Sector preset

Stablecoin issuers

For issuers whose reserve question gets answered by the market if they do not answer it first.

PresetonboardStablecoinDetectors in play16Boundaries declared3Refusals at onboarding0

How this sector loses money.

A stablecoin does not break loudly. It breaks as a two-basis-point step nobody escalates, then a mint that clears because the minter was authorised, then a redemption queue that stops clearing. By then the market has answered the reserve question for you.

Answered by

13Deterministic rules
3Invariants

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardStablecoin(platform, config) 7 configured

01Peg integrity, bounded by a declared basis-point step rather than a vague band
02Supply-versus-backing invariant, evaluated every block
03Mint cap per token per window, enforced as an event invariant
04Two-or-more oracle agreement, with divergence as its own signal
05Reserve reconciliation against signed custodian attestations, under proof of control
06Full authority surface: admin changes, role grants to EOAs, upgrade diffs, uninitialised proxies
07Transfer-halt and critical-selector watch on the token itself

Detectors in play

rules.reserve-shortfall
rules.reserve-unexplained-drain
rules.reserve-control-unproven
rules.reserve-attestation-stale
rules.reserve-window-dressing
rules.rate-integrity
invariants.state
invariants.event
rules.admin-authority-change
rules.role-granted-to-eoa
rules.authority-handover-fresh-account
rules.upgrade-implementation-diff
rules.uninitialized-proxy
rules.token-transfers-halted
rules.critical-selector
inv.bridge-message-correspondence

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Fiat held at a commercial bank is not an on-chain object, and no amount of chain monitoring makes it one.

Closed by Closed by the reserve-attestation lane. Your custodian signs a balance attestation; Fuga Labs measures the on-chain leg continuously under proof of control, and a stale, contradicted or window-dressed attestation is itself a CRITICAL rather than a silence.

The edge Redemption decisions are taken in your operations system, not on chain.

Closed by Closed by supply-versus-backing plus the per-window mint cap: an issuance that outruns its backing fires on the arithmetic, regardless of who authorised it or why.

The edge An oracle can be correct and still be the wrong oracle.

Closed by Closed by requiring two-or-more source agreement and treating divergence as a first-class event, so a single compromised feed cannot quietly become the truth.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

Step 1
Scope

The token contract, every authorised minter, and the custodian addresses holding the reserve. The mint cap and the basis-point step are numbers only your treasury can state, so they are agreed on the call.
Step 2
Detect

Supply against backing is evaluated from the first block. A peg step and an oracle divergence route separately: a two-basis-point move with both feeds agreeing is a market, the same move with one dissenting is an incident.
Step 3
Prevent

The bounded action is a mint pause on a named token. It rehearses report-only against your live issuance until duration, volume and distinct subjects clear your bar, and the revoke stays with you.

What runs underneath.

Supply against backing is the shared invariant that earns its keep here, evaluated every block on a number nobody has to remember to check.

The base under all eleven presets

Scope Stablecoin issuers coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset