funds, change core parameters of an existing annuity, or terminate annuities. Once created, an annuity's type, frequency, principal, and beneficiary are immutable.
Pause only blocks new-annuity creation. If Tribunus pauses the contract (e.g., in response to a security incident), existing annuities continue paying — no user is ever locked out of their income stream by a governance action.
No price oracles. Payments are denominated in the deposited asset; there is no oracle dependency in the payment math, and therefore no oracle-manipulation attack surface.

Composable cash flow

TradFi annuities are illiquid instruments. Selling early triggers surrender penalties of 5–8% of principal. Routing payments to anything other than the annuitant's bank account requires paperwork.

Annuitas payment routing lets you plug the income stream into any other on-chain destination in one transaction — Usura, Fideicommissum, a treasury multisig, a charity. V2 adds NFT receipts, which open a secondary market for annuity positions themselves.

Integration with the rest of the Lucrum ecosystem

Annuitas does not stand alone. Every neighboring module plugs in:

Pensio (decentralized pensions) uses Annuitas as its terminal payout layer — a Pensio position can automatically convert to a Fixed-Term Annuitas at the target retirement date.
Fiscus (managed pools) is a balanced-strategy backing route for annuity principal.
Creditum (lending) is the conservative-strategy backing route.
FRS pools (asset-class revenue shares) are the growth-strategy backing route; FRS pool yields can also fund annuity principal directly.
Guard (insurance) backstops the Guaranteed tier's minimum payment floor in V2.
Tribunus governs fee splits, approved assets, yield-router whitelisting, and strategy preset parameters — all via timelocked DAO proposal.
Fideicommissum (irrevocable trusts) composes both ways: a trust's maturity can fund an annuity, and an annuity's payments can feed a trust.
Usura (auto-compounding) is a first-class payment-destination target for reinvesting annuity income.

When an Annuitas position makes sense

Honest framing of the three variants:

Variable Annuitas is most useful when:

You want yield exposure but prefer scheduled disbursements over manual claiming
You want to avoid any principal drawdown
You're matching a liability that can tolerate payment-amount variance

Fixed-Term Annuitas is most useful when:

You need known nominal cash flow for a specific future window
You're matching a defined liability schedule (child's tuition, property purchase, runway)
You want to lock in today's yield expectations before they compress
You're comfortable with principal amortization over the annuity's lifespan

Guaranteed Annuitas is most useful when:

Your downside sensitivity exceeds your upside appetite
You need a floor and are willing to pay a premium (via fee or yield-allocation haircut) for it
You're planning for V2's active Guard coverage — V1 tracks shortfall but does not cover it

In all three cases, the comparison is not "DeFi or nothing" — it's DeFi or the TradFi equivalent. Annuitas wins on transparency, no counterparty default, composable payment routing, and a permissionless dead-man's-switch. TradFi wins on regulatory protection (state insurance guaranty associations), brand familiarity, and tax-deferred growth (jurisdiction-specific — consult a tax advisor).

What's next

Lucrum Architecture — the full module map (FOLLIS, FRS, Vestibulum, Tribunus, the yield engine)
Pensio: Retirement Planning On-Chain with Automatic Annuity Conversion — upcoming
Fideicommissum: Irrevocable Trusts and the Annuitas Integration — upcoming
Guard Insurance: The V2 Roadmap for Guaranteed Annuitas Coverage — upcoming

Or browse the Lucrum product page for the current deployment status across EVM and Solana.