The Anemos Stablecoin: A Native, Overcollateralized, Self-Stabilizing Design

The Anemos stablecoin is built as native consensus logic, mirroring the existing transfer/bond/withdraw modules. Because every node re-executes and commits a shared state root, every operation is integer/fixed-point only with defined rounding — any nondeterminism would be a chain halt.

Mint and redeem against a floor

Minting deposits ANM at the oracle price and issues stablecoin only if the post-mint collateral ratio stays above a floor (launch value ~400%). This minting-halt-below-floor rule is the anti-death-spiral mechanism — we lift Djed’s formally verified bounds rather than invent new ones. Redeeming burns stablecoin and returns ANM at the oracle price, reserve-ratio aware. Both execute against the previously committed (lagged) price, so a single block cannot be used to front-run the peg.

Balances as shares: O(1) interest

Stablecoin balances are stored as shares with one global monotonic interest index I; displayed balance = shares × I. Accruing “golden-age” interest is therefore a single index bump — O(1), no per-account iteration — which is what keeps a full node light enough to target Android. Interest is the marginal overflow of the block-subsidy emission slice above the 1200% collateral target, measured on the instantaneous ratio (not an EMA band): only the slice that lands above 1200% is paid to holders; everything at or below 1200% builds the reserve. It is self-throttling: paying interest raises liabilities → the ratio falls back toward 1200% → the slice lands wholly in the reserve → interest stops. The negative feedback is a feature.

A reserve that builds in good times and yields to security in bad ones

Each block’s reward splits between the proposer (and delegate) and the stablecoin reserve. The reserve slice is health-dependent: it builds the buffer at a base rate in the comfort band and tapers toward zero as the ratio weakens — because printing into a fall is futile, and starving validators exactly when the chain is most attackable is the real hazard. A hard validator-share floor guarantees proposers always keep a majority of every block, preserving BFT liveness.

Restructuring instead of latching to ruin

A mild senior insolvency does not immediately latch the terminal wind-down. Instead the protocol can restructure: write the senior face down to its backed value, issue the shortfall as fungible recovery tokens (a deferred senior claim bought back at par from future surplus before the junior tranche earns again), and pay them out pro-rata. The waterfall — senior ≻ recovery ≻ junior — is enforced at redemption-time price. Only a catastrophic drop past a cumulative write-down floor falls through to the §4.7 terminal wind-down.

Reflexivity, stated plainly

The reserve is ANM-denominated, so its USD value tracks ANM’s price, and emission funding mints more of the same volatile asset. Ratio floors dampen the spiral but do not remove it: the only real backing is native market cap. We are explicit about this. The full math, conservation proofs, and risk register live in the whitepaper.