The treasury and the buy-back
A keyless contract with a frozen order of spending, a quarter of every dollar of revenue buying FYBER and burning it from the first settlement, a keeper vault that pays whoever does the work, and a liquidity position nobody can withdraw.
Spec v0.15, reviewed 2026-09-09
The protocol has a revenue and nobody collects it. What it takes is fixed, what it does with it is fixed, and what it never takes is engraved. Treasury has no owner, no setter, no withdrawal function and no address of a person anywhere in its constructor.
Rule R-19.17, Rule R-3.34, decisions D196 to D201, D226 to D232, D242 to D248
What comes in
| Source | Amount |
|---|---|
| Interest | 20% of it, multiplied by the health of the Stability Pools, and nothing at all under 40% |
| Vault pool fees | 50% of the 0.25% those pools charge |
| Micro-fees | the origination floor and the rate-change floor, both 0.1%, from 365 days after deployment and zero before |
| Liquidation bonus | 10% of the bonus, from the same date, as stock to be sold |
| The initial liquidity position | its fees in ether, continuously; its FYBER fees are burned instead |
Nothing else. In particular: no fee at any date on repaying, adding collateral, closing, withdrawing, taking money out of a pool, taking USDG out of the peg module, or claiming anything. That list is fuzzed function by function.
The cascade, in order, with no key
settle() is permissionless and callable once every 3,600 seconds. It spends in an order written into immutable constants.
Four steps, always in this order
- buy-back floor — 25% of the fyUSD that came in since the last settlement goes to the buy-back before anything else
- gas — the keeper vault's shortfall, paid in ether first with no ceiling, then in fyUSD out of the three quarters that remain, bounded by 50% of the rolling 30 days fyUSD intake
- reserve — 60% of what is left, until the backstop holds 2% of the debt; the other 40% goes to the buy-back
- buy-back — the rest. When the reserve is full, that is all of it
Under bad debt, or in the terminal mode, the buy-back is closed and every step that would have fed it feeds the backstop instead. In the terminal mode the backstop then passes the residue to the Stability Pools.
A settlement never reverts for a reason of routing
Selling an inventory of stock is a separate, permissionless, best-effort function, not a step of
the cascade. The conversion of fyUSD into ether for the keeper, and of ether back into fyUSD in the
terminal mode, are attempted and skipped on failure with an event rather than a revert. A
settle() reverts for exactly one reason: it was called too soon. A branch whose inventory nobody
can sell keeps its inventory without blocking anything else.
Rule R-3.34.1, decision D242
Two things about the ceiling on gas are worth stating precisely. The rolling intake it is measured against is counted in fyUSD only — the treasury reads no price of ether and no price of a stock, so it cannot value them — and the ether it holds pays gas first and without a ceiling, because that ether comes from the liquidity position and is the one source of gas that does not depend on the debt existing yet. The buy-back floor does not raise the ceiling on gas; it reduces what is left to reach it, which means the keeper vault stays in its economy mode for longer. That is the trade, and it is stated.
Risk
The reserve is the variable that absorbs this choice. Because a quarter of every dollar buys FYBER before the reserve gets anything, the reserve holds on the order of 0.2 to 0.5% of the debt through the first two years rather than its target of 2%, and does not reach the target inside five years on the modelled path. One layer of bad-debt cover is therefore thinner than the target suggests. Read liquidation and bad debt.
The reserve target is read as 2% of the larger of today's debt and the highest debt of the last thirty days, from a ring of daily readings. A crash or a whale's repayment therefore cannot make the reserve look suddenly over-full and release it into an irreversible burn: the target falls at the pace of a month.
Rule R-19.1.2, Rule R-19.1.3, decisions D226, D231, D252
The keeper vault, and why nobody is named
Nothing in this protocol runs on a machine belonging to its authors. There is no server, no keeper and no watcher, at any point, by decision. What has to be done is done by whoever wants to, and the keeper vault reimburses them in ether.
| Work | Reimbursed when |
|---|---|
| Observing a branch's pools, and poking what is due with it | the oldest observation among the pools the adapter retains, the 2 conversion pools included, was at least 300 seconds old — 540 seconds in economy mode |
| Settling an epoch | the lot at the head has been settleable for at least 120 seconds; the gas of the call is reimbursed in full, bounded per request processed, and the bonds of the requests that minted are passed through to the caller on top |
| Executing a buy-back call | there is at least the minimum call size released |
Each is capped per call, and each cap is a gas measurement due before deployment rather than a policy: not fixed yet for an observation, not fixed yet per settled request, not fixed yet for a buy-back call.
The refunded heartbeat also observes the two pools that convert one unit into another — FYBER against ether, and the settlement asset against ether — whenever their own last observation is that old, and their age counts towards whether the refund is due. Without that, the price of FYBER in fyUSD, the conversion of fyUSD into ether, the buy-back and the terminal mode all waited on three observations nobody was paid for. It costs about two more pool writes per heartbeat, inside the same per-call ceiling.
What the refund measures is measured, not estimated: the vault reads the remaining gas as its first instruction and again just before it pays, and the difference is what it reimburses, at the block's own base fee and never at a priority fee or a data cost. The gas a transaction costs before its first instruction — the intrinsic cost and the calldata — is therefore not counted; the 20% premium on top is what covers it, and that is said rather than hidden.
An observation call never reverts for want of a balance: the work happens, the amount due is recorded, and the vault pays what it can. What the settlement reimbursement is not is netted against the bonds: it is the gas actually spent, up to the cap per request, which is what lets a lot posted the day before the base fee rises still find somebody to settle it. The bonds arrive from the other side. Every request that is refunded sends its bond to the vault through receiveBonds, and each of those bonds is the size of the ceiling on reimbursing one settled request, so a queue of empty requests costs the vault nothing at all — and its author recovers none of it by clearing the queue themselves.
The bonds of the requests that minted pass through the vault rather than staying in it. The settlement hands them back as a return value, the vault takes them at a plain receive() with no logic attached, and forwards them to whoever made the call. If that forwarding fails — a caller that will not take ether — the amount becomes a credit inside the vault, pulled later with claimBond(). Nothing is stranded, and the vault never keeps a bond that was owed to a settler.
How the vault asks for money
spend floor per day = 20 branches × 160 observations × the per-call cap, computed at construction: not fixed yet
shortfall(window) = max( 0, days × max(average daily spend due, spend floor) − balance )
economy mode below thirty days of cover, which stretches the observation cadence and the settlement grace
Two details of that formula are corrections of a fixed point that would otherwise have existed. The spend counted is the amount due — computed at each eligible call, whether or not it was paid — so a vault that cannot pay still knows what it owes. And the floor is computed at construction, so the shortfall is non-zero from the very first day, before anything has been spent at all: the first settle() therefore pays something, rather than paying nothing because nothing had been paid.
Risk
What the keeper vault costs is larger than what the protocol earns for a long time. Two branches observed every fifteen minutes cost roughly 2,300 dollars a month at a low base fee; sixteen branches every five minutes are of the order of 8 to 10 thousand a month, an order of magnitude more once the chain's gas subsidy ends. That is structurally more than 20% of the interest under twenty to thirty million dollars of debt. The cascade caps the gas at 50% of the fyUSD intake and the economy mode engages by itself; the ether from the liquidity position funds this before any interest exists. Without funding, a branch whose pools stop being observed is frozen at night — nobody is liquidated and every exit stays open, which is the direction that protects everybody, and not a good outcome.
Rule R-3.33.1, decisions D197, D225, D243, D258
The one route that sells
Every flow that sells goes through one immutable router: vault fees, the backstop's recovered collateral, the treasury's inventory, the wrapper's collateral, and a pool depositor's own gain when they ask for it. A liquidation never does — the Stability Pool absorbs, and that is the point of the pool.
Stock is sold either directly into the branch's own vault pool, or into the deepest whitelisted USDG pool and then through the peg module. fyUSD is turned into ether through the peg module's exit when its window allows, and through the fyUSD/USDG pool when it does not, then through a whitelisted USDG/ether pool. Every leg is bounded to 25% of that pool's window depth and to 3% under the branch's sale price, and the ether legs are bounded by the truncated 30-minute average of the USDG/ether pool read from the shared observer — the same kind of reading the price layer uses, and never a feed.
That sale price is a live figure rather than a remembered one. It is the higher of two numbers: a base — the branch's reference price while it lends, or the last good price once it has shut down — and the median of the time-weighted averages of the pools the branch currently counts as fresh. Whichever of the two is higher is the bound, so an inventory whose market has moved up is never sold against a number that stopped moving. In shutdown, or while liquidations are frozen, a routed sale needs at least 2 fresh pools to run at all: with fewer the sale price is zero and every routed sale reverts NoPrice. Nothing is stranded by that — redemption in kind, redistribution and the surplus sweep are the ways out that do not need a price.
The router reverts when it cannot do better than its bound. Its callers in the treasury never turn that into a revert of their own: they catch it and skip the step.
Rule R-3.35.1, decisions D201, D242, D248
The liquidity position nobody can withdraw
10,000,000 FYBER of FYBER sit in FYBERLiquidity from the deployment sequence, inert. At the launch — the first season, 180 days after deployment — a permissionless call reads the ether price of a dollar once, converts a target of 0.005 dollars into ether, and places the whole amount as a single-asset position between that price and 10× times it, on the FYBER/ether pool of fee 1%.
That gives a capitalisation at the opening price of $50,000 on the position alone, and a fully diluted value of $500,000 against the written cap.
It sells upward, buys back downward, and never leaves
There is no withdrawal function in that contract's interface. The position is never recentred, never reduced and never removed, with one exception: once the price has passed the upper bound and the position is entirely ether, a permissionless call sends that ether to the treasury and the position ceases to exist. The ether it takes in on the way up stays in the position and buys FYBER back on the way down. Only the fees leave, continuously: the ether to the treasury, the FYBER burned.
Rule R-3.36.1, Rule R-19.18
If the price reading is unavailable at the launch, the call reverts and anybody retries later; after ninety days of that, it falls back to the truncated average of a USDG/ether pool. Same target in dollars, same single conversion, another source after ninety days of failure — and no key either way.
The only price of ether the whole token layer reads is that one reading, at that one moment. No rule of the core, and no rule of the token layer, reads a price of FYBER at all.
Rule R-3.36.1, decisions D203, D235, D248
The buy-back: slow, bounded, and burned
The buy-back is not an auction and has no target. It is an ordinary buyer with three bounds.
What one call may buy
each arrival of revenue opens a tranche, released linearly until the next one, over at least 3,600 seconds
a call buys at most what is released and not yet bought
and at most the amount that moves the reference pool by 0.2%, measured on the smaller of the pool's live liquidity and its window minimum
at a price no worse than the 30-minute average less 2%
and at least not fixed yet per call, so the gas never costs more than the purchase
A sandwich loses money on it
A trader who frames a buy-back call has to cross the reference pool's fee of 1% twice to capture at most 0.2% of price movement. That is a loss, and the assertion is checked at deployment: the impact ceiling is under the pool fee. The average-price bound closes what would be left. No auction is needed, and none exists.
Rule R-19.5.1, decision D232
The window minimum rather than the live liquidity is what stops somebody depositing liquidity at the tick a block before a call to enlarge it. Withdrawing liquidity, on the other hand, lowers the bound and simply makes the pending amount wait — no loss, only patience.
What is bought is burned. All of it, through the eighth season — that is 100% of every purchase, for two years — and after that the protocol's own stake's share is burned and the rest is credited to the stakers who are there. The exit fees of the staking contract are burned in full as well.
Before the launch, revenue that arrives has no pool to buy on. It accumulates in one tranche and is released at the pace at which it arrived, not in a single movement on the opening position.
The buy-back closes entirely while any branch carries bad debt and in the terminal mode; the pending amount waits, and in the terminal mode it goes to the backstop.
Risk
No target is published, and none exists. "A tenth of a per cent of the supply a day" was measured and is unreachable in dollars at every date of this version, so it is not an argument anybody here makes. What the buy-back is worth against a year's emission is modelled at 5.5% in the second year and 113% to 123% in the fifth, at a modelled price. The only mechanical floor under the price of FYBER in the first year is zero. Nothing in the protocol supports a price and nothing is meant to. Read FYBER risk.
What is published, after the fact, is the net emission of each season: minted less burned, as a measurement.
Rule R-19.5.1, Rule R-19.5.2, decisions D227, D232, D238
What the treasury cannot do
No discretion exists anywhere in it
There is no owner, no role, no timelock, no withdrawal function and no address of a person in any of these contracts. The order of spending is immutable. The Closer key does not know the treasury, the keeper vault, the sale router or the liquidity contract, and no freeze it can set touches any of them. Every entry point is permissionless, and every one of them reverts only on its own arithmetic.
Rule R-3.34.1, Rule R-12.1.7
What that also means is that the treasury cannot pay for an audit, a legal opinion or an off-chain service, because those are not on-chain flows with fixed destinations. Whatever is paid for outside the protocol is paid for outside the protocol, and this page does not pretend otherwise.
What follows from this page
- Where the treasury's share of the interest comes from: interest and rates.
- What the buy-back does to a staker: FYBER internals.
- The work the keeper vault pays for: borrowing by epoch and the composite price.
- What the reserve is a layer of: liquidation and bad debt.
The equity vaults
Twenty vaults that create the stock-against-fyUSD market the protocol was missing, that are its own price source at night, what they buy in depth, and the honest size of what that is.
The accounting guard
A permissionless contract with no address of its own that closes a branch when two of its internal counters stop agreeing, reads no price, pays nobody, and cannot be undone.