Peg and the swap module
What holds fyUSD near a dollar, what happens above and below, the cap that never rises, what a USDG depeg does, and the loop between the liquidity vaults and the reserve.
Spec v0.9.1, reviewed 2026-09-08
fyUSD is a debt token. Nothing obliges anyone to buy it at a dollar, and no entity guarantees its value. What keeps it near one is a set of mechanisms that pay somebody to push it back, and a reserve that is not deployed anywhere. This page is about where those stop working.
The mechanism is on The swap module and Redemptions.
The two sides of the peg, and what enforces each
| Side | What enforces it | Limit |
|---|---|---|
| Above a dollar | Anyone swaps USDG in at 0.05%, or opens a position and sells | The module holds while it has intake capacity under the cap |
| Above a dollar | Borrowing at the limit of the day, which mints fyUSD into a bid | Bounded by the branch ceilings |
| Below a dollar | Anyone swaps fyUSD out at 0.20% | Holds while the reserve is not empty |
| Below a dollar | Redemption: burn fyUSD, take collateral at the oracle price | Profitable roughly from 0.998 downward, once fees are paid |
| Below a dollar | A borrower buying discounted fyUSD to repay their own debt | Always available, never blocked |
Guarantee
The exit swap is never pausable. Not by the Closer key, not by a price regime, not by a depeg guard, not by a shutdown. It is refused only when the reserve is empty, and then the redemption path is still open.
Rules R-8.2.1, R-4.4.1 (i)
The franchise that lets the first fyUSD exist
The protocol is deployed empty, and a share cap on a supply of zero is zero. The module therefore carries an absolute franchise underneath the share cap: it may always have minted up to 1,000,000 fyUSD, whatever the supply is, and the share cap binds instead once it is the larger of the two, past a supply of about 3,333,333 fyUSD. How the protocol gets off zero from there is on How it starts. This page is about what the franchise concentrates while it does.
Risk
Inside that franchise, up to 1,000,000 fyUSD of fyUSD can be backed entirely by USDG. While the protocol is small that is a real concentration on one issuer, and the exposure is at its largest exactly when the protocol has the least of everything else. If USDG were worth ninety cents in that period, that fraction of the backing would be worth ninety cents.
It is a franchise rather than an exemption: the depeg guard still applies inside it, so the module refuses to mint at all while the USDG feed prints below 0.985.
The cap that never rises
Past the franchise, the module may hold at most 30% of the fyUSD supply. It is a constructor constant with no setter and no way to raise it, including by the Closer key.
What it buys. fyUSD does not become a wrapped USDG. Above the cap the ceiling is no longer defended by the module and fyUSD can trade above a dollar, which is a visible signal rather than a hidden dependency.
What is left over. Above the cap, a premium persists until borrowers arrive to sell into it. In practice that premium is the price of not having handed the stablecoin's backing to a single third party.
Repaying with USDG is subject to the same limit. The exemption it had before turned the module into an unlimited mint on the day USDG lost its peg, which is exactly the moment it must not be. A borrower above the cap buys fyUSD on the market instead.
If USDG loses its peg
The module reads a price feed for USDG and refuses to mint new fyUSD when it prints below 0.985. Swapping out is never refused, and repaying in fyUSD is never refused.
Risk
The guard protects the protocol from minting against a discounted dollar. It does nothing for the reserve already held: 30% of the fyUSD supply can be backed by USDG, and all of it while the supply is inside the franchise above. If USDG is worth ninety cents, that fraction of the backing is worth ninety cents. The reserve is not diversified, cannot be diversified, and nobody can move it.
Rule R-8.6.2
Whether the feed the guard reads is a price feed rather than a reserve attestation, and whether it publishes at all during a depeg, is a blocking pre-deployment check. If it is not usable, the guard is absent at deployment and the cap is the only line.
The reserve is never deployed
The USDG the module holds sits still. It is not lent, not staked, not placed in a vault, and no function exists to move it. The operational aim is 10% of the supply, with 5% as the level below which the interface raises an alert.
Guarantee
There is no function that deploys the reserve anywhere. A yield on it would be a counterparty nobody chose, on the one asset whose only job is to be there when somebody wants out.
Rule R-8.5.5
That is a decision with a cost: the reserve earns nothing, so it contributes nothing to what a depositor receives.
The loop between the liquidity vaults and the reserve
This is the newest exposure in the design and the one with no bound in the contracts.
A liquidity vault is 68% fyUSD at its centre on tier 1, and about 70% on the other two, waiting to buy the stock as it falls. When the stock falls twenty per cent, close to half of that fyUSD has left the vault, paid to whoever sold the stock into it.
That fyUSD has three destinations. Repaying a debt burns it and is neutral. Depositing it in a Stability Pool is neutral. Swapping it out through the module is not: it draws on a reserve sized at 10% of the supply.
Risk
With enough vault deposits, a single fall can release more fyUSD toward the exit than the reserve holds. The module empties, fyUSD trades below 0.998, redemptions become profitable and deliver stock tokens, and those tokens are sold into the same vault pool that no longer has fyUSD under its bound. The amplification is proportional to the vaults' total value divided by the reserve.
There is no cap on this in the contracts. What exists is an indicator, published per branch, with an alert when the ratio passes one, and a mandatory simulation before deployment.
Rule R-19.15.10, indicator R-15.1.12
What a depositor receives when the wrapper is holding collateral
The wrapper values the stock tokens it is still selling at a discount of 4% on tier 1, and it values them asymmetrically: someone entering pays the higher of the two prices, someone leaving receives the prudent one.
Above twenty per cent of the wrapper's assets in un-sold collateral, a redemption is delivered partly in stock tokens rather than in fyUSD. That is not a failure; it is the pool handing over what it actually holds. It does mean a depositor who wanted dollars receives an equity certificate at a moment when equity certificates are what nobody wants.
The fyUSD nobody is holding
A stablecoin whose only use is the Stability Pool has no peg to defend, because there is no demand outside the mechanism that mints it. The indicator the design publishes is the share of fyUSD living outside the pools, with a target of at least forty-five per cent.
Risk
If that share stays low, the honest description of fyUSD is an accounting unit for one protocol rather than a stablecoin, and its market price is whatever the swap module says it is. Nothing in the contracts can create demand for it.
Issuer and freeze
The collateral is a certificate, not a share. What happens if the entity behind it fails, freezes a balance, upgrades its contract, or runs a corporate action nobody anticipated.
Liquidity vaults
What a concentrated range actually costs when the stock falls, why the position becomes all stock below its lower bound, what the lock means, and why this liquidity is temporary by design.