MDLR: a dollar held in gold, hedged

MDLR is a synthetic dollar: a token that aims to be redeemable for one US dollar of value. Its reserve is gold, hedged to be neutral to the gold price, with a buffer of issuer capital above supply. It is issued on Midas Chain. It is not a licensed stablecoin, and as designed it cannot become one in any regime reviewed (section 10).

• The token contract is immutable and has no owner, pause, blacklist, freeze, seize or forced transfer. That is structural: there is no function to call and no upgrade path to add one.
• Minting and redemption live in a separate controller that can be upgraded only through a public timelock.
• Redemption pays par while the reserve covers supply. Below par, controller version 2 pays each redeemer the same pro rata share; version 1, the first deployed on testnet, pays par at any ratio until the upgrade to version 2 runs through the timelock. MDLR pays no interest or yield.
• Every epoch, a proof-of-reserves contract records supply and the on-chain reserve, which it reads itself, and the attested off-chain lines, each backed by a document whose hash is on chain.
• Today MDLR runs only on testnet, where the gold is a mock token and MDLR has no value.

Gold is priced in dollars and moves one to two percent on an ordinary day. A token that owes one dollar while holding gold is, in effect, long gold: a fall in the gold price leaves it under-reserved. Over-collateralisation alone would need a very large buffer to survive a sustained fall.

MDLR pairs the gold with a short gold perpetual of equal notional. Long gold plus short gold has approximately zero dollar delta, so the pair behaves as a dollar whose value does not follow the gold price. Gold supplies a real asset held outside the banking system; the hedge supplies dollar stability.

The short perpetual pays or receives funding. When longs pay shorts, the reserve receives it, and under the issuer's policy it stays in the reserve until the collateral ratio is above 1.12, so good months build the cushion that bad months draw on. Holders receive none of it. When shorts pay longs, the reserve pays from the buffer.

Negative funding is never answered by reducing the hedge. That would turn the reserve into a long gold position against dollar liabilities, which is a larger risk than the funding. The responses are to pause minting, raise fees, shrink supply, or move the hedge to another instrument, such as gold futures or forwards.

Reserve value R = on-chain gold at the oracle price after haircuts + attested custodian gold + attested off-chain buffer assets + the hedge's profit or loss. The hedge's profit or loss is the venue account's value less the margin principal deposited: realised and unrealised profit, plus funding, less fees. The margin itself is issuer capital posted at the venue and is not counted in R.

Collateral ratio (CR) = R / MDLR supply. The buffer is R less supply. It is shown as a derived line and never added to R. Target 1.08. Floor 1.02: a mint that would leave the ratio below the floor reverts. The floor stops issuance only; it never touches balances, transfers or redemption.

Growth is limited by issuer capital. A mint at par adds equal value to R and to supply, so it moves the ratio toward 1.00. The room left before the floor is R less 1.02 times supply, divided by 0.02, published as mint capacity. A reserve of 1,100,000 dollars against a supply of 1,000,000 leaves room for 4,000,000 more MDLR. More room needs more issuer capital.

Capital rule (issuer policy). If CR stays below the 1.02 floor for 24 hours, the issuer recapitalises to the 1.08 target within 72 hours or begins an orderly wind-down. If CR falls below 1.00, the issuer gives public notice and calls capital at once. Hedge income is swept to the treasury only above a CR of 1.12.

The no-freeze guarantee is structural. Balances live only in the immutable token. The upgradeable parts can change how minting and redemption work, but have no path to read, move or lock a holder's balance.

Mint: deposit an Active registry asset. The controller counts only what arrived at the reserve (so a token that charges a transfer fee is valued at what it delivered), values it at the oracle price less the asset's haircut, and mints that value less the mint fee to the recipient. The fee is minted to the treasury, so every MDLR is covered by collateral.

A mint reverts unless all of these hold: minting is not paused; the mint gate, if set, allows the caller; the oracle price is available; the latest proof-of-reserves epoch is younger than the maximum age; the epoch's mint cap has room; the asset stays within its share of the on-chain reserve; and the CR after the mint is at least the floor.

Redeem: return MDLR. The redeem fee goes to the treasury, the rest is burned, and the asset is paid from the reserve at the oracle price, within a per-epoch redemption cap. While CR is at least 1.00, the net amount is paid at par.

Below 1.00, the rule depends on the controller version. Version 1, deployed on testnet on 2026-09-27, pays par at any ratio, so in a shortfall the first redeemers would be paid in full until the cap or the gold held on chain ran out. Version 2 pays the net amount times CR: each redeemer takes the same pro rata share, never more than par, so no one gains by leaving first. Version 2 replaces version 1 only when its upgrade has run through the public timelock; the reserves page reads which version is live.

Under version 2, CR for a redemption is computed from live prices. If a price for some other asset is missing, the controller uses the latest proof-of-reserves epoch's figures instead (on-chain value, custodian gold, hedge and buffer over supply), so a gap elsewhere does not block a redemption. In either version, redemption has no pause and no CR gate: a pause that stopped holders leaving would make MDLR an IOU. It does need a price for the asset paid out; while that price is unavailable, holders keep and can transfer their tokens.

Compliance applies at the gateway, not the token. On mainnet the issuer can, and under its anti-money-laundering policy will, refuse to mint or redeem for a party that fails screening. It cannot freeze or seize anyone's MDLR.

XAU/USD is the median of independent push sources, each with its own publisher key. Four sources are configured, listed below. The adapter uses it only when at least two sources are fresh (updated within 120 seconds) and the spread between them is under 1.5%. A source rejects a push that moves more than 3% from its last unless two consecutive pushes agree. Anything else marks the price unavailable, which stops minting and redemption until it returns.

PAXG and XAUT trade around the clock, so the price survives weekends when spot sources go quiet. They are quoted mostly against USDT; that is a price input only, and no USDT is held or moved. The LBMA Gold Price needs a licence and is a mainnet item.

Each epoch (hourly on testnet, daily planned for mainnet) the publisher submits the off-chain lines: custodian gold, off-chain buffer assets and the hedge's profit or loss, with the hedge's notional and the root of the epoch's document hashes. The statement shows the hedge account's value, margin, position and venue account beside them. The contract reads supply and the on-chain reserve itself at that moment, so those lines cannot be misreported. Epochs are append-only; a correction is a new epoch naming the one it supersedes.

• Read the latest epoch on the explorer.
• Recompute supply and on-chain holdings; they must match.
• Download the epoch statement and hash it; it must match docsRoot.
• Look up the hedge account on the venue; its position must match the hedge line. Its value must be the margin plus the profit or loss, and only the profit or loss may be in the off-chain line.
• From mainnet: while the reserve holds PAXG or XAUT, check their issuers' attestations; once it holds MGLD, check the MGLD bar list against the vault's statement and the auditor's attestation.

The hedge is attested rather than read on chain because the venue commits only account equity roots on chain, so no contract can see a perpetual position. It becomes an on-chain read when the venue commits positions.

• Arbitrage at one dollar: below it, buy and redeem; above it, mint and sell.
• A reserve neutral to the gold price.
• A buffer above supply.
• Circuit breakers that stop issuance only: CR below the floor, a stale or divergent price, or a late proof of reserves.
• A disclosed redemption cap per epoch, which covers gold settlement time during a run.
• Redemption at par while CR is at least 1.00 and, from controller version 2, pro rata below it, so a run gives early redeemers no advantage. Version 1 pays par below 1.00 as well, which leaves the redemption cap as the only brake.
• A negative-funding policy that never reduces the hedge: pause minting, raise fees, shrink supply, or move to another instrument.
• A capital rule: below the floor for 24 hours, recapitalise to target within 72 hours or wind down in order; below 1.00, public notice and a capital call at once.

All admin roles belong to the timelock. On testnet the proposers are two issuer keys; on mainnet the proposer is planned to be a multisignature account. A guardian key can pause minting and cancel queued operations, and nothing else. Unpausing requires the timelock. Every queued operation is public on the reserves page before it can run.

Paxos publishes a testnet PAXG on Ethereum Sepolia, but its public faucet does not dispense it. MockXAU therefore carries the testnet reserve, and every page that shows the reserve says so.

• Position: MDLR as designed cannot be a licensed stablecoin in any regime reviewed (the United States, the European Union, Switzerland, the United Arab Emirates and Dubai, Hong Kong, Singapore). Gold and derivatives are not eligible stablecoin reserve assets in any of them, and margin posted at a venue counts as an encumbrance. The earlier assumption that an issuer licence would be held before mainnet is withdrawn.
• Structure: an offshore synthetic dollar. The issuer is proposed as a bankruptcy-remote special purpose company outside Singapore, the United States and the European Union, a subsidiary of Krysos, separate from the MIDS issuer, with the buffer contractually first-loss. Not yet constituted. MGLD would have its own issuer and an independent trustee.
• Geofencing: not offered in the United States, and never marketed there as a stablecoin; not offered in the European Union (MiCA), in Hong Kong, whose ordinance reaches marketing aimed there from anywhere, or in the United Arab Emirates, which bans issuing or promoting "algorithmic stablecoins" under a definition that may catch MDLR's mint pause and redemption caps. In Singapore it is not marketed to retail and never called a stablecoin to retail. Japan has not been assessed.
• Singapore: the Monetary Authority's consultation of September 2026 (P015-2026) proposes treating gold-referenced tokens as stablecoins and digital payment tokens, which would reach MGLD. Hence issuers outside Singapore, and a Singapore bullion company that handles bars only and never sells, mints or redeems tokens.
• No interest: neither MDLR nor MGLD pays interest, yield or balance-based rewards. Any earn product would belong to a separate, separately licensed entity, for accredited investors only.
• Sanctions: screening at the gateway under UN sanctions and those of the issuer's jurisdiction, the EU and the UK. Whether US secondary sanctions reach a USD-referenced product with no US rails is for counsel.
• The first open question: whether the issuer's jurisdiction permits a token with no freeze capability, and whether the venues MDLR needs will list one.

• Issuer jurisdictions, outside Singapore, the United States and the European Union, after counsel.
• Whether no-freeze is lawful there, and whether the venues MDLR needs will list it.
• Source and size of the issuer capital: the buffer, and the hedge margin, which is not counted in the reserve.
• The vault operator and site for MGLD's bars.
• The reserve architecture: layered, as recommended, or fully separate.
• The mainnet hedge: a capped stablecoin margin sleeve on outside venues, gold futures or forwards, or Pactol only with a lower supply cap and a higher target CR.
• The negative-funding trigger: when to pause minting, raise fees, shrink supply or change instrument. Reducing the hedge is not one of the responses.
• Whether limited mainnet holds PAXG, XAUT or both, and MGLD's physical delivery minimums.