FYBER
A token with no claim on anything, that exists only once somebody has earned it, that can be seized to cover somebody else's bad debt, that costs to leave, and that can be worth nothing without a borrower or a depositor noticing.
Spec v0.15, reviewed 2026-09-09
FYBER is distributed for using the protocol. It is not sold, it does not govern version 1, and it never pays the Stability Pool yield, which is borrower interest and nothing else. What it does carry is a set of exposures that a holder should read before staking anything.
The mechanism is on FYBER internals and the user path on FYBER and sFYBER.
It carries no claim on anything
Risk
FYBER gives no right over fyUSD, over sfyUSD, over the collateral, over the reserve or over the protocol. No vote that changes a rule, no share of profits as a legal entitlement, no claim against any company, foundation or person, because there is no company, foundation or person behind it.
Rules R-19.14, R-15.4.1 (14)
The share of protocol revenue that ends up bidding for FYBER is a formula in deployed code. It is closed while any branch carries bad debt and in the terminal mode, and the treasury's own take of the interest is zero while the pools hold less than 40% of the debt, reaching its maximum of 20% only above 70%.
What exists at deployment, and what does not
The cap is 100,000,000 FYBER, written into the token contract with no function that raises it. What is actually in existence on the day the contracts land is 10,500,000 FYBER, and not one unit more until somebody claims something.
| At deployment | Amount | Where it is |
|---|---|---|
| The one-way liquidity position | 10,000,000 FYBER | Held by a keyless contract until it posts a single one-sided position against ETH, which no function can ever withdraw |
| The launch lot | 500,000 FYBER | Staked, in one lot, for the launch address |
| Everything else | Nothing | Not minted, and only minted when a user claims what they earned |
Risk
The launch lot is the only FYBER ever attributed to a person's address. It is 500,000 FYBER, half a per cent of the cap, staked at deployment for the launch address, and it is declared as a reserve of rewards to be handed out outside the protocol.
It is not vested, not locked beyond the ordinary grid, and not subject to any rule other lots are not: it leaves by the same exit grid as anybody's stake, it is seized at the same fraction as anybody's stake, and it carries weight in the same way. That is the whole of the protection, and it is a real holding by a real person from the first day.
There is no other allocation to the authors — no vesting, no schedule, no address that receives anything for having written the code — and that claim would be false without this paragraph.
Rules R-3.22.1, R-19.7.1, D234
Nothing is minted before it is earned and claimed
Closing a season mints no FYBER at all. It freezes the totals of that season and stops there.
FYBER comes into existence at the moment a user calls the claim: the amount they earned is minted to them, or minted and staked if they choose that, and the protocol's own lot is minted alongside it, pro rata, at 0.315385 per unit claimed. If everything across twenty seasons is claimed, that lot reaches 20,500,000 FYBER; if half is claimed, it reaches half of that. It grows with claims and does not exist beforehand.
Guarantee
A class of a season that nobody earned is never minted, in that season or in any later one. There is no carry-forward, no rollover and no settlement mint: unclaimed budget is simply supply that never comes into existence, and the cap holds even if every season is claimed in full.
Rules R-19.5.1, R-19.8.4, invariants 87 and 101
What that removes is an overhang nobody asked for: no season's budget sits minted and unowned waiting to be sold. What it does not remove is the dilution when people do claim, which arrives whenever they choose rather than on a schedule anybody can read.
The emission curve
| Season zero, for everything done before the first season opens | 4,000,000 FYBER, released over 90 days |
| The first season opens | 180 days after deployment |
| Seasons | 20, of 90 days each, then nothing ever again |
| First season budget | 8,816,000 FYBER |
| Each season against the one before | 0.873423559829 |
| Twentieth and last season | 673,821 FYBER |
| All twenty together | 65,000,000 FYBER |
| First year, season zero included | at most 33,120,000 FYBER |
Each season is split four ways: 35% to Stability Pool depositors by fyUSD-days, 20% to borrowers by interest actually accrued, 15% to providers of liquidity to FYBER itself, and 30% to the equity/fyUSD vaults, delivered staked.
The whole curve is geometric and it stops. There is no tail, no perpetual emission and no second programme, and everything the twenty seasons can produce is inside five years of the first one opening.
Risk
The first year can distribute 33,120,000 FYBER — about a third of the cap — while the protocol's own use locks a small fraction of that. The obligations that lock FYBER are quoted per fyUSD of deposit or debt: at a few million dollars of debt, the stake the pool boost and the redemption shield make worth holding is a few million units against tens of millions distributed.
Whoever receives the difference either holds it or sells it, and nothing in the contracts prevents the second. The counterweight the design has is that 30% of each season arrives staked rather than liquid, and cannot be sold at all for at least 7 days without paying to leave sooner.
The buy-back starts immediately, and burns what it buys
This is the largest change from the earlier design, and it changes the shape of the risk rather than removing it.
The buy-back no longer waits for the reserve to be full. At each treasury settlement, in this order and with no discretion anywhere:
- 25% of the incoming fyUSD goes to the buy-back, before anything else.
- The keeper's gas is paid, in ETH first and then in fyUSD, capped at 50% of the rolling intake.
- The reserve takes 60% of what is left, up to 2% of the debt; the remaining two fifths go to the buy-back too.
- Whatever is left goes to the buy-back. Once the reserve is at target, all of it does.
Everything bought is destroyed through season 8 inclusive. After that, only the protocol lot's share of each purchase is burned and the rest is credited to stakers' existing lots, at their existing age, never as liquid FYBER.
The buy-back is also deliberately slow, and that is a design property rather than a limitation. Each tranche of revenue releases linearly until the next settlement, over at least 3,600 seconds. A permissionless call then buys at most what has been released, and at most an amount that moves the reference pool by 0.2%, at a price no worse than the thirty-minute average less 2%.
Guarantee
No buy-back target is published, and none exists in the code. There is no share of supply per day, no floor, no schedule and no commitment of any kind. What is published, after each season and never before, is the net figure: what was minted, minus what was destroyed.
Rules R-19.5.1, D232, D238
Risk
The only mechanical floor under the price of FYBER is the ETH the liquidity position holds, and that is zero until the position has sold something. The position is one-sided at the start: it holds FYBER and no ETH, so there is nothing in it to bid with. It accumulates ETH only as FYBER is bought out of it on the way up, and whatever it accumulates goes to the protocol's treasury rather than to any holder.
The buy-back is not a floor either. It buys what revenue allows, when somebody calls it, bounded to a fifth of a per cent of pool impact per call. At an early debt level that is a small number of dollars a day.
The opening of that position is worth stating exactly, because it is the one number that looks like a price. It opens at 0.005, converted once into ETH at the moment it opens and then never re-read, with an upper bound at 10× times that. At the opening price the position alone is $50,000 of capitalisation, and $500,000 against the base cap.
Risk
That is a liquidity position, not an issue price and not a floor price, and it must never be presented as either. Nobody sold anything at it, nobody undertook to buy at it, and the number is a lower tick of a range rather than a valuation.
Staked FYBER is what absorbs bad debt after the reserve
This is the exposure most holders will not have priced. Staking is not only a claim on a flow; it is the second layer of loss absorption in the protocol.
When a branch has bad debt and the reserve is empty, after 24 hours anybody may seize staked FYBER and auction it, with the proceeds burning the debt. The seizure takes the same fraction of every staked lot — the protocol's lot, the launch lot, and lots already on their way out, all included, in no order at all. The ceiling is 30% of the whole stake over any rolling 7 days, counted across every branch together rather than per branch, and one branch cannot open a second seizure within 7 days.
The seizure is counted in fyUSD, because the debt it covers is: the shortfall is divided by the price of FYBER in fyUSD, which the reserve contract reads as the bounded average of the FYBER/ETH pool multiplied by the bounded average of the USDG/ETH pool. The auction that follows is descending: the accepted price starts at 1.5× that figure, fixed when it opens, and falls linearly to 0.2× it over 24 hours. Bids may be partial, and the fyUSD a bid pays is capped by the bad debt still outstanding, so the auction stops taking money once the shortfall is covered.
Risk
That price is a condition, not a detail. A seizure needs both averages to be valid and USDG inside the peg guard; while any of the three is not, the call reverts and nothing is seized. If that state lasts, the staked layer is skipped entirely — through no act of the stakers, and with no way for them to make it happen — and after 72 hours the debt is redistributed across the branch's own borrowers instead. The order of the layers is not a promise in either direction: a stake can be spared by a missing price, and a borrower can be redistributed onto while stakes are untouched.
Risk
You are in that base from your first day. There is no threshold of private staking below which the protocol's own lot absorbs the loss on your behalf, and no ordering that puts anybody last. Your stake can be taken to cover a loss on a branch you never touched.
Unsold FYBER is returned when the auction closes, so the realised loss is usually smaller than the seizure, but the amount that can be taken is 30% of the total over a week, and the only opt-out is not staking. The descending price cuts the other way too: the early hours are dear and may sell nothing at all, and if the market sits under the floor when the auction closes, the whole seizure comes back unsold and the debt falls to redistribution instead — the staked layer will have covered nothing.
A stake that has been requested for withdrawal is still seizable until it is actually withdrawn. That is deliberate: it removes the race to the exit in front of an announced seizure.
The layer is thin, and the specification says so rather than presenting it as insurance. 30% of the staked total is a few hundred thousand dollars at a plausible price and an early staking level, against branch ceilings that reach $65,000,000 in total. And the layer in front of it is thinner than its target suggests: with a quarter of every dollar of revenue going to the buy-back first, the reserve sits at something like a fifth to a half of a per cent of the debt for the first two years rather than 2%.
Leaving costs what you refuse to wait, and the cost is destroyed
The fee falls continuously with the time you wait, along straight lines between four fixed points. There are no steps to hit and no cliff to miss.
| You wait | Withheld, and burned |
|---|---|
| Nothing | 70% |
| Twelve hours | 60% |
| A day | 50% |
| Two days | 40% |
| Three days | 30% |
| Five days | 15% |
| 7 days | Nothing |
100% of what is withheld is destroyed, not paid to the stakers who stayed. An hour of waiting is worth about 0.83 points on the first day, 0.42 points until the third, and 0.31 points until the seventh. The curve is fixed in the constructor and read from the elapsed time. There is no function that accelerates it and no fee that buys a shorter wait.
Risk
Because the fee is burned rather than redistributed, a staker who stays gains nothing from a staker who leaves in a hurry. The supply falls, which is not nothing and is not a payment either. If you were treating other people's exits as a return to you, that is no longer how it works.
That shape is also what removes the race in front of an announced seizure: at the moment a seizure becomes possible the fee is still 50%, against a seizure ceiling of 30%, so leaving early costs more than staying and being seized.
The grid is genuinely a grid rather than a delay dressed as one: waiting 7 days costs nothing at all, so a reward delivered as staked FYBER is liquid at seven days.
Risk
A stake on its way out contributes nothing to the revenue share, the pool boost, the redemption shield or the season multiplier, from the moment the request is made. If the withdrawal window passes without being taken, the amount returns to the stake dated from that day, which means the age that gives it weight starts again from 25%. That return is performed by a function anyone may call, so it does not depend on the holder noticing.
Taking part of a stake out does not restart the clock on the rest. The age of what remains falls by the fraction withdrawn, so a holder who takes out a tenth keeps nine tenths of the age they had built.
The season counters are counters
Season counters are non-transferable numbers written on-chain by the modules a user touches. They are converted into FYBER by a formula, with no list, no root, no rate anybody sets and no human act at any stage.
Risk
A counter is not an entitlement, not an asset and not a debt. Its value depends entirely on the budget of the season it belongs to, on how many other people accumulated counters in the same class, and on what FYBER is worth when it is claimed. All three are unknown while the counter is being accumulated, and the third stays unknown afterwards.
A class nobody accumulated anything in mints nothing at all, so a season's actual issuance is not knowable until its claims have been made — and a claim can be made late, which means the dilution from an old season can arrive at any time.
Two things a holder should watch for
The version 2 vote is capped per address at 10% of the private weight, so no single holder decides an election on their own. That is a bound on concentration, not a guarantee of a good outcome: the endowment it releases is the largest single decision the token can make, and it can be made once.
Risk
Nothing prevents a third party from building a contract that stakes on users' behalf and issues a liquid receipt against it. Such a contract would escape the exit grid, because the stake would never leave from the holders' point of view, and its holders would lose the individual pool boost and the individual redemption shield, both of which are computed per address. It is the obvious route around the grid, it is not blocked by anything, and a holder should understand which of the two positions they are actually in.
What happens to everyone else if FYBER goes to zero
Nothing.
Guarantee
No price regime, no threshold, no cap, no rate, no activation criterion and no risk parameter reads FYBER, its price, its supply, the staked amount, or anything about the pool the buy-back trades in. A failure in any FYBER contract cannot make a core operation fail: the core writes to the counters inside a guarded call and reads staking weight through a bounded call that defaults to zero. The Stability Pool yield contains no emission at all.
Rule R-19.12.1, invariants 52, 70 and 100
At zero, a borrower pays the same rate against the same threshold, a depositor receives the same interest, the swap module works identically, and the second loss layer is worth nothing while the first and the third are untouched. That is the design intent, and it is the reason FYBER can be described plainly rather than defended.
Liquidity vaults
What a concentrated range actually costs when the stock falls, why the position becomes all stock below its lower bound, what the lock means, why the vault's own pool is the branch's night price, and why this liquidity is temporary by design.
What is measured before launch
Which hypotheses have come back, what they said, and which ones are still blocking. Every constant is final at deployment, so a value calibrated on a guess is a guess that lasts for the life of the protocol.