USDMD: a dollar held in gold, hedged

USDMD is a stablecoin that aims to be redeemable for one US dollar of value. Its reserve is gold, hedged to be neutral to the gold price, with a buffer above supply. It is issued on Midas Chain.

• The token contract is immutable and has no owner, pause, blacklist, freeze, seize or forced transfer. That is structural: there is no function to call and no upgrade path to add one.
• Minting and redemption live in a separate controller that can be upgraded only through a public timelock.
• Every epoch, a proof-of-reserves contract records supply and the on-chain reserve, which it reads itself, and the attested off-chain lines, each backed by a document whose hash is on chain.
• Today USDMD runs only on testnet, where the gold is a mock token and USDMD has no value.

Gold is priced in dollars and moves one to two percent on an ordinary day. A token that owes one dollar while holding gold is, in effect, long gold: a fall in the gold price leaves it under-reserved. Over-collateralisation alone would need a very large buffer to survive a sustained fall.

USDMD pairs the gold with a short gold perpetual of equal notional. Long gold plus short gold has approximately zero dollar delta, so the pair behaves as a dollar whose value does not follow the gold price. Gold supplies a real, non-US asset that cannot be frozen by a bank; the hedge supplies dollar stability.

The short perpetual pays or receives funding. When longs pay shorts, the reserve earns. When shorts pay longs, the reserve pays, and the buffer absorbs it. Persistent negative funding triggers a review: reduce the hedge, widen fees, or move venue.

Collateral ratio (CR) = (on-chain gold at the oracle price after haircuts + attested hedge value + attested custodian gold + buffer) / USDMD supply. Target 1.08. Floor 1.02: a mint that would leave the ratio below the floor reverts. The floor stops issuance only; it never touches balances, transfers or redemption.

The no-freeze guarantee is structural. Balances live only in the immutable token. The upgradeable parts can change how minting and redemption work, but have no path to read, move or lock a holder's balance.

Mint: deposit an Active registry asset. The controller counts only what arrived at the reserve (so a token that charges a transfer fee is valued at what it delivered), values it at the oracle price less the asset's haircut, and mints that value less the mint fee to the recipient. The fee is minted to the treasury, so every USDMD is covered by collateral.

A mint reverts unless all of these hold: minting is not paused; the mint gate, if set, allows the caller; the oracle price is available; the latest proof-of-reserves epoch is younger than the maximum age; the epoch's mint cap has room; the asset stays within its share of the on-chain reserve; and the CR after the mint is at least the floor.

Redeem: return USDMD. The redeem fee goes to the treasury, the rest is burned, and the asset is paid from the reserve at the oracle price, within a per-epoch redemption cap. Redemption has no pause and no CR gate: a pause that stopped holders leaving would make USDMD an IOU. It does need a price; while the oracle is unavailable, holders keep and can transfer their tokens.

Compliance applies at the gateway, not the token. On mainnet the issuer can, and if licensed must, refuse to mint or redeem for a party that fails screening. It cannot freeze or seize anyone's USDMD.

XAU/USD is the median of independent push sources, each with its own publisher key. Four sources are configured, listed below. The adapter uses it only when at least two sources are fresh (updated within 120 seconds) and the spread between them is under 1.5%. A source rejects a push that moves more than 3% from its last unless two consecutive pushes agree. Anything else marks the price unavailable, which stops minting and redemption until it returns.

PAXG and XAUT trade around the clock, so the price survives weekends when spot sources go quiet. They are quoted mostly against USDT; that is a price input only, and no USDT is held or moved. The LBMA Gold Price needs a licence and is a mainnet item.

Each epoch (hourly on testnet, daily planned for mainnet) the publisher submits the off-chain lines: custodian gold, hedge value and notional, buffer, the venue account that holds the hedge, and the root of the epoch's document hashes. The contract reads supply and the on-chain reserve itself at that moment, so those lines cannot be misreported. Epochs are append-only; a correction is a new epoch naming the one it supersedes.

• Read the latest epoch on the explorer.
• Recompute supply and on-chain holdings; they must match.
• Download the epoch statement and hash it; it must match docsRoot.
• Look up the hedge account on the venue; its position must match the hedge line.
• From mainnet: check the bar list against the custodian's statement and the auditor's attestation.

The hedge is attested rather than read on chain because the venue commits only account equity roots on chain, so no contract can see a perpetual position. It becomes an on-chain read when the venue commits positions.

• Arbitrage at one dollar: below it, buy and redeem; above it, mint and sell.
• A reserve neutral to the gold price.
• A buffer above supply.
• Circuit breakers that stop issuance only: CR below the floor, a stale or divergent price, or a late proof of reserves.
• A disclosed redemption cap per epoch, which covers gold settlement time during a run.
• A negative-funding policy: reduce the hedge, widen fees, or rotate venue.

All admin roles belong to the timelock. On testnet the proposers are two issuer keys; on mainnet the proposer is planned to be a multisignature account. A guardian key can pause minting and cancel queued operations, and nothing else. Unpausing requires the timelock. Every queued operation is public on the reserves page before it can run.

Paxos publishes a testnet PAXG on Ethereum Sepolia, but its public faucet does not dispense it. MockXAU therefore carries the testnet reserve, and every page that shows the reserve says so.

• Issuer: proposed as a bankruptcy-remote special purpose company, a subsidiary of Krysos, separate from the MIDS issuer. Not yet constituted.
• Licence: an e-money or stablecoin issuer licence in the chosen jurisdiction is required before any mainnet mint. None is held.
• Sanctions: screening at the gateway under UN sanctions and those of the chosen jurisdiction, the EU and the UK. Whether US secondary sanctions reach a USD-referenced product with no US rails is for counsel.
• The first open question: whether the chosen regime permits a token with no freeze capability.

• Issuer jurisdiction and licence.
• Whether no-freeze is lawful there.
• Source and size of the initial buffer capital.
• Custodians and vault jurisdictions.
• Hedge venue: a related venue only, or a second venue.
• How long negative funding is absorbed before de-risking.
• Mainnet redemption assets and physical gold minimums.