How it works
The loop
A dollar borrowed here is a dollar that did not exist a moment earlier, and it stops existing when the loan is repaid.
Tracker certificates are deposited into a branch contract and held raw. They are never lent out, never rehypothecated, never pooled with another branch's collateral. Each branch is a separate contract, so a failure on one cannot reach another.
You borrow up to 80.0% of the collateral's value on tier 1, at an annual rate you choose. The fyUSD did not exist before you borrowed it, and it is destroyed when you repay.
Interest accrues by the second and is minted directly into the Stability Pool as it accrues, 90.0% of it in phase one. Total fyUSD supply therefore always equals total debt, by construction.
Depositors in a Stability Pool are the counterparty to that branch's liquidations. They burn fyUSD, receive seized collateral plus a bonus, and are paid the interest for standing there.
Anyone holding fyUSD can exchange it for collateral at the oracle price during a live session, walking the queue of borrowers cheapest rate first. That is what stops fyUSD trading below a dollar.
A reserve of USDG swaps in and out at a fixed price, refusing to sell fyUSD above $1.00. Swapping out is never pausable, by any market state or by the one key that exists.
The 24/7 price
Fyber does not switch itself off when the exchange closes, and it does not pretend the closing print is still true. It carries an explicit confidence in the price and makes every rule a function of it.
When
A fresh official print exists: regular session, extended hours, or the overnight window.
The price
The official print. The on-chain composite is not consulted for price at all.
The rules
Full rules: no valuation haircut, the standard ratio to borrow, the standard liquidation bonus, a 90-second confirmation, and the Stability Pool takes liquidations.
When
The calendar says the underlying market is shut (weekend, holiday), or the feed has gone quiet for longer than the session tolerates.
The price
The lower of the last official print and a depth-weighted on-chain average, clamped to a recognition band. A rise is never recognised for liquidation; a fall is never recognised to hand a redeemer more collateral.
The rules
A valuation haircut applies, so borrowing and withdrawing need a higher ratio. A liquidation needs two independent proofs or hours of persistence, waits 30 minutes to confirm, and settles as an open sale to any fyUSD holder, never against the Stability Pool.
When
A failure, not a calendar fact: sequencer down, oracle paused, circuit open, or a missed heartbeat during session hours.
The price
None. The protocol does not guess.
The rules
Repaying, adding collateral and closing a position stay open. Nothing else does. The path that gets you out never depends on the oracle.
Valuation haircut
h = 30% × (1 − confidence)When the protocol trusts the price less, it values your collateral for less when you want to borrow more or withdraw, and only then. Your liquidation threshold does not move.
30% is the tier 1 ceiling. At full confidence the haircut is zero; it only ever bites when you want to borrow more or withdraw.
Raising it when confidence drops would make positions liquidatable on an estimated price that would be perfectly healthy on the real one. Lowering it would weaken solvency at the exact moment the protocol sees least clearly. So the threshold stays at 115.0% on tier 1 in every regime, and prudence is bought with proof instead.
Outside a live session, no single source claiming the price has dropped can trigger anything. At least one of these must hold:
The asymmetry is deliberate. A rise is never used to let you borrow more against an unconfirmed number, and a fall is never used to seize collateral against one.
What this replaced
An earlier design closed the protocol at the weekend: a higher threshold while the market was shut, a forced sweep on Friday afternoon, a relief valve, and a grace window on Monday morning. All four are gone. They bought solvency by liquidating, on a Friday, positions that would have been fine on Monday in almost every case.
The price is now continuous and the protocol’s confidence in it varies, which is a more honest description of what happens to an asset whose reference market has quiet hours.
This is not a promise of a quiet weekend
A more conservative valuation is not a claim that you cannot be liquidated outside trading hours. It means the protocol demands more margin when it is less certain. If your collateral falls far enough and the fall is confirmed, your position can be reduced at any hour of any day.
Liquidations
A position must first be flagged, and at least 90 seconds must pass before it can be liquidated, with the ratio checked again at the moment of execution, not at the moment of flagging. A single anomalous price print therefore cannot be converted into a seizure, and a borrower who is watching has a window to add collateral or repay.
The amount taken is the amount needed to bring the position back above its threshold with room to spare, not the whole position. Liquidation becomes total only below 105%, or when the remainder would fall under the 100 fyUSD minimum. Whatever is not seized becomes a surplus you can claim at any time, in any state, for ever.
Who buys the collateral
| Regime | Taker |
|---|---|
| LIVE | The Stability Pool, on an official price |
| DRIFT | Any fyUSD holder, by open sale at 2.0% below the liquidation price |
| BLIND | Nobody. No liquidation happens without a price |
The pool never buys on an estimate
A Stability Pool depositor agreed to buy collateral at the oracle price. Nobody asked them to buy on a Sunday against an on-chain average. So outside a live session the pool is never the taker: the position is offered to the open market, and if nobody wants it at that price it waits for the next official print.
Immutability in practice
Immutability is easy to claim and expensive to build. This is the bill.
The cost of this, stated plainly
A parameter that turns out to be badly calibrated cannot be corrected. A component that fails is not repaired; its branch shuts down in an orderly way and everyone exits. A corrected branch is a new deployment that you would choose to move to, or not.
A sixth collateral is not an upgrade. It is a different protocol, deployed separately.
| Was a decision | Is now |
|---|---|
| Extending the market calendar | Algorithmic exchange rules plus a frozen exception table, with bounded degradation afterwards |
| Raising the debt ceiling | Dated steps, locked permanently the first time bad debt is recorded |
| Setting how much can be lent | On-chain liquidity depth with a one-way ratchet, sampled by whoever borrows |
| Posting a reference interest rate | A 30-day average of an on-chain lending market, clamped, with fixed floors if it fails |
| Listing a new collateral | Five branches pre-deployed at genesis, three activating on eight measurable on-chain criteria |
| Suspending interest during an outage | An interest clock that stops by itself after 24 hours of a degraded state |
| Delisting a branch | Permissionless shutdown on a dead feed, a failed ratio, or an unresolved token upgrade |
| Winding the protocol down | Permissionless sunset on two shut branches, or an aggregate ratio below 130% |
The doors out
The question that matters about any lending protocol is what happens on the worst day. Here is the answer, in advance.
In fyUSD, or directly in USDG, at any hour, in any protocol state. This function does not read the price oracle, so no oracle failure can block it.
Never pausable
fyUSD to USDG at the peg module for 0.20%, as long as the reserve holds. Never pausable, not even by the Closer key.
Never pausable
fyUSD against collateral at the oracle price during a live session. This is also what holds the floor under the fyUSD price, so it works for holders and for the peg at the same time.
Never pausable
Questions
Two mechanisms pushing from opposite sides. Below a dollar, redemption is profitable: anyone can buy discounted fyUSD and exchange it for a dollar of collateral at the oracle price, which buys fyUSD until the discount closes. Above a dollar, the peg module sells fyUSD for USDG at a fixed price and refuses to go above $1.00.
Neither depends on anyone choosing to defend the peg. Both are arbitrage that pays whoever performs it.
A redemption exchanges fyUSD for collateral at the oracle price, taken from the borrower with the lowest chosen rate first. If it reaches your position, part of your debt is repaid and the equivalent collateral leaves. You are not liquidated, you lose no bonus, and your collateral ratio improves.
What you lose is exposure you wanted to keep. That is why your rate is also your queue position, and why picking the cheapest possible rate is not automatically the right call.
Because that is where both halves already live. The tokenized certificates are issued on Robinhood Chain, and USDG already circulates there. So there is no bridge between your collateral and your loan, and none between your dollars and the pool. A bridge is a second protocol you would be trusting without being asked.
Nobody runs it. There is no proposal, no vote, no delegate, no forum and no quorum. Nobody can raise your rate, lower a collateral ratio, add a collateral, allowlist an address or redirect the interest split, because the functions to do those things are not in the bytecode.
That is not a claim of full decentralisation, and we do not make one: one key exists for 365 days and it can close things. What it cannot do is change things.
Borrowing, repayment, liquidation, redemption, the peg module and the pool wrappers carry on unchanged, permissionless and incentivised. Liquidity measurements are refreshed by borrowers themselves as a side-effect of borrowing. Dated ceilings open on their own. Dormant branches activate on their own. The one key expires unused. The front end and the documentation would stop being maintained, and the protocol would remain usable by direct contract call.