How a U comes into existence, how it leaves, why the price cannot wander far from the U rate while redemption works — a plain-numbers account of where the real risk sits — and the economics of why every actor at the table keeps it that way.
1 U := 2.29 mg PAXG gold + 0.286 EURC + 1⁄36,468 of the S&P 500 via bCSPX + 1⁄3,267 of a tokenized housing index + 89 sats of WBTC
Fixed constants q = (q₁ … q₆), set at Revision R3 (September 2026) so the list matched the target weights 35 / 29 / 19 / 10 / 7. The price of a U is not posted by anyone: it is Σ qᵢ pᵢ — what the contents cost right now, checkable by multiplication. Between revisions (§10), nobody can change the list, including us.
Deposit the list itself — or USDC worth Σ qᵢpᵢ × (1 + f) per unit, where f is a small conversion fee (terms published separately), which the contract atomically swaps into the exact quantities on Ethereum DEXes. Either way the vault gains precisely q per unit minted. Supply grows only as the contents arrive; there is no oracle in this path — DEX execution prices are the prices.
Send U back → the contract destroys it and hands you the list — q × (1 − f) in kind, or its USDC value from the same atomic swaps. Supply shrinks; the exit door has no queue, no gate, and — by design — no pause switch.
The U rate this site publishes is derived, not authoritative: it is Σ qᵢpᵢ evaluated at market prices, shown so you can sanity-check venues. The contract never needs to be told what a U is worth — it holds the answer.
vaultᵢ ≥ qᵢ · S for every asset i
S = U outstanding. A value invariant (V ≥ S·N) can be satisfied by the wrong assets; this one cannot. Every unit's exact contents sit in the vault at all times, so redemption-in-kind can never fail for lack of inventory. There is no unbacked issuance path — minting is delivering the list.
The market price P of U on any venue is pinned to the U rate by two riskless trades that anyone can do. This isn't a promise — it's a pair of profit machines that only run when the peg slips, and running them restores it.
Mint at N(1+f), sell at P, pocket P − N(1+f) > 0 per unit. Selling pushes P down until the profit is gone — i.e., until P ≤ N(1+f).
Buy at P, redeem at N(1−f), pocket N(1−f) − P > 0. Buying pushes P up until P ≥ N(1−f).
N(1 − f) ≤ P ≤ N(1 + f) → P stays within the fee band of U rate
The bound depends on exactly one thing: the burn path staying open. That is why the contract has no pause_redeem — the one switch that could break the mathematics deliberately does not exist.
Watch what each operation does to the coverage ratio C = V / (S·N). A mint adds N(1+f) to the vault but only N to the liability: the vault gains f·N free and clear. A burn removes N of liability but only N(1−f) of USDC: again the vault keeps f·N. So:
ΔC > 0 on every mint and every burn. Activity — in either direction, including panic — makes the system better collateralized.
A redemption run is, mechanically, a fee harvest: if the entire supply exited in a day, every exit would pay its fee into a vault whose per-unit obligation never changed. Compare a bank, where a run reduces the assets backing the remaining depositors.
Algorithmic stablecoins die one way: the redemption value depends on something the redemption itself pushes down. Terra's UST redeemed into freshly minted LUNA — every exit cut the value of the next exit, a feedback loop with a fixed point at zero.
U's U rate is a function of consumer price indexes and exchange rates. Burning U does not move the euro, the yuan, or the US CPI. Formally: ∂N/∂S = 0 — the redemption value is exogenous to redemption activity. There is no self-referential loop to spiral. The vault is USDC, not the protocol's own token; the U rate is the world's prices, not the protocol's price.
A system is run-proof when the last person out the door is paid the same as the first. With C ≥ 1, an exogenous U rate, and a liquid vault, that is an arithmetic fact, not a hope.
Because every mint buys the underlying assets on-chain, the vault and the liability are the same thing: your U is a claim on assets the protocol actually holds. The classic stablecoin failure — a vault that drifts away from what the token promises — is eliminated by construction. What remains is smaller, and it is execution:
| Residual risk | Size | Bound / response |
|---|---|---|
| Gas — a six-leg atomic mint on Ethereum L1 touches six markets | $ per mint | minimum mint size; batching and netting across mints; an L2 deployment settling to the L1 vault. This is the largest practical cost for small users, and it is stated on the mint page rather than hidden in the quote |
| Execution slippage — the mint buys bills, gold, equities, property and bitcoin at market depth | bp per trade | per-leg slippage bands, routed through aggregators; oversized mints split into batches; the conversion fee absorbs routine slippage |
| Permissioned legs — BUIDL and several tokenized-equity and RWA tokens restrict transfer or require an allowlist | structural | the honest constraint of this design: retail-accessible instruments are preferred, a qualified-custody or wrapper path is required otherwise, and a leg is not counted as live until its path is proven |
| Thin legs — tokenized property and credit are the shallowest market in the basket | 10% cap | the charter's ceiling for that tier; per-mint and daily caps sized to live depth, published on the audit page |
| Euro stablecoin depeg — the euro leg is an issuer claim, not a bearer asset | 29% | diversified across EURC, EURS and agEUR; it is now the vault's only ballast, which concentrates this risk rather than spreading it. A depeg passes through honestly |
| Unit volatility — gold, equities, property and bitcoin all move | 7.9%/yr | not a solvency risk at all: the backing moves one-to-one with the unit. It is the owner's chosen exposure, bounded by the charter and priced on the front page |
vault ≡ basket → coverage = 100% at every price, in every market, at any size
There is no yield-versus-growth race to win (the old §5 problem), no buffer that can be outrun, no scenario where redemptions find the vault holding the wrong thing. The unit can go down in value — the front page says so in large numbers — but it cannot be unbacked.
| Scenario | Bound / response |
|---|---|
| 100% redemption run | Everyone paid in full at U rate while C ≥ 1 — the vault is USDC, as liquid as the payout; each exit adds its fee to what remains (§3). No first-mover advantage exists. |
| USDC depegs by x% | Passes through to coverage one-for-one — disclosed, never papered over. Historical worst: brief ~5% in 2022-style stress. Mitigation path: splitting the vault across USDC/USDe (T-2 decision). |
| Oracle key stolen | U rate movement is drift-capped at 5 bp/day on-chain: a fully compromised poster can mis-price by at most ~0.05%/day, and redemption stays open the whole time. Larger changes require the timelocked admin. |
| Oracle goes silent | After 72h of staleness, mints halt; burns continue at the last posted U rate. The system can only shrink gracefully, never grow blindly. |
| Contract bug | Capped blast radius: small supply cap, per-tx cap, audited ERC-20 stablecoin contract as the base, timelocked admin. Caps grow only with audit coverage. |
| The one thing no math fixes | If the yield spread stays below liability growth for years and turnover stays near zero and the buffer exhausts: mints pause, and coverage decays at the spread rate — single digits per decade, in daylight, on the audit table. Slow, visible, and boring is the worst case; instant and reflexive is impossible by construction (§4). |
Why does the price hold economically, not just mechanically? Because U's supply is perfectly elastic at the U rate. Whatever the demand is today, supply expands or contracts to meet it at the same price — so demand shocks move quantity, never price.
Compare a fixed-supply asset: when demand for bitcoin doubles, its price must move, because its quantity cannot. When demand for U doubles, arbitrageurs mint twice as much — each new unit fully paid for — and the price stays inside the band. When demand halves, the surplus burns itself away. The token has no float to squeeze, no scarcity to speculate on, and therefore no price of its own: it inherits the U rate the way a banknote inherits its denomination.
Premium above U rate+fee is free money to any minter; minting pushes the premium away. New demand is absorbed as new, fully-collateralized supply.
Discount below U rate−fee is free money to any redeemer; burning shrinks the float until the discount closes. The system gets smaller, not cheaper.
If the world loses interest, the last holders redeem at full U rate and the system winds to zero — solvent at every size, because coverage never depended on growth. There is no Ponzi floor to fall through.
Arbitrage pins the price to the U rate — but that only matters if the U rate is worth pinning to. Two "stabilities" are involved, and most stablecoins have only the first: USDC is perfectly stable against the dollar and fully inherits the dollar's 2–3% yearly melt. U's U rate is engineered to be stable in what money is for.
Diversified monetary policy. The core spreads the unit across five central banks. No single policy mistake — one bloc's money-printing, one deval, one rate error — moves more than its weight. The dollar holder eats 100% of the Fed's decisions; the U holder eats 16% of them.
An internal hedge inside every leg. Each currency leg is priced as CPI × FX. When a bloc inflates, its CPI term rises while its exchange rate typically falls — the two components partially cancel, because a bloc's consumption basket is more stable than either its currency or its price level alone. The unit tracks what people can buy, which is the most mean-reverting economic quantity there is: consumption shares shift by fractions of a percent a year while currencies swing by tens.
Claims on production, not promises. The growth sleeve ties 20% of the unit to productive and scarce assets — equity earnings, land, monetary metal, network value. Economically the Base is a claim on the world's ability to produce the basket, not on any government's willingness to defend a number.
A peg survives when no rational actor gains by breaking it and at least one gains by maintaining it. Check every seat at the table:
| Actor | Incentive | Effect on the peg |
|---|---|---|
| Arbitrageur | Earns the deviation every time price leaves the band | Restores it — the peg's unpaid police force, paid by the deviation itself |
| Holder | Wants stable purchasing power; can always exit at U rate | No reason to run — exiting early earns nothing over exiting late |
| Protocol | Earns the conversion fee on every mint and burn | Profits from volume, not from price moves — including panic volume |
| Attacker | Wants to buy the vault below fair value | No channel: redemption pays U rate, never less; mass-redeeming raises the coverage of what remains (§3) |
This is why the classic currency-peg attack has no purchase here. Soros broke the Bank of England in 1992 because the BoE was defending a price with finite reserves against unlimited selling — every pound sold drained the defense. U never defends: it settles, at full value, from a vault that covers every unit, collecting a fee on the way out. Attacking a full-reserve peg is indistinguishable from using it.
Fixed exchange rates break because someone must fight the market. Full-reserve redemption doesn't fight — it agrees with the market, at U rate, all day, and charges a small fee for the conversation.
Fixed quantities keep the unit honest between revisions, but a list that never changes is a bet on 2026 forever. U's answer is an optimizer with an explicit objective and explicit bounds: maximize backtested purchasing power, subject to a charter the contract enforces. Growth is what it wants; the charter is what it may not do to get it.
maximize CAGRreal(q) over the rolling 20-year window
subject to σreal ≤ 8%/yr, maxDDreal ≤ 20%,
wi ≤ capi (liquidity), turnover ≤ 20%, ≤ 1 revision / quarter
"Real" means deflated by the world consumption index W(t) — the measuring rod the protocol never holds. The per-leg ceilings come from how deep each tokenized market is, not from conviction. Solved by projected random search with local refinement on every data refresh; the answer is published live on the protocol page.
Two properties of that program matter more than its solution. First, the constraints bind: the optimizer's answer sits exactly on the volatility and drawdown limits, because growth always wants more risk than a unit can carry. The charter is not decoration — it is the thing doing the stabilizing. Second, the objective is not a price target. Nothing in the program defends a number; it chooses what to own, and the price of U remains whatever those things cost.
An AI advisor drafts the next list from backtests, live DEX depth, and any newly qualified token — publishing the full argument, including the candidates it rejected.
The contract validates the proposal against the charter. Out-of-bounds proposals cannot execute; no human override exists for this step.
Seven days in public. Anyone who prefers the current list redeems it in full before the change — a revision can never trap a holder in a basket they did not choose.
Revision R3 (2026-09-20), the current list. US Treasury bills were removed from the eligible universe, so that the unit does not rest on the debt of any single government. With cash gone at R2 and sovereign debt gone at R3, the optimizer's answer is: 35% gold (at its ceiling), 29% euro stablecoins, 19% tokenized US equities, 10% tokenized property and credit, 7% wrapped bitcoin. Backtested purchasing power: +5.9%/yr real, 3.13× over twenty years, 7.9% wobble, −18.6% worst drawdown; +8.8%/yr over the last ten.
The charter had to widen, and that is the real news. Treasury bills were not in the basket for their return — at −0.16%/yr real they barely stood still. They were there because they were the only asset in the tokenized universe that controlled drawdown. With them gone, no basket the optimizer could build reached the old −12% bound: with euro stablecoins capped at 25% the calmest possible fall was −19.5%; raising that cap to 40% only reached −17.6%; even re-admitting bills at a 20% ceiling stopped at −16.0%. The bound was unreachable, not merely expensive. So the charter moved to σ ≤ 8% and maxDD ≤ 20%, the euro ceiling rose to 40% to give the vault some ballast, and the consequence is stated rather than buried: U now buys more over time and falls further when it falls. R2 gave +4.5%/yr with a −11.8% worst fall; R3 gives +5.9%/yr with −18.6%.
Two honest footnotes. First, this did not fully detach the unit from the United States: US equities and US housing remain, so roughly 29% of the vault is still American, down from 60% under R2. Second, euro stablecoins now carry 29% of the basket on a −2.11%/yr real return — they are held purely as a dollar hedge, and if that correlation changes, the case for them goes with it.
What the advisor can never touch, by construction: your right to redeem, the per-leg invariant of §1, the fee schedule, or the pause switch that does not exist. Its entire authority is the next list of quantities, inside bounds, after a week of daylight.
Every currency is managed by someone. U's manager writes its reasoning down, cannot exceed its bounds, waits a week in the open, and holds no key to the exit.