Branches and tiers
A registry of thirty-two slots with twenty branches in it, three tiers set by how a name can fall in a minute, eight measured criteria that open a dormant branch, and what a second version would be.
Spec v0.9.1, reviewed 2026-09-08
Every collateral has its own Branch contract, its own Stability Pool, its own price adapter, its own volatility oracle and its own vault. A branch never holds another branch's collateral, never lends it out, and never pools its risk with another. The registry that lists them is built once with thirty-two slots: twenty are filled at deployment and twelve stay empty in this version.
Additional collaterals can come with a later version of the protocol, deployed separately; moving to it is each user's choice.
Rule R-12.3.1, Rule R-3.11
The three tiers
A tier is set by one question: how far can this name fall between two moments when the protocol can act? An index fund diversifies its issuer risk away and does not gap on an earnings release. A single company does, whatever its size.
| Tier 1 | Tier 2 | Tier 3 | |
|---|---|---|---|
| What is in it | Broad-market funds and gold | Mega caps, silver, large caps | The four names that fall furthest in a minute |
| Loan-to-value ceiling | 80% | 75% | 65% |
| Loan-to-value floor | 60% | 50% | 40% |
| Liquidation threshold | 115% | 122% | 140% |
| Solvency tolerance | 8.7% | 12.7% | 22.9% |
| Last cap step | $3,000,000 | $2,000,000 mega caps, $1,500,000 otherwise | $1,000,000 |
The ceiling is a ceiling. The limit of a given day is recomputed from the volatility of the last 7 days and 30 days, and on a lively name it sits below the ceiling most of the time. See volatility and the borrowing limit.
Tier 1, four branches
SPY, QQQ, VTI, GLD. Indices, broad-market funds and gold. No single company is in this tier, and that is the whole rule.
Tier 2, twelve branches
The six mega caps AAPL, MSFT, GOOGL, AMZN, META and NVDA, plus SLV, AVGO, AMD, CSCO, LLY and XOM.
The mega caps sit here, and not in tier 1, because size does not stop a gap. META fell 26% in one minute in February 2022, NVDA 17% in January 2025, AMZN 14%, GOOGL 9%. Tier 1 tolerates a fall of 8.7% between two prices before a liquidation stops covering the debt it repays. Tier 2 tolerates 12.7%. A name with an earnings date belongs where the tolerance is wider (decision D142).
Risk
Even at tier 2, an earnings gap of 25% in one minute exceeds the tolerance. The Stability Pool then buys collateral worth less than the debt it burns, and the branch records bad debt. Past 0.5% of its current cap in cumulative bad debt, that branch's ladder is locked where it stands, for good. The figures are worked through in liquidation and bad debt.
Tier 3, four branches
TSLA, PLTR, COIN and NFLX. At 140% the tolerance is 22.9%, so a fall of 25% in one minute is absorbed with a normal gain for the pool.
NFLX moved here from tier 2 on the measurement rather than on the category. On an earnings date it falls further than tier 2's margin of 12.7% covers, and a stock that does that belongs where the margin is 22.9%. It therefore carries a threshold of 140%, a ceiling of 65%, a floor of 40%, a rate floor of 4%, a counter cap of 8%, the 150-day wait before it may open, depth and capitalisation thresholds of 200,000 and 2,000,000 dollars, and a last debt step of $1,000,000.
MSTR, MU and HOOD were excluded by the founder. VOO and IWM have no Robinhood Chain token at all, so they are not branches; VTI and SLV take their places.
What is open at genesis
Two branches lend on day one. The rest are deployed with activatedAt == 0: they cannot mint, they accept Stability Pool deposits that sleep, and they open by themselves when eight measured criteria are all true.
| Branch | State at genesis | Why |
|---|---|---|
| SPY | Active | The only branch whose price depends on no signer at all: two on-chain pools of 9.8 and 1.9 million dollars per 1% of move |
| AAPL | Active | A non-reporter group exists, so the median is never made by the reporters alone |
| GLD | Active only if its gold sources verify | No exchange feed for GLD exists on this chain, so its single anchor is a signed session feed and there is no second to fall back on. It ships dormant unless four weekends of measurement confirm the source |
| QQQ | Dormant | Its on-chain pool holds 4,000 dollars per 1% of move, and the signed index feed was not readable at measurement. Two twin markets from one signer group is one group |
| NVDA | Dormant | Its only non-reporter source is a hooked pool of 254,000 dollars. Without a signed 24/7 feed the branch would be frozen before and after a gap, so it does not open |
| The other fifteen | Dormant | Not yet measured, or not yet deep enough |
No branch is active at genesis on a seven-day check. Any branch that lends on day one must have been at full price quality for at least 80% of the hours of four measured weekends, the same bar as the fifth activation criterion (decision D141).
The eight activation criteria
activate() is permissionless and succeeds only if all eight hold. It returns the first one that fails, so a dormant branch can always say what it is waiting for.
| Criterion | Tier 1 | Tier 2 | Tier 3 | |
|---|---|---|---|---|
| 1 | Days since deployment | 60 | 90 | 150 |
| 2 | Twenty-fifth percentile of exit depth at 2% | 1,000,000 | 500,000 mega caps, 300,000 otherwise | 200,000 |
| 3 | Hourly depth samples collected | 84 of 168 | 84 of 168 | 84 of 168 |
| 4 | On-chain capitalisation of the token | 8,000,000 | 4,000,000 | 2,000,000 |
| 5 | Hours at full price quality in the last 28 days, out of 672, and a covered volatility window | 538 (80%) | 470 (70%) | 403 (60%) |
| 6 | Anchor deployed, with no halt over 72 hours in the last 90 days | 60 days | 60 days | 60 days |
| 7 | State at the moment of the call | Full quality, no pending corporate action | idem | idem |
| 8 | Stability Pools of the branches already open | no condition | 40% of fyUSD supply | 40% of fyUSD supply |
Criterion 5 counts hours in which the branch reached full price quality, and a slot is marked only if somebody called poke() during it. A dormant branch nobody watches never activates, which is the intended failure. Criterion 5 also requires 15 days of the 30 days volatility window to be covered, so a branch opens with a measured volatility rather than a prior.
No key can force an activation and no key can prevent one. There is no deadline.
Rule R-12.3.2, Rule R-12.3.3
What each branch reads for a price
The source registry is fixed in each adapter's constructor: between two and eight sources outside the anchor, from at least two families and at least two signer groups. Families and groups are explained in the composite price.
| Branch | Anchor | On-chain pools | Signed index or perpetual | Twin markets | Weekend quality |
|---|---|---|---|---|---|
| SPY | Exchange feed, then signed session feed | Two, 9.8M and 1.9M per 1% | Index perpetual, signed index | Three twins | Full, measured |
| GLD | One signed session feed, and no second | One hooked pool, 669k | Gold spot, gold perpetual, PAXG | One, disqualified on depth | Full, measured |
| QQQ | Exchange feed, then signed session feed | One, 4k, disqualified | Signed index, if readable | Three twins, one group | Frozen without the signed index |
| AAPL | Exchange feed, then signed session feed | Two, 531k and 919k | 24/7 signed feed, index perpetual | Four twins | Full, measured |
| NVDA | Exchange feed, then signed session feed | One hooked, 254k | 24/7 signed feed, perpetual | Three twins | Full with the signed feed, frozen without |
| AVGO, AMD, CSCO, LLY, XOM | Exchange feed, then signed session feed | To measure | No 24/7 signed feed exists | Twins by reporter | Degraded at best on a weekend, frozen if no deep pool |
| The rest | To measure | To measure | 24/7 signed feed | Twins by reporter | Full quality, subject to measurement |
The last two rows are the price of independence, and it is stated rather than hidden. Six tier 2 names have no signed 24/7 feed at all. On a weekend their only non-reporter source is an on-chain pool. If that pool is thin, the branch is frozen: nobody is liquidated, and everybody can still repay. In session the exchange feed is itself a group, so those branches reach full quality.
Each branch also registers its own vault pool as an on-chain source, alongside the USDG pools and never instead of them. In the first year that pool is below the qualification floor of 0.10× and counts only toward exit depth. See the vaults.
Rule R-12.3.5, Rule R-3.2.15
What a second version is
There is no migration and no upgrade path. A version 2 is a complete new deployment: a new stablecoin, new branches, a new peg module. Version 1 does not die; it keeps working, its caps stop rising past the last step they reached, and it enters its terminal mode only through its own triggers.
The only bridge is economic. A version 2 peg module may accept version 1 fyUSD as a reserve asset at par, bounded by its own cap, for as long as version 1 is not in its terminal mode. Positions do not move by themselves; a borrower repays on one side and opens on the other.
The team's intent for a version 2 is readable on chain as three signals in FBRVote, one of which releases a stream to an elected deployer and expires unclaimed if nobody is ever elected. See FBR internals.
Rule R-12.4
Modules
Every contract Fyber deploys, how many instances of it exist, what it is responsible for, and which constants it owns for ever.
The composite price
How a price exists at three in the morning on a Sunday: three families of live markets, four groups of signers, a weighted median nobody can carry alone, and a clamp around the last exchange print.