FBR internals
Seven contracts, a fixed supply distributed by on-chain counters, a staking weight that does five jobs, an exit grid that prices impatience, and an invariant that keeps all of it out of the risk layer.
Spec v0.9.1, reviewed 2026-09-08
FBR exists at deployment as contracts nobody owns. The whole supply is minted once, toward six destinations, and no function anywhere increases it. There is no sale, no auction, no company and no treasury. Distribution is by seasons of counters written on chain, converted by a curve fixed in the constructor, with no human act at any point in the process.
The one thing to hold on to while reading: no regime, threshold, cap, rate or activation criterion reads FBR, and the Stability Pool yield contains no emission.
Rule R-12.10.1, Rule R-19.12.1, principle P10
The seven modules
| Module | What it does |
|---|---|
FBRToken | Fixed supply, minted once. Burn callable by the backstop and the distributor and by nobody else |
UsageLedger | Counters per season and per class, written by 82 addresses, closed automatically |
FBRDistributor | Settles a season, releases allocations, receives the revenue share, buys and credits |
sFBR | Dated stakes, one weight, the exit grid, the credit index, the slash index |
LPMining | Custody of FBR/fyUSD liquidity positions and hourly checkpoints |
FBRVote | Three objects, one of which can release a stream to an elected deployer |
VestingWalletCliff | One per team address, with a fixed beneficiary in place of an owner |
Supply and allocation
100,000,000 FBR, minted once.
| Destination | Share | Release |
|---|---|---|
| Team | 20% | cliff one year after the first season, then three years linear |
| Season zero, retroactive | 2% | liquid when the first season opens |
| Seasons one onward | 47% | the curve below, streamed over 90 days |
| The protocol's own stake | 21% | never. There is no withdrawal function on that lot |
| A second version's endowment | 10% | only by an election, or never |
There is no vesting on a reward. The exit grid and the stream do that work, and a locked reward that nobody can reach is a known failure of other protocols.
Rule R-19.7.1
Seasons, and the four counters
A season is 90 days long, counted from the first one, which opens 180 days after deployment. Season zero is everything before that. A season closes automatically the moment the next begins, and any write to a closed season reverts — absorbed by a try/catch on the core side, so no protocol operation can ever fail because of the ledger.
| Class | Unit | Share of a season |
|---|---|---|
| Depositors | fyUSD-days in a pool or its wrapper | 35% |
| Borrowers | fyUSD of interest accrued, at a rate capped by tier | 20% |
| Pool liquidity | in-range liquidity times time, on the FBR/fyUSD pool | 15% |
| Vault liquidity | in-range value times time times the lock multiplier, per branch | 30% |
Season zero used 55% and 45% on the first two and nothing on the others, because neither pool existed yet.
The borrower class counts interest actually accrued and nothing else. Origination fees and rate-change fees earn no counters at all, and the rate that counts is capped at 3% on tier 1, 5% on tier 2 and 8% on tier 3, which is twice each tier's floor. Choosing a rate above that cap pays more to the Stability Pool and earns nothing extra here.
Staked FBR multiplies the first two counters by up to 1.5×, saturating at the same weight per unit as the pool boost. It does not multiply the vault class, where the lock is already the multiplier.
The counters are non-transferable, are converted alone, and are not written at all while a branch has no price.
Rule R-19.8.1, Rule R-19.8.2
The curve, and the two ceilings
The season budget
B_0 = 2,000,000 FBR
B_k = 47% of supply × ( 2^(−(k−1) × season ÷ half-life) − 2^(−k × season ÷ half-life) ), half-life 912 days
the first four seasons run that profile at 1.4187×, every season after it at 0.8683×
season 1 4,408,000 FBR · 2 4,117,000 FBR · 3 3,845,000 FBR · 4 3,590,000 FBR · 5 2,053,000 FBR
There is a step at season five, and it is 43%
The first year is deliberately front-loaded and the tail is deliberately not. Season 5 emits 2,053,000 FBR, which is 43% less than season 4, and every season after it falls by about 6.6% from the one before. Nobody should discover that on the day it happens, so it is written here and on the FBR page rather than left in a curve.
Season zero and the first four seasons together are 17,960,000 FBR; the four seasons on their own are 15,960,000. The second year is 7,430,000 FBR and the third 5,650,000 FBR. Seasons 13 to 16 total 4,300,000, and everything after that is 13,660,000, spread thinner and thinner without ever reaching zero.
Two ceilings, asserted at deployment
The first season is at most 6.65% of the supply, and season zero plus the first four seasons at most 17.96%. Both are constructor assertions, so a deployment that broke either would revert. The numbers are a third above what Ethena distributed over the same window, and that multiple is the whole of the justification.
Rule R-19.8.3, decision D156, invariant 65
A class with no counters at all carries its share forward to the next season rather than losing it.
Conversion and delivery
settleSeason(k) is permissionless, runs once, and only after the season has ended. It freezes the totals and computes each allocation as the class share of the budget, times the user's counters over the class total.
The vault class is split first between activated branches, in proportion to their current cap step, and only then between the providers of each branch. A dormant or shut branch weighs zero.
claim(k) releases a liquid stream over 90 days for the first three classes; season zero is immediate. claimStaked(k) takes everything acquired and stakes it directly.
The vault class has no liquid path. claim reverts on it, and claimStaked is the only way out. With the exit grid that makes it liquid after 7 days, or at 70% of its value immediately. Delivering it liquid would have put a quarter of a season's emission on the market inside the stream, and the same tokens are what absorbs the first loss on the liquidity they reward.
Rule R-19.8.4, Rule R-19.8.5
The staking weight, which does five jobs
Weight of one lot
weight = stake × growth × (W0 + (1 − W0) × min(age, AGE_CAP) ÷ AGE_CAP) × slash index
W0 = 25%, AGE_CAP = 365 days
A fresh lot counts a quarter; a lot older than a year counts fully, so a one-year staker is worth four times a same-day one per token. Lots on their way out are excluded from the weight entirely.
The same weight is used for the share of the revenue buyback, the Stability Pool boost, the redemption shield, the season multiplier and the seizure base. There is one notion of weight and no second accounting.
The exit grid
The fee is a continuous line, not a set of steps. Four points are fixed and straight lines join them, so every hour of waiting is worth something and no minute is worth more than the one beside it.
Leaving costs what you refuse to wait
request, then withdraw after Δ. The fee falls along the line through
0 → 70% · 24 hours → 50% · 3 days → 30% · 7 days → nothing
so 12 hours → 60% · 20 hours → 53.3% · 2 days → 40% · 5 days → 15% · 6 days → 7.5%
an hour of waiting is worth 0.83 of a point on the first day, 0.42 up to the third and 0.31 up to the seventh
what is kept back is credited to the stakers who stayed; the protocol's own share of it is burned
exitPreview returns the curve and its slope at the caller's own position on it, so an interface shows what waiting another hour is worth rather than a table of four rows.
Requesting removes the amount from the weight immediately. A lot on its way out receives no revenue share, no boost, no shield, no multiplier and no vote, its age is frozen, and it remains seizable until it is actually withdrawn. Cancelling returns it to the stake, dated now.
Withdrawing part of a stake no longer resets the age of the rest. The age falls by the fraction taken out, age' = age × (1 − share withdrawn), so somebody who waits the full 7 days for a quarter of their stake keeps three quarters of their standing on the rest. That is what makes "free after seven days" true for a partial exit rather than only for a total one.
A request left past 7 days plus 7 days returns to the stake through settleExpired, which anybody may call, with no fee and at age zero.
The user never selects a rate. They select it by waiting, they can always wait longer, and no function accelerates anything.
Running from a seizure costs more than the seizure
Bad debt must sit uncovered for 24 hours before staked FBR can be seized. Somebody who requests an exit the moment they see it and withdraws at that same delay pays 50%, where staying and being seized costs at most 30%. The assertion checked at deployment is on the fee itself: the fee at the seizure delay exceeds the seizure ceiling. The race to the exit is arithmetically irrational at every point on the curve.
Rule R-19.2.5, invariant 66
Splitting an exit into a hundred requests costs exactly the same, because each lot carries its own timestamp and the fee is a function of that timestamp alone. Leaving instantly and re-staking costs 70% net. Holding a request open as a free option costs two weeks of zero weight and then the whole age.
Rule R-19.2.4, Rule R-19.2.6
Crediting, without creating a lot
Everything bought back, and every exit fee, is credited by an index rather than paid out.
How a credit lands
credit index += amount ÷ Σ private weight
at a user's next touch: E = weight × (index − snapshot), then growth ← growth × (1 + E ÷ stake)
The credit joins the lots that already exist, in proportion to their stake. No new lot is created, every lot keeps its own age, and the user's weighted average age is exactly unchanged. It is never liquid: it leaves only through the exit grid, and it is seizable in the meantime.
The two alternatives were worse. A new lot per buyback would be thousands of lots a year per staker. One aggregated lot dated at the credit would lower a one-year staker's average weight by nearly 4% on a 5% credit.
The share belonging to the protocol's own stake is burned rather than credited, which is the only burn in the system. On the first day that share is nearly everything, and at twelve months it is still about 90%: the protocol's lot reaches full weight before most private stakes do, so most of what is bought is burned rather than handed to anybody.
Rule R-19.5.2, decision D157
What the buyback is actually worth, year by year
The reserve fills first, so the buyback is close to nothing for a long time. Against that, the team's vesting releases 6,670,000 FBR a year from month 12 to month 48.
| Year | Buyback, as a share of that year's emission |
|---|---|
| 1 | roughly nothing: the reserve is still filling |
| 2 | at most 2% |
| 3 | at most 13% |
| 4 | 27% to 37% |
| 5 | 77% to 105%, so it crosses, once the team's vesting has finished |
Risk
The only mechanical floor under the price of FBR in the first year is zero. The buyback is not there yet, the reserve comes before it, most of what it does buy is burned rather than credited, and the emission and the vesting both run through that window. Nothing in the protocol supports a price, and nothing is meant to.
Seizure and auction
Bad debt is covered in three layers: the fyUSD reserve, then staked FBR, then redistribution across the branch's own positions.
The middle layer opens when bad debt has been uncovered for 24 hours, the reserve is empty, and at least 7 days have passed since the last seizure on that branch. It takes the lesser of five times the shortfall at the time-weighted price and what the ceiling allows, as the same fraction of every staked lot: private lots, exiting lots and the protocol's own lot alike, in no order at all. A staker is in that base from their first day.
The ceiling is 30% of the whole stake over a rolling 7 days, counted across every branch together rather than branch by branch.
The seized tokens go to a 24-hour auction whose accepted price rises from zero to one and a half times the average. Buyers pay in fyUSD, which is burned against the debt. Whatever does not sell returns to the stakes.
Risk
The dollar thickness of this layer is 30% of a stake whose price nobody controls. At a low price it is a few hundred thousand dollars for the whole protocol. It is noise, not insurance, and it is junior to the fyUSD reserve. Read liquidation and bad debt.
Rule R-19.3.1
Boost, shield, multiplier
All three divide something that already exists between users. None of them creates a unit of anything.
| Mechanism | Saturates at | Worth at most | Paid by |
|---|---|---|---|
| Pool boost | 0.25× of weight per fyUSD deposited | 1.50× of the average share | the other depositors, up to a third less |
| Redemption shield | 0.10× per fyUSD of debt | 2% on the sort key | the borrowers behind you in the queue |
| Season multiplier | the same as the boost | 1.5× | the other holders of counters in that class |
Every read of the staking weight from the core is a bounded static call. A revert gives zero, or one for a multiplier, and the core operation goes through regardless.
Liquidity mining
One canonical Uniswap v4 pool, FBR against fyUSD, whose id is known at deployment. Nobody initialises it for the protocol: the first provider chooses the price. The protocol posts no price, holds no position and sells nothing.
A staked position must sit on that exact pool key, be at least about a hundred per cent wide, and stay locked seven days. An hourly checkpoint counts a position only if it was in range at the previous checkpoint and at the current one. That rules out just-in-time liquidity, narrow positions, pool hopping and leaving at the first sign of trouble. If nobody provides, the budget carries forward, and the first provider to arrive takes the whole season alone.
Rule R-19.9.1
The second version's endowment
FBRVote carries three objects. Two are signals with no execution: a closer address and a parameter set that a published deployment script reads. The third elects a deployer, once, no earlier than a year after the first season, in a 30-day window, with a quorum of 25% and a two-thirds majority. Election releases a stream of 10% of the supply over two years. With no election, those tokens stay locked for ever. The protocol's own stake does not vote, and one address counts for at most 10% of the private weight.
Risk
A third-party contract that staked on users' behalf and issued a liquid receipt against it would escape the exit grid entirely: its holders would sell the receipt instead of paying 70% to leave. It would also deprive them of the boost and the shield, which are computed per address and cannot be shared. Nothing in the protocol prevents such a contract from existing.
Rule R-19.6.1
The independence invariant
The risk layer cannot see the token
Any sequence of interactions with any FBR or vault contract leaves the reference price, the liquidation price, the regime, the branch ceiling, the activation test, the mint freeze, the rate floor, the redemption fee, the pool cap and the total flow to the pools unchanged. No path in the core reads a price of FBR. A revert inside the staking contract or the ledger fails no core operation. The token share is zero before the first season, zero under bad debt, and zero in the terminal mode.
Rule R-19.12.1, invariants 52 and 70
What FBR is not
Not a governance token for version 1. Not a source of yield for the pool wrapper. Not an asset whose price steers a parameter. Not tail insurance. Not a treasury. Not an entity. The season counters are neither a promise, nor an asset, nor a debt.
Rule R-19.14
What follows from this page
- The holder's guide: FBR and sFBR.
- Where the buyback money comes from: interest and rates.
- What can go wrong: FBR risk.
The equity vaults
Twenty vaults that create the stock-against-fyUSD market the protocol was missing, what they buy in depth, and the honest size of what that is.
Immutability and the Closer
No setter, no proxy, no role survives the deployment transaction; one key can freeze briefly or close for good, it can touch neither the prices nor the token, and it stops working on a date written in the code.