A revenue-generating, dual-collateral stablecoin system spanning a dedicated Cosmos EVM chain and Ethereum — with an internal credit module, bond market, AMM, and automated cross-chain revenue engine.
USC is a $1 stablecoin backed by a dual-collateral basket — 80% mETH (synthetic ETH, 1:1 backed by real ETH locked on Ethereum) and 20% WCAPE (the wrapped native token of the protocol's own chain). Every part of the system feeds one loop: real fee revenue is harvested, converted to backing, and paid out as yield to USC holders who lock their coins.
Every USC is minted against mETH + WCAPE at live oracle prices. Redeemable at any time for the underlying basket.
Bridge fees (0.1% in / 0.2% out), mint & redeem fees (0.1%), AMM swap fees (0.3%), and staking yield on bridged ETH (3.5% APR, simulated on testnet).
The Treasury Credit Module (TCM) pays 4–7% APR on 90-day locked USC — the rate tracks the support ratio, is fixed the day you deposit (grandfathered), and is funded entirely by the protocol's own fees.
Real ETH lives on Ethereum (Sepolia). All protocol logic runs on a dedicated Cosmos EVM chain (ID 9000, native token CAPE) with 1-second blocks.
The 20% WCAPE backing requirement means every USC minted creates structural buy pressure for CAPE — absorbing supply distributed by the LPBonder's emissions budget.
An autonomous liquidity loop borrows against staked ETH when support falls below 1.02 and repays automatically above 1.30 — sized smoothly by the live deficit, no human trigger.
Two chains, one relayer, ten contracts. Ethereum holds the real ETH; the Cosmos EVM chain runs everything else.
| Component | Detail |
|---|---|
| Cosmos EVM node | Evmos v19, chain ID 9000 (usc_9000-1), native denom acape, 1 s blocks. Runs as evmosd systemd service with auto-recovery wrapper (height-mismatch auto-reset + auto-redeploy + auto-funding). |
| Ethereum side | Real Sepolia via Alchemy RPC. Merchant contract holds bridged ETH. |
| Relayer | Node.js service (usc-relayer). Watches ETHDeposited (Sepolia → mint mETH), RedemptionRequested (Cosmos → release ETH), ProtocolRevenueReady (Sepolia → mint revenue mETH). Pushes ETH/USD + CAPE/USD to PriceOracle every 60 s. |
| Determinism | Contract addresses are deterministic (deployer + nonce) — chain resets always redeploy to identical addresses. |
| Token | Type | What it is | Supply mechanics |
|---|---|---|---|
| USC | ERC-20 | The $1 stablecoin. The product. | Minted/burned only by Treasury against the 80/20 basket at oracle prices. |
| mETH | ERC-20 | Synthetic ETH on the Cosmos chain. Always 1:1 with real ETH locked in Merchant on Sepolia. | Minted by MerchantBridge on deposit, burned on redemption. Also minted for verified protocol revenue. |
| CAPE | Native | Gas token of the Cosmos chain. The protocol's equity-like asset. | Fixed genesis supply. Distributed via the LPBonder's emissions budget; demanded via the 20% backing rule. |
| WCAPE | ERC-20 | Wrapped CAPE (WETH9 pattern). What contracts actually hold. | 1:1 wrap/unwrap of native CAPE — no privileged minting; total supply always equals CAPE locked in the wrapper. |
| CLP | ERC-20 | CapePool LP share (mETH/WCAPE). The bondable asset — and, once bonded, permanent Treasury backing. | Minted/burned by permissionless add/removeLiquidity (Uniswap-V2 share math). Appreciates from the 0.3% swap fee. |
Nine contracts on the Cosmos chain, one on Sepolia. All verified line-by-line against the deployed source.
Issues and redeems USC against the 80/20 basket, accumulates protocol revenue as mETH, and harvests it into TCM rewards. Roles: DEFAULT_ADMIN_ROLE (deployer), OPERATOR_ROLE (deployer + MerchantBridge).
| Function | Access | Behaviour |
|---|---|---|
buyUSC(meth, cape, applyFee) | public | Pulls mETH + WCAPE (must be 80/20 by USD value ±2%), mints USC = deposit value. 0.1% fee on the mETH side when applyFee (fee → protocolMethBalance). The bonder route passes false. |
sellUSC(usc) | public | Burns USC, returns mETH (80%) + WCAPE (20%) at current prices. 0.1% fee: mETH-equivalent moves to revenue pool; the CAPE share of the fee stays as excess backing. |
harvestToTCM() | public (permissionless) | Swaps 20% of protocolMethBalance for WCAPE via CapePool, adds all to backing, mints USC of equal value straight into TCM's rewards pool. |
receiveBacking(meth, cape) | OPERATOR | Injects collateral without minting USC — used by the emergency liquidity loop. |
receiveProtocolRevenue(meth) | OPERATOR | Accepts bridged revenue mETH into protocolMethBalance. |
calcUscSupport() | view | Backing USD ÷ active supply (TCM-held USC excluded). Backing = mETH + WCAPE + CLP at fair value. Returns uint256.max when active supply is zero. |
registerLpAndMint(lp) v2 | OPERATOR (LPBonder) | Pulls CLP as permanent backing, mints equal-value USC straight into the TCM rewards pool. Fair pricing: P_lp = 2·√(methUsd·capeUsd)/S — manipulation-resistant (uses oracle prices + pool invariant, not raw reserves). |
harvestLpFees() v2 | public (relayer, daily) | Converts swap-fee growth on Treasury-held CLP into USC → TCM. Fee isolation via √k-per-share: grows only from fees, immune to price moves and proportional add/remove. Support-neutral by construction. |
releaseBacking(meth, cape) v2 | OPERATOR (bridge) | Controlled outflow for loop repayment. Hard guard: reverts unless post-release support ≥ 1.20. |
previewBuy / previewSell / fairLpPrice / activeUscSupply | view | Quote + metric helpers for frontends and the loop controller. |
Lock USC for 90 days at a grandfathered APR: the rate in force the day you deposit is written into your deposit and never changes for its duration. The rate offered to new deposits is a smooth linear function of the support ratio — 7% at support ≤ 1.00, 4% at ≥ 1.50 (rate = 7% − 3%·(s−1.0)/0.5). Weak peg → higher rate → more locking → active supply shrinks → peg recovers: the deposit rate is itself a peg-defense instrument. Interest remains capped by the rewards pool (solvency), and locked USC is excluded from the support denominator.
| Function | Behaviour |
|---|---|
deposit(amount) | Locks USC; snapshots aprAtDeposit = rateFromSupport(now) into the deposit. |
withdraw(id) | After 90 days: principal + amount × aprAtDeposit × elapsed/year, capped by rewards pool. |
allocateRewards(amount) | Open — Treasury feeds the rewards pool (harvests, LP registrations, LP fees). |
currentAPR() / currentDepositAPR() | The rate NEW deposits would lock in right now. |
setTreasury(addr) | One-time wiring (owner) — lets the rate curve read the live support ratio. |
Bond CLP tokens (not the raw basket) at a 5% discount, fixed on the deposit day — CAPE price moves during the 5-day lock change nothing. The CLP flows to the Treasury as permanent backing; equal-value USC is minted into TCM rewards. Because the deposited liquidity stays inside the pool, every bond deepens the market that must later absorb its own payout — and keeps earning the 0.3% swap fee for the protocol forever.
Payouts come from a 1,000,000 WCAPE emissions budget endowed at deploy (contracts cannot mint native CAPE — it's the gas token; the hard-capped genesis endowment is the on-chain equivalent of thin-air emissions, with the cap visible as capeReserve). Owed CAPE is reserved at purchase time, so the bonder can never over-promise.
| Function | Behaviour |
|---|---|
buyBond(lpAmount) | Pulls CLP, freezes capeOwed, routes CLP → Treasury.registerLpAndMint() → USC → TCM. |
claimBond(id) | After 5 days: transfers the reserved WCAPE (unwrap to native anytime). |
previewBond(lp) | Quote: USD value + CAPE owed right now. |
topUpReserve(amount) | Anyone can extend the emissions budget. |
Constant-product (x·y=k) pool for mETH/WCAPE with a 0.30% fee that stays in reserves (k grows → CLP appreciates). Now issues ERC-20 LP shares ("CLP") with Uniswap-V2 share math, and liquidity is permissionless. Triple duty: price discovery, harvest venue, open market — plus it now mints the asset the LPBonder runs on.
| Function | Behaviour |
|---|---|
addLiquidity(meth, cape) v2 | Permissionless; mints CLP (first mint: √(m·c) − 1000 locked; later: proportional). Use quoteAddLiquidity() to size the WCAPE side. |
removeLiquidity(lp) v2 | Burns CLP for proportional reserves. |
swapMethForCape / swapCapeForMeth | Standard x·y=k swaps, 0.30% fee. |
getCapePrice / getCapeOut / getMethOut | Price + quotes (unchanged interfaces). |
sqrtKPerShare() v2 | √k per CLP (grows only from fees) — the Treasury's fee-isolation metric. |
Merchant (Sepolia) locks real ETH: depositETH() takes 0.1% in-fee, splits net 30% reserve / 70% staked (simulated 3.5% APR), and emits ETHDeposited. releaseETH() (relayer-only) pays out redemptions minus 0.2% out-fee. harvestRevenue() (permissionless) bundles accrued fees + simulated yield and emits ProtocolRevenueReady.
MerchantBridge v2 (Cosmos) is the mirror: mintBridge() (relayer-only) mints mETH 1:1 on deposits; redeemBridge() burns user mETH and signals the relayer; mintProtocolRevenue() (relayer-only) mints revenue mETH into the Treasury. The liquidity loop is now a fully autonomous, permissionless controller: executeLiquidityLoop() fires only when support < 1.02, sized smoothly to lift it to exactly 1.05 (over-collateralised model: debt ≤ 70% of pledged staked ETH — a fixed constant, like real lending terms; loan proceeds re-join staking so staged capacity converges to ~2.33× real staked); repayLiquidityLoop() fires when support > 1.30 and retires debt down to a 1.20 floor, hard-guarded by Treasury.releaseBacking(). Both have 1-hour cooldowns; the relayer checks every 5 minutes. Loop mETH is never added to totalLocked — synthetic supply can never enlarge the bridge-out allowance. The pool-seed mETH is also minted directly (not via the bridge), so bridge counters reflect only real Sepolia deposits.
| Contract | Purpose |
|---|---|
USCToken | ERC-20, mint/burn restricted to Treasury via roles. |
MerchantETH | ERC-20 mETH, mint/burn restricted to MerchantBridge via roles. No rebase, no yield — staking yield flows to TCM as USC instead. |
WCAPE | WETH9-style wrapper for native CAPE. deposit() / withdraw(), always 1:1 backed. |
PriceOracle | Stores ETH/USD and CAPE/USD (18-decimal). Only the relayer (updater) or owner can push. Exposes isStale() (2 h threshold) — advisory, does not revert reads. |
Merchant.depositETH() on Sepolia with real ETH.ETHDeposited(user, net) fires.MerchantBridge.mintBridge(user, net) on Cosmos.Treasury.buyUSC(meth, cape, true). Value ratio must be 80/20 (±2%).LPBonder.buyBond(lpAmount). Value and CAPE owed are frozen at this block: value ÷ (CAPE price × 0.95) — a 5.26% bonus, immune to later price moves. Reserved from the emissions budget immediately.claimBond(id) pays out the WCAPE (unwrap to native CAPE anytime).executeLiquidityLoop() fires (permissionless — anyone may call).receiveBacking() — no new USC minted. Fresh loan ETH re-joins staking, raising next-stage capacity while the deficit persists.repayLiquidityLoop() automatically pulls backing (guarded ≥ 1.20 post-release), converts the WCAPE leg back, and burns the recovered mETH — the loan is repaid, collateral freed.MerchantBridge.redeemBridge(amount) — mETH is burned, RedemptionRequested fires.Merchant.releaseETH(user, amount) on Sepolia; 0.2% out-fee retained; net real ETH sent to the user.USC locked in the TCM (deposits + rewards pool) is off the market — it cannot create redemption pressure — so it is excluded from the denominator. This has an elegant consequence: USC minted by harvestToTCM() goes straight into the TCM, so harvests raise backing while leaving active supply flat. Every harvest strictly improves the ratio.
| Source | Rate | Destination |
|---|---|---|
| Bridge deposit fee | 0.1% (inflow — cheap on purpose) | All accumulate as mETH in protocolMethBalance → harvestToTCM() → TCM depositor yield |
| Bridge redemption fee | 0.2% (outflow — costlier) | |
| Mint / redeem fee | 0.1% each side | |
| ETH staking yield | 3.5% APR on 70% of bridged ETH (simulated on testnet) | |
| AMM swap fee | 0.3% | Accrues into CLP value; the Treasury's CLP share is converted to USC → TCM rewards by the daily harvestLpFees() |
| Bond (LP route) | 100% of bonded CLP value | CLP → permanent Treasury backing; USC minted → directly to TCM rewards |
The protocol "borrows" from its own TCM depositors at ≤6% APR, funded entirely by internal fee revenue — no dependency on external capital markets. This is the foundation of the Phase 2 credit facility: lend TCM capacity at 9–12% against a 6% internal cost, keeping a 3–6% spread.
Intent: the LPBonder distributes CAPE into the market; the 20% backing rule makes every USC mint buy it back. More USC demand → more CAPE locked in Treasury → scarcer float. The v2 LP design also helps structurally: bonded liquidity deepens the very pool that must absorb bond-exit sells.
| Decision | Rationale |
|---|---|
| TCM-held USC excluded from support denominator | Locked USC cannot run on the Treasury. |
Fee only on the mETH side of buyUSC | WCAPE enters untouched — avoids double-penalising the CAPE leg. |
| Credit USC = regular USC (no separate cUSC) | Accounting-only separation; credit-line protocols are blocked from sellUSC(), ordinary holders always redeemable. |
| No flash loans; no external yield on TCM funds | External smart-contract risk not worth it at this stage. |
| One bonder type active at a time | Prevents stacked WCAPE sell pressure. |
| Governance tokens as credit-line condition | Accumulate influence in borrower protocols without a separate bonder. |
| Parameter | Value | Where |
|---|---|---|
| Collateral ratio | 80% mETH / 20% WCAPE (±2% tolerance) | Treasury |
| Mint / redeem fee | 0.10% | Treasury FEE_BPS |
| Bridge fees | 0.10% deposit · 0.20% redeem | Merchant |
| Staking APR (simulated) | 3.50% on staked ETH | Merchant |
| Bridge ETH split | 30% reserved / 70% staked | Merchant + MerchantBridge |
| TCM lock / APR | 90 days / 4–7% (support-linked, grandfathered per deposit) | TCM v2 |
| Bond discount / lock | 5% fixed at deposit day / 5 days | LPBonder |
| LPBonder emissions budget | 1,000,000 WCAPE (genesis endowment, hard-capped) | LPBonder |
| Loop bands | borrow < 1.02 → target 1.05 · repay > 1.30 → floor 1.20 | MerchantBridge v2 |
| Loop borrow LTV / cooldown | 70% of pledged stakedEth (fixed constant) / 1 h | MerchantBridge v2 |
| AMM swap fee | 0.30% | CapePool |
| Oracle push cadence / staleness | ~60 s / 2 h advisory | Relayer + PriceOracle |
| Harvest cadence | ~24 h (relayer timer) | Relayer |
| Contract | Address |
|---|---|
| WCAPE | 0xC5dfeab583C6bD8A5E536b17Fc35E6D1ED6680F1 |
| MerchantETH (mETH) | 0x208293e3D6720FDE6b8367463C4773b98C5707DD |
| USCToken | 0xcC4f9d2C7Db111bF3ac915440508E57e9c66E09e |
| PriceOracle | 0x5073C4C6FE8a53c93cEBD5eE9Ddc821464C65e58 |
| CapePool | 0x61b716980210717A5c0ea5B9DA6A6Be0671e1Cba |
| Treasury | 0x9551871cA9e60fB0C28c831F1E87E1ae37f3a584 |
| TreasuryCreditModule | 0xc82dD71f4132a701f1c1919C41cD463E6A633D63 |
| LPBonder | 0x0d6A28655e4c042aD2CD8B280A940442231C0978 |
| MerchantBridge | 0x04646a987c535B5aA40A75AAF014E91b0fCfa66A |
| Contract | Address |
|---|---|
| Merchant (bridge entry) | 0x1F44B649c247E7ED743BABA62F4b9722d8eEF0Ba |
evmosd-wrapper.sh auto-detects height mismatches after ungraceful reboots and resets the chain; usc-autosetup redeploys contracts and refunds wallets automatically; the relayer retries on connection loss, persists processed bridge events (no double-mints/double-releases across restarts), and runs the loop manager + daily harvests. The ETH leg was migrated from local Anvil to real Sepolia (July 2026).usc-autosetup can fire — it races the deploy with the same key and scrambles the deterministic addresses. systemctl disable does NOT prevent it (evmosd's hook starts it explicitly) and mask fails (unit lives in /etc). Working method: sudo sed -i '1a exit 0 # TEMP-DISABLED-FOR-DEPLOY' /home/micha/usc-autosetup.sh before, remove the line after, and verify the deployer nonce is 0x0 before deploying. Full runbook in UPGRADE_NOTES.md.The stablecoin is the foundation. The endgame is a full-stack monetary system: currency, savings rate, credit facility, deposit insurance, and settlement.
LP tokens as Treasury backing — live. Three revenue streams per bond: discount, USC to TCM, perpetual swap fees harvested daily. Deeper pool → less harvest slippage → better yields.
Lend TCM capacity to whitelisted protocols at 9–12% (6% internal cost). Enforcement stack: algorithmic credit score, destination whitelisting, RevenueInterceptor (auto-repayment from borrower fee income), governance-token deposits, quarterly maintenance fee.
Protocols pay 0.5–2% annual premiums on TVL → "USC Insured" badge. Depositors covered up to 80% (max 10,000 USC). Claims paid from accumulated reserves — never from new USC. TCM backstops catastrophic events.
USC liquidity on mainnet (Curve/Uniswap), sUSC as a composable yield token, USC as the unit of account for inter-protocol credit and insurance.
| Item | Replaces |
|---|---|
| Real ETH staking (Lido / EigenLayer) | Simulated 3.5% APR |
| Multi-source oracle + deviation circuit breakers | Single relayer pushing CoinGecko prices |
| Threshold-signature / multi-relayer bridge, mint caps, on-chain proof-of-reserves | Single relayer key |
| Multisig + timelock on all admin roles | Deployer EOA |
| Keeper-automated liquidity loop | Manual owner trigger |
| Validator set / shared security | Single validator |
| Audits + bug bounty | — |