How a PUD comes into existence, how it leaves, why the price cannot wander far from the PUD rate while redemption works — a plain-numbers account of where the real risk sits — and the economics of why every actor at the table keeps it that way.
1 PUD := 0.50 USDT + 53.0 µoz XAUt0 gold (1.65 mg) + 1⁄46,200 of the S&P 500 via SPYx + 0.0661 Gram
Fixed constants q = (q₁ … q₄), set at the Jan 2026 revision so the list cost $1.0000 and matched the target weights 50 / 25 / 15 / 10. The price of a PUD is not posted by anyone: it is Σ qᵢ pᵢ — what the contents cost right now, checkable by multiplication. Between revisions (§10), nobody can change the list.
Deposit the list itself — or USDT worth Σ qᵢpᵢ × (1 + f) per unit, where f is a small conversion fee (terms published separately), which the contract atomically swaps into the exact quantities on TON DEXes. Either way the vault gains precisely q per unit minted. Supply grows only as the contents arrive; there is no oracle in this path — DEX execution prices are the prices.
Send PUD back → the contract destroys it and hands you the list — q × (1 − f) in kind, or its USDT value from the same atomic swaps. Supply shrinks; the exit door has no queue, no gate, and — by design — no pause switch.
The PUD rate this site publishes is derived, not authoritative: it is Σ qᵢpᵢ evaluated at market prices, shown so you can sanity-check venues. The contract never needs to be told what a PUD is worth — it holds the answer.
vaultᵢ ≥ qᵢ · S for every asset i
S = PUD outstanding. A value invariant (V ≥ S·N) can be satisfied by the wrong assets; this one cannot. Every unit's exact contents sit in the vault at all times, so redemption-in-kind can never fail for lack of inventory. There is no unbacked issuance path — minting is delivering the list.
The market price P of PUD on any venue is pinned to the PUD rate by two riskless trades that anyone can do. This isn't a promise — it's a pair of profit machines that only run when the peg slips, and running them restores it.
Mint at N(1+f), sell at P, pocket P − N(1+f) > 0 per unit. Selling pushes P down until the profit is gone — i.e., until P ≤ N(1+f).
Buy at P, redeem at N(1−f), pocket N(1−f) − P > 0. Buying pushes P up until P ≥ N(1−f).
N(1 − f) ≤ P ≤ N(1 + f) → P stays within the fee band of PUD rate
The bound depends on exactly one thing: the burn path staying open. That is why the contract has no pause_redeem — the one switch that could break the mathematics deliberately does not exist.
Watch what each operation does to the coverage ratio C = V / (S·N). A mint adds N(1+f) to the vault but only N to the liability: the vault gains f·N free and clear. A burn removes N of liability but only N(1−f) of USDT: again the vault keeps f·N. So:
ΔC > 0 on every mint and every burn. Activity — in either direction, including panic — makes the system better collateralized.
A redemption run is, mechanically, a fee harvest: if the entire supply exited in a day, every exit would pay its fee into a vault whose per-unit obligation never changed. Compare a bank, where a run reduces the assets backing the remaining depositors.
Algorithmic stablecoins die one way: the redemption value depends on something the redemption itself pushes down. Terra's UST redeemed into freshly minted LUNA — every exit cut the value of the next exit, a feedback loop with a fixed point at zero.
PUD's PUD rate is a function of consumer price indexes and exchange rates. Burning PUD does not move the euro, the yuan, or the US CPI. Formally: ∂N/∂S = 0 — the redemption value is exogenous to redemption activity. There is no self-referential loop to spiral. The vault is USDT, not the protocol's own token; the PUD rate is the world's prices, not the protocol's price.
A system is run-proof when the last person out the door is paid the same as the first. With C ≥ 1, an exogenous PUD rate, and a liquid vault, that is an arithmetic fact, not a hope.
Because every mint buys the underlying assets on-chain, the vault and the liability are the same thing: your PUD is a claim on assets the protocol actually holds. The classic stablecoin failure — a vault that drifts away from what the token promises — is eliminated by construction. What remains is smaller, and it is execution:
| Residual risk | Size | Bound / response |
|---|---|---|
| Execution slippage — the mint buys gold, S&P tokens and Gram on TON DEXes at market depth | bp per trade | slippage bands per leg; oversized mints split into batches; the fee absorbs routine slippage |
| Thin legs — XAUt0 and SPYx depth on TON is limited today | caps | per-mint and daily caps sized to live DEX depth; caps grow with liquidity, published on the audit page |
| USDT leg — half the basket is a dollar stable | 50% × depeg | a USDT depeg passes through to that leg honestly; diversification of the cash leg (USDe) is a standing decision point |
| Unit volatility — gold, stocks and TON move | 7.3%/yr | not a solvency risk at all: the backing moves one-to-one with the unit. It is the owner's chosen exposure, priced on the front page |
vault ≡ basket → coverage = 100% at every price, in every market, at any size
There is no yield-versus-growth race to win (the old §5 problem), no buffer that can be outrun, no scenario where redemptions find the vault holding the wrong thing. The unit can go down in value — the front page says so in large numbers — but it cannot be unbacked.
| Scenario | Bound / response |
|---|---|
| 100% redemption run | Everyone paid in full at PUD rate while C ≥ 1 — the vault is USDT, as liquid as the payout; each exit adds its fee to what remains (§3). No first-mover advantage exists. |
| USDT depegs by x% | Passes through to coverage one-for-one — disclosed, never papered over. Historical worst: brief ~5% in 2022-style stress. Mitigation path: splitting the vault across USDT/USDe (T-2 decision). |
| Oracle key stolen | PUD rate movement is drift-capped at 5 bp/day on-chain: a fully compromised poster can mis-price by at most ~0.05%/day, and redemption stays open the whole time. Larger changes require the timelocked admin. |
| Oracle goes silent | After 72h of staleness, mints halt; burns continue at the last posted PUD rate. The system can only shrink gracefully, never grow blindly. |
| Contract bug | Capped blast radius: small supply cap, per-tx cap, audited TEP-74 stablecoin contract as the base, timelocked admin. Caps grow only with audit coverage. |
| The one thing no math fixes | If the yield spread stays below liability growth for years and turnover stays near zero and the buffer exhausts: mints pause, and coverage decays at the spread rate — single digits per decade, in daylight, on the audit table. Slow, visible, and boring is the worst case; instant and reflexive is impossible by construction (§4). |
Why does the price hold economically, not just mechanically? Because PUD's supply is perfectly elastic at the PUD rate. Whatever the demand is today, supply expands or contracts to meet it at the same price — so demand shocks move quantity, never price.
Compare a fixed-supply asset: when demand for bitcoin doubles, its price must move, because its quantity cannot. When demand for PUD doubles, arbitrageurs mint twice as much — each new unit fully paid for — and the price stays inside the band. When demand halves, the surplus burns itself away. The token has no float to squeeze, no scarcity to speculate on, and therefore no price of its own: it inherits the PUD rate the way a banknote inherits its denomination.
Premium above PUD rate+fee is free money to any minter; minting pushes the premium away. New demand is absorbed as new, fully-collateralized supply.
Discount below PUD rate−fee is free money to any redeemer; burning shrinks the float until the discount closes. The system gets smaller, not cheaper.
If the world loses interest, the last holders redeem at full PUD rate and the system winds to zero — solvent at every size, because coverage never depended on growth. There is no Ponzi floor to fall through.
Arbitrage pins the price to the PUD rate — but that only matters if the PUD rate is worth pinning to. Two "stabilities" are involved, and most stablecoins have only the first: USDC is perfectly stable against the dollar and fully inherits the dollar's 2–3% yearly melt. PUD's PUD rate is engineered to be stable in what money is for.
Diversified monetary policy. The core spreads the unit across five central banks. No single policy mistake — one bloc's money-printing, one deval, one rate error — moves more than its weight. The dollar holder eats 100% of the Fed's decisions; the PUD holder eats 16% of them.
An internal hedge inside every leg. Each currency leg is priced as CPI × FX. When a bloc inflates, its CPI term rises while its exchange rate typically falls — the two components partially cancel, because a bloc's consumption basket is more stable than either its currency or its price level alone. The unit tracks what people can buy, which is the most mean-reverting economic quantity there is: consumption shares shift by fractions of a percent a year while currencies swing by tens.
Claims on production, not promises. The growth sleeve ties 20% of the unit to productive and scarce assets — equity earnings, land, monetary metal, network value. Economically the Base is a claim on the world's ability to produce the basket, not on any government's willingness to defend a number.
A peg survives when no rational actor gains by breaking it and at least one gains by maintaining it. Check every seat at the table:
| Actor | Incentive | Effect on the peg |
|---|---|---|
| Arbitrageur | Earns the deviation every time price leaves the band | Restores it — the peg's unpaid police force, paid by the deviation itself |
| Holder | Wants stable purchasing power; can always exit at PUD rate | No reason to run — exiting early earns nothing over exiting late |
| Protocol | Earns the conversion fee on every mint and burn | Profits from volume, not from price moves — including panic volume |
| Attacker | Wants to buy the vault below fair value | No channel: redemption pays PUD rate, never less; mass-redeeming raises the coverage of what remains (§3) |
This is why the classic currency-peg attack has no purchase here. Soros broke the Bank of England in 1992 because the BoE was defending a price with finite reserves against unlimited selling — every pound sold drained the defense. PUD never defends: it settles, at full value, from a vault that covers every unit, collecting a fee on the way out. Attacking a full-reserve peg is indistinguishable from using it.
Fixed exchange rates break because someone must fight the market. Full-reserve redemption doesn't fight — it agrees with the market, at PUD rate, all day, and charges a small fee for the conversation.
Fixed quantities keep the unit honest, but value weights drift as prices move — gold rallies and the gold leg swells past 25%. The SDR solves this with a five-yearly revision; PUD revises yearly, and whenever a waitlist jetton ships. The proposer is an AI. Its leash is the point.
An AI advisor drafts the next quantity list from the strongest available evidence: rolling 20-year purchasing-power backtests against the world consumption index W(t), realized drawdown and volatility, live DEX depth per leg on TON, and any newly shipped waitlist asset. The full argument is published with the proposal — data, backtest, reasoning.
The contract rejects any proposal outside hard bounds: TON-buyable assets only; USDT 40–60%, gold 15–35%, no leg sized past its DEX liquidity; turnover ≤ 20% of the vault per revision; at most one revision per quarter. The advisor argues; the code decides what is arguable.
An accepted proposal waits 7 days in public before taking effect. Anyone who dislikes the next list can redeem the current one, in full, before it changes — the revision cannot trap anyone. On execution day the vault trades to the new quantities in one published rebalance.
Revision R2 (2026-08-30), the machinery’s first use: the advisor proposed admitting an RWA leg at 10%, funded from USDT (50 → 40) — tokenized real estate first, T-bills acceptable. No qualifying jetton has real DEX depth on TON yet, so the leg is admitted but dormant: its slice rides in USDT and the per-leg invariant is unchanged until activation day. Backtest with the US home-price index standing in: 1.85× real over 20 years (+3.1%/yr), 7.4% wobble, −14.5% worst drawdown. Activation turnover 10%, inside the 20% bound.
What the advisor can never touch, by construction: your right to redeem, the per-leg invariant of §1, the fee schedule, or the pause switch that doesn't exist. Its entire authority is the next list of quantities, inside bounds, after a week of daylight. If the AI is ever wrong, it is wrong in public, slowly, and within limits — which is the only kind of wrong a monetary instrument survives.
Every currency is managed by someone. PUD's manager writes its reasoning down, cannot exceed its bounds, waits a week in the open, and holds no key to the exit.