The Anemos Stablecoin: A Native, Overcollateralized, Self-Stabilizing Design

The Anemos stablecoin is built as native consensus logic, mirroring the existing transfer/bond/withdraw modules. Because every node re-executes and commits a shared state root, every operation is integer/fixed-point only with defined rounding — any nondeterminism would be a chain halt.

Mint and redeem against a floor

Minting deposits ANM at the oracle price and issues stablecoin only if the post-mint collateral ratio stays above a floor (launch value ~400%). This minting-halt-below-floor rule is the anti-death-spiral mechanism — we lift Djed’s formally verified bounds rather than invent new ones. Redeeming burns stablecoin and returns ANM at the oracle price, reserve-ratio aware. Both execute against the previously committed (lagged) price, so a single block cannot be used to front-run the peg.

Balances as shares: O(1) interest

Stablecoin balances are stored as shares with one global monotonic interest index I; displayed balance = shares × I. Accruing “golden-age” interest is therefore a single index bump — O(1), no per-account iteration — which is what keeps a full node light enough to target Android. Interest accrues only when the collateral-ratio EMA is at or above target, paid from genuine surplus emission. It is self-throttling: paying interest raises liabilities → lowers the ratio → exits the band → interest stops. The negative feedback is a feature.

A reserve that builds in good times and yields to security in bad ones

Each block’s reward splits between the proposer (and delegate) and the stablecoin reserve. The reserve slice is health-dependent: it builds the buffer at a base rate in the comfort band and tapers toward zero as the ratio weakens — because printing into a fall is futile, and starving validators exactly when the chain is most attackable is the real hazard. A hard validator-share floor guarantees proposers always keep a majority of every block, preserving BFT liveness.

Restructuring instead of latching to ruin

A mild senior insolvency does not immediately latch the terminal wind-down. Instead the protocol can restructure: write the senior face down to its backed value, issue the shortfall as fungible recovery tokens (a deferred senior claim bought back at par from future surplus before the junior tranche earns again), and pay them out pro-rata. The waterfall — senior ≻ recovery ≻ junior — is enforced at redemption-time price. Only a catastrophic drop past a cumulative write-down floor falls through to the §4.7 terminal wind-down.

Reflexivity, stated plainly

The reserve is ANM-denominated, so its USD value tracks ANM’s price, and emission funding mints more of the same volatile asset. Ratio floors dampen the spiral but do not remove it: the only real backing is native market cap. We are explicit about this. The full math, conservation proofs, and risk register live in the whitepaper.