is the risk that USB earns less than you hoped. This is the likely one, and it is survivable.
is the risk that the reserve is worth less than the USB in circulation. This is the one that matters, and almost the entire design exists to keep it separate from the first.
Products in this category get into trouble when the two blur together — when a bad month for returns is met with something that turns it into a bad month for backing. Keeping them apart is the job.
Two of the three strategies cannot produce a negative return.
Over-collateralized lending pays a rate that floors at zero. In a quiet market it pays very little. It does not pay less than nothing.
Fixed-rate positions are locked in on the day of purchase. The return is known before we enter.
Market-neutral strategies are the exception. They earn from spreads and market structure, and in unusual conditions those can invert — the position pays out instead of paying in.
A buffer sits between that sleeve and USB holders, absorbing negative carry before it reaches anyone's return. It is held in stable assets and never invested in the strategies it exists to insure — an insurance fund invested in the thing it insures is not insurance. And because only one of the three sleeves can go negative at all, the buffer only has to cover a fraction of the reserve rather than the whole of it.
five risks · five answers · nothing omitted
Lending rates compress, spreads narrow, holders earn less. In a flat market the realistic figure is closer to 3–4% than 7%.
Three strategies answering to three different kinds of demand, so they rarely thin out together. Backing is unaffected either way — this is a return event, not a solvency event, and we would rather say so now than explain it later.
Smart contracts get exploited after multiple audits, sometimes after ten or more clean reviews. Price feeds disagree, and every major stablecoin has printed a false price on some venue at some point.
No single protocol holds enough of the reserve for its failure to break USB, and the cap is enforced by the system rather than by a risk memo. A total loss at any one venue is a bad quarter, not an insolvency. Prices are taken as a median of several independent providers with outliers rejected and rate-of-change bounded. When feeds dislocate, rebalancing stops — redemptions don't, because the redemption channel proving the real price is exactly how a false print gets corrected.
Venues fail and custodians fail. Concentration is what turns one failure into a collapse — and it hides most easily when it looks like several names that turn out to be one decision-maker.
Every counterparty is one we can name. Nothing enters the reserve whose own backing involves managers we can't see. Exposure to any single curator is capped across every venue they operate, not per venue. Collateral at derivatives venues sits in off-exchange settlement, so a venue failing is not the same as the collateral being lost.
In a severe enough event, the queue lengthens.
The price is fixed the moment you ask, not the moment you're paid — so there is no advantage to being first, and a nervous week stays a waiting room rather than becoming a race. We can't stop processing: the contract keeps paying at a floor rate even in a declared emergency. The window can extend, but only inside a hard maximum written into the contract and only when measured conditions are met. And the reserve is laddered by exit time rather than by yield, so the redemption promise is backed by positions that can actually be sold in the window it names.
This is the failure mode that has actually killed products in this category. The largest single-day loss in recent memory came from a compromised credential, not from a flaw in anyone's financial model.
The amount of USB that can be minted is capped on-chain against verified inflows. No key, no signer and no compromised system can mint USB that isn't backed, because the contract will not permit it — regardless of who holds the key. Keys are split across independent providers on different technology stacks. An independent watchdog recomputes backing against supply continuously and halts minting on drift. Upgrades carry a mandatory delay, which is a holder protection as much as a security one: if a bad upgrade were ever pushed, you have time to leave under the old rules.
Written now, before there is anything to report, because the value of this is entirely in having committed early.
We tell you fast — a first public statement within hours of detection, not after the internal picture is complete.
Redemptions keep processing. Not a promise of goodwill; a property of the contract.
We publish the post-mortem in full, including the parts that are embarrassing.
The dashboard shows the loss on the day, not after a reconciliation that suits us.
The failure we plan hardest against is our own. That is why so much of the design hands decisions to the contract instead of to us — every rule here that reads the system enforces rather than we ensure is there on purpose.
Not a bank deposit.
Not insured by any government scheme.
Not a money-market fund.
The yield is not guaranteed.
It is a token on a public blockchain, backed by a reserve of digital assets, redeemable at backing value through published terms. If you think a risk is missing from this page, tell us and we'll answer it publicly — a risk disclosure that can't be challenged isn't a disclosure. Write to us here.
Then you have read the part most people skip. Get launch updates and the first published reserve report.
