The TON stage: a jetton that mints against USDT inside Telegram and redeems at the world-basket NAV — with the one honest complication TON forces, stated on page one instead of hidden: on TON you can measure the basket, but you cannot yet buy it.
Companion to the design spec and methodology · chain research 2026-08-13 (Solana vs TON vs Robinhood Chain) · sister deployment on Solana: glu.booga.me
TON is the only chain that lives inside a messenger with ~1B users: the wallet is built into Telegram, and a mint can be a Mini App two taps from any chat. That is why PUD exists here. The other half of the truth, from the August 2026 asset research: the shelf is nearly empty.
| What the basket needs | What TON has |
|---|---|
| USD stable | USDT native jetton, ~$670M — deep, mintable, everywhere |
| EUR / JPY / GBP / CHF stables | None. Zero non-USD stablecoins exist as jettons, in any form |
| Gold | XAUt0 exists, ~$230k of DEX depth — credible backing, no liquidity |
| Treasuries / TIPS | None permissionless (Libre bond fund is institution-gated) |
| FX price oracles | Yes — RedStone and Pyth are live on TON with EUR/JPY/GBP/CHF/XAU feeds |
| Mint/burn programmability | Yes — jettons are arbitrary contracts; the audited TEP-74 stablecoin reference fits exactly |
| Verdict | The basket is measurable (oracles) but not purchasable (assets) — so v1 is synthetic by design |
V1 backs every PUD with USDT worth its NAV at mint time, and carries the basket exposure synthetically: the NAV is the real index W(t), the FX legs are valued by on-chain oracles, but the vault holds dollars. The gap between "priced like the basket" and "backed by dollars" is basis risk — absorbed by a buffer, capped small, and printed on the mint page, not buried.
100 USDT jetton · index exposure = synthetic, valued via oracle FX (EUR 30 / JPY 15 / GBP 10 / CHF 5 legs) against the posted W(t)
Each leg carries a mode the contract enforces: REAL a live jetton held in the vault · SYNTHETIC oracle-valued, collateral held in USDT. Today only the USD leg is REAL. Every synthetic leg has a registry slot that flips to REAL the day its jetton ships on TON — EURC would be first.
The rule from the methodology applies here at maximum strength: disclose the lag, don't fake the leg. A dollar-backed index token that says so is honest; one that pretends TON has a euro is not.
Jetton master built on the audited ton-blockchain/stablecoin-contract (TEP-74/89): mint on USDT deposit at NAV + 25 bp, burn-to-redeem at NAV − 25 bp, USDT payout. Caps, staleness and drift checks enforced in-contract.
The PUD index server (this site) signs W(t) + oracle FX cross-rates into the contract daily; poster moves are drift-capped at 5 bp/day so a stolen key cannot rug the NAV. RedStone/Pyth feeds cross-check the FX legs.
A Telegram Mini App is the primary UI: TON Connect for Telegram Wallet/Tonkeeper, mint and redeem two taps from a chat. The web page mirrors it for browsers.
Mini App fetches the posted NAV → price = NAV × (1 + 25 bp). NAV staler than 72h ⇒ mints halt (redeems never halt).
User sends USDT to the master's vault wallet; contract mints PUD to the user at the quoted NAV. Atomic on TON's message chain; no swaps anywhere.
The vault is USDT; the liability tracks W(t). The daily difference accrues against the buffer, published as a live "basis" line on the mint page. Buffer exhausted ⇒ mints pause, redeems continue at disclosed NAV.
User burns PUD; payout = NAV × (1 − 25 bp) in USDT. No pause switch exists for redemption, by design.
USDT only in v1 — the honest consequence of the shelf. More payout jettons appear exactly as fast as real legs do.
| Risk | Guardrail |
|---|---|
| Basis risk (USDT vault vs basket liability) | The defining v1 risk: dollar collateral under an index liability. Sized by the research at ~3.9%/yr of purchasing-power volatility — absorbed by a fee-funded buffer, disclosed live, and the reason v1 caps stay small |
| Poster key stolen → fake NAV | On-chain drift cap ≤ 5 bp/day vs the posted path; larger moves need the timelocked admin |
| Oracle staleness | NAV > 72h old: mints halt, redeems continue |
| USDT depeg | The collateral IS USDT in v1 — a depeg passes through to NAV honestly rather than being papered over; disclosed prominently. Diversification (USDe sleeve) considered for T-2 |
| Contract bug | v1 caps: small supply cap, per-tx cap, audited reference contract as the base, admin behind a timelock |
| Legal | Same reality as the design spec §7: an index-redeeming token is not a payment stablecoin; testnet first, capped pilot, geo-notice, no yield paid |
| Stage | Ship | Proves |
|---|---|---|
| T-1 | Testnet jetton + Mini App. Stablecoin-contract fork with NAV mint/redeem, mock USDT, NAV posted from the live index, TON Connect UI inside Telegram | The full loop: index → posted NAV → mint → burn, two taps from a chat |
| T-2 | Mainnet pilot, small cap. Real USDT vault, live basis line, fee-funded buffer | The synthetic design under real deposits; whether Telegram distribution actually converts |
| T-3 | Real legs as they land. EURC-on-TON (or any non-USD jetton) flips its registry slot from synthetic to real; gold via XAUt0 if liquidity arrives | The path from measurement to full backing — converging on the Solana design |