Roles: a formal treatment
What each role gets, written down and checked by simulation. Every claim traces to a rule in the white paper; the model’s assumptions are stated where they enter, and the places where the arithmetic corrected our intuition are marked.
Notation and rules
Let R be the reserve, S the circulating supply, and B = R/S the backing per token. Let p_m be the mint price — the cost of entry — which never falls: in Phase 1 a function of the issuance count, in Phase 2 a function of time. Let P be the market price. Let B* be the historical maximum of B and X the protection level, the admissible drawdown; the threshold is (1−X)·B*. Defaults from the white paper: X = 61.8 %, redemption fee f_r = 0.9 %, dilution coefficient k = 5.6 %, transfer fee f_t from a ladder with a zero default.
A position is a pair (c, p): collateral c deposited when the mint price was p. It represents t = c/p tokens not yet issued. It can be redeemed — c returns, nothing enters the pool — or closed: c enters R and t enter S.
Closing changes backing to B′ = (R + c)/(S + t). Since c/t = p, B′ lies between B and p: above B when p > B, below when p < B. The first is rewarded with voting credits and never charged; the second is dilutive, charged k·(1 − p/B) in tokens withheld, and limited in volume: no single closing may use more than 38.2 % of the headroom above the threshold.
Redemption of tokens is neutral: a holder takes S_r/S of R, so B is unchanged; the fee f_r·m stays in the reserve and raises B slightly, where m = 1/(1 − drawdown). A transfer burns f_t of the amount: S falls, R does not, B rises. A vote burns tokens likewise.
Two bounds hold by arbitrage once a market exists: P ≤ p_m, because minting beats buying above the cost of entry; and P ≥ B·(1 − f_r·m), because redeeming beats selling below backing by more than the fee. From these, B ≤ p_m except transiently — in a stagnant Phase 1 heavy burns can lift B above a standing mint price, and then minting and closing is profitable and pulls B back through throttled dilution. In Phase 2 the mint price grows with time and the exception disappears.
The dynamics of backing
Four channels move B up: closings above backing, the redemption fee, the transfer fee, and votes. One channel moves it down: closings below backing. With stablecoin collateral there is no other. The asymmetry is first in the number of channels, then in their size, then in when the downward one can act.
The upward channel is unbounded: a closing at p ≫ B adds (p − B)·t/(S + t), and nothing caps p. The downward channel is bounded twice — by the threshold, which B may approach but not reach, and by the fraction: each dilutive closing takes at most 38.2 % of the remaining headroom, so after n such closings at most 0.618ⁿ of it is left.
The downward channel can act only on a position whose entry price is below the current backing — and every position enters at the mint price, above backing. So a position becomes dilutive only afterwards, when B has risen past its entry. Corrections are a consequence of growth: old positions taking their gain, not new money leaving.
Outflow does not lower B. Redemption removes R and S in the same proportion and leaves the fee. In the simulation an outflow shock — twelve per cent of the supply redeemed every cycle with no inflow for fifty cycles — did not lower backing by a single unit; the market price went to the floor and the holders left, and when inflow returned the first closings above backing lifted B in a jump, because the cost of entry had kept climbing while nobody minted. Stagnation stores potential; it does not destroy it.
What the simulation corrected in our intuition is the size of ordinary corrections. When holders close as soon as closing beats redeeming — which happens while a position is only slightly below backing — dilutive closings are one to three per cent of all closings, their damage is a few per cent of what the others add, and the drawdown from the record stays in single digits. A deep correction needs a whale: a large position held far below backing. The threshold and the fraction exist for that case. In the model a position three times the supply, entered at a fifth of backing, takes B to 0.41 of its record over four cycles against a threshold of 0.382 — and stops. Figure 1 shows the three phases; Figure 2, the whale.
Figure 1. Backing, cost of entry and market price through inflow, stagnation and an outflow shock Simulation on the white paper’s rules. Backing does not fall in the shock; the price goes to the floor; the first closings after the shock lift backing in a jump.
A whale against the threshold
The fraction rule is what turns a cliff into a staircase. A position three times the supply, entered at a fifth of backing, cannot close at once: each closing may use 38.2 % of the headroom above the threshold, so the first takes backing down by about forty per cent, the second by less, the third by less again, and the fourth exhausts the position with backing at 0.41 of its record — above the threshold of 0.382 — and with three cycles in which everyone else could see it coming and act.
Figure 2. A whale against the threshold A cheap position three times the supply at a fifth of backing: each closing takes about a third of the remaining headroom; backing stops at 0.41 of the record against a threshold of 0.382.
The reservoir of cheap positions
Define the dilution reservoir D = Σ (B − pᵢ)·tᵢ over positions with pᵢ < B: the damage all cheap positions could do if closed at once, before the fraction throttles them. D is not fed by entry — new positions enter above backing — and is fed only by growth of B, which retroactively puts old positions in the money.
It drains three ways. A holder who redeems a cheap position takes c and never dilutes. A holder who waited until the fraction lets him close only a sliver per cycle tends to redeem instead; the white paper notes that the dilution coefficient makes redemption more attractive than closing for exactly these positions. And every dilutive closing that happens removes its own term.
In the simulation the reservoir is small and transient: under prompt closing it never exceeds a fraction of a per cent of the reserve; under patient holders it flares in the first cycles and is gone within forty. The stock of cheap positions is finite, replenished only by growth and never by entry; the stock of expensive positions is unbounded and replenished by every deposit. Figure 3 shows both cases.
Figure 3. The dilution reservoir under prompt and patient holders Share of the reserve that cheap positions could dilute if closed at once. It fills only when backing rises and drains within tens of cycles.
Role 1 — the saver: a purchase with a refund, and its price
A position (c, p) held to a moment when the market price is P is worth max(c, c·P/p): redeem for c, or close into c/p tokens and sell them. Held against the market this is a purchase of c/p tokens with a full refund right — and the refund is not free. The same c on the market buys c/P tokens, and P ≤ p always. The tokens foregone, 1 − P/p, are the premium.
The premium is set by where the market stands in the corridor. At the ceiling, P = p and the refund costs nothing: minting strictly dominates buying, because it adds a refund at c to the same tokens. At the floor, P = B·(1 − f_r·m), and with the corridor two to ten times wide the premium is thirty to eighty per cent of the deposit. Hence the rule: mint near the cost of entry, buy near the backing. Figure 4 draws the payoff and the premium.
Because p_m only rises, every later position carries a higher strike than every earlier one: two savers who mint a cycle apart hold refunds on the same tokens at different prices, and the earlier dominates. That is the whole content of “the cost of entry rises” for the saver — a statement about strikes, not about P.
Figure 4. A position against a token, and the price of the refund Left: value at exit per unit deposited. Right: tokens foregone by minting instead of buying, by the market’s place in the corridor and the corridor’s width.
Role 2 — the holder: a floor that rises by rule inside a wide corridor
A token is worth P, bounded below by B·(1 − f_r·m) and above by p_m. The floor cannot fall below (1−X)·B*·(1 − f_r·m) while the reserve is in stablecoins: 38.2 % of the record at the default level, 76.4 % at the strict one. And the floor rises: by the dynamics above, B is a staircase that outflow does not lower.
What the arithmetic insists on is the width of the room above the floor. In the model the cost of entry stands at two to ten times the backing, and the market price has moved from near the ceiling to near the floor and back within that room — a fall of up to eighty per cent without any rule being touched. The floor is where the rules do their work; the room above it belongs to demand.
The corridor is a state, not a constant. In Phase 2 with a steady inflow it tends to widen: the cost of entry grows at the rate while backing grows as an average of past entries. Two things narrow it — an inflow large relative to the supply, and transfer burns, which remove old cheap tokens from the denominator. The holder therefore has a direct interest in a non-zero transfer fee.
Role 3 — the spender: turnover feeds the floor, and who pays for it
Let the transfer fee be f_t and the annual turnover of the coin be k·S. Burns remove f_t·k·S tokens a year; R is untouched; B rises by the factor 1/(1 − f_t·k) per year. At f_t = 0.0618 % and k = 120 that is 7.7 % a year; at 0.1 %, 12.7 %. The white paper gives the same figures.
The rise is not from nothing. The fee is paid by the sender of each transfer, so the burn transfers value from those who move the coin to those who hold it. A merchant who accepts ASTRX and holds it is on the receiving side; a participant who only pays is on the paying side. The channel is honest and its direction is worth knowing.
The fee is governed and defaults to zero; the holders switch it on from stage 2. Figure 5 shows the annual rise of B against turnover for the ladder of rates.
Figure 5. Annual rise of backing from transfer burns B rises by 1/(1 − f_t·k) a year; k is the number of times a token changes hands. Rates from the transfer-fee ladder.
Role 4 — the trader: a self-limiting loop
Let the realised band be w = P_high − P_low inside the corridor, and let the cost of a round trip be κ: gas twice, the pool fee twice, the transfer fee, slippage. A trader’s expected profit per round trip is w − κ. When w > κ, trading pays; each trade sells near the top and buys near the bottom, which narrows w. When w falls to κ, profit is zero and traders leave; with fewer traders, w widens; they return. The equilibrium band is w* ≈ κ, and the share of traders oscillates around the level that holds it there. Figure 6 draws the loop.
What distinguishes this market from a stochastic one is that both reference levels are published and defended by the contract: the trader is not guessing where the bounds are. His risks are the band moving with the corridor — both boundaries rise — and the redemption multiplier, which widens the lower band precisely when backing is in drawdown.
Figure 6. The trader’s loop Band width against the traders’ share; the cycle circulates around the equilibrium w* ≈ κ.
Role 5 — the liquidity provider: a range with edges, far apart
In a concentrated-liquidity pool the provider chooses a range [a, b] and earns fees only while the price is inside it. The corridor gives a natural range: a = B·(1 − f_r·m), b = p_m. Arbitrage returns the price into the corridor from either side, so the position is never out of range for long, and impermanent loss — the loss from the price leaving the range — is bounded by the corridor’s width.
The honest qualifier is that the width is large. A bound of four times is a weak comfort, and a provider who ranges the whole corridor spreads his liquidity thinly. The practical range is narrower than the corridor and re-set as the boundaries move; how narrow, and what that costs, is the subject of the arbitrage study. Figure 7 shows the range inside a rising corridor.
Figure 7. The provider’s range inside a rising corridor The range follows the boundaries; the price returns into it from either side.
The second loop: saturation and return
The first loop bounds corrections; a second bounds growth itself. The pool of participants is finite. A rise attracts them until they are in — and then minting stops, because there is nobody new to mint. With no new positions there are no closings above backing; B stops rising; the market price, no longer pulled by a rising floor, drifts to it. Holders who came for the rise leave.
This is not a solvency event, and the reason is structural. A token is not a claim for a fixed sum; it is a share S_r/S of the reserve R. Whatever R is, the claims on it sum to exactly R. Redemption pays that share and leaves the fee behind, so B does not fall with the outflow and the reserve is, at every moment, sufficient by definition. There is no run to start, because there is nothing to be first to.
What the outflow does is clear the market and open the discount. At the floor a token costs its backing, while the cost of entry has kept rising: the gap between them is now the widest it has been. The return goes through that gap — but by buying, not by minting. Minting at the ceiling and selling at the floor loses; buying at the floor gets two to five times the tokens minting would, with the same floor beneath them. Buyers come for the discount, the price recovers toward the ceiling, and only then does minting resume, when its premium has shrunk. In the simulation new positions lag the recovery of the price by several cycles for exactly this reason.
Two loops with different periods, then. The short one: growth makes positions cheap, cheap positions correct, corrections are throttled, the reservoir drains, growth resumes. The long one: growth draws participants in, participants run out, minting stops, the market clears, the discount opens, buyers return, minting resumes. Each turn of either loop ends with B not lower than it began. The process cannot run away, because it runs out of people; it cannot collapse, because there is nothing it could fail to pay. Figure 8 draws both loops and the waves the model produces from them.
Figure 8. Two loops, and the waves the model produces Above: the short loop of cheap positions and the long loop of saturation. Below: holders, new positions, backing and price over three hundred cycles under a demand rule with a finite pool.
Role 6 — the fund: a share written into the contract
The protocol fee accumulates at one treasury address; rights to it are divided into shares. One share exists at deployment, tied to the guardian; the guardian may add addresses, each a new share; the maximum is one hundred; an added address cannot be removed by anyone. A fund’s share is therefore f/N of the fee, N ≤ 100, and it cannot be diluted below f/100 nor written out.
The fee is bounded by ceilings fixed in the code — from 1 % of the deposit at the start of Phase 1 to 2.8 % at its end, 0.56 % in Phase 2 — and is charged on creating a position, so it is proportional to inflow. The fund is aligned with the same quantity the regulator optimises, and with nothing else.
How the roles hold each other up
The saver supplies the upward channel: positions entered above backing and closed above it. The spender supplies the burn channel and pays for it. The trader narrows the band and returns the price to the corridor. The liquidity provider makes the trader’s work possible and is paid by all of them. The holder is the sum of the others’ effects. The fund is paid by inflow, which every other role generates.
The circuit closes twice: on the reservoir, in the short loop, and on the discount, in the long one. Both close with B not lower than before, because the upward channels are unbounded and the downward one is not.
Where the model stops
It assumes stablecoin collateral. With a volatile currency in the reserve, R moves with that currency, and every floor above moves with it.
It takes demand as an input. The oscillation in Figure 8 comes from a demand rule — inflow drawn by momentum and by the discount to the ceiling, a finite pool that refills slowly — not from the contract. What the contract contributes is that every wave rides a staircase that does not step down. If demand never recovers, B stops rising, does not fall, and the regulator hands control to the holders.
It treats P as bounded by B and p_m through arbitrage, which requires a market with participants who arbitrage. Before liquidity exists, the bounds are theoretical.
The numbers are the white paper’s defaults. The holders can change every one of them except the fraction, the threshold rule, and the immutability of the contract.
In brief
- The ratchet works at two scales: short corrections are throttled geometrically and fed only by growth; long waves of demand run into a finite pool of participants, and no turn of either loop leaves backing lower than it found it.
- Backing does not fall through outflow. That is a property of a share, not of a debt, and it is why a solvency crisis is impossible by definition.
- A position is a purchase at the ceiling with a refund right; the premium is the market’s discount to the ceiling. Mint at the ceiling, buy at the floor.
- Corrections are shallow under ordinary behaviour; deep ones need a whale, and they are bounded by the threshold and stretched over cycles.
- The corridor is wide and, in Phase 2, tends to widen; transfer burns are the one channel that narrows it without new inflow.
- The return after a wave comes by buying at the floor, not by minting; minting resumes when the price approaches the ceiling.
Conclusions
What the model establishes, what it refines, and what it found that was not expected.
- Asymmetry is a theorem, not a figure of speech
Four channels move backing up and none is bounded above; one moves it down and is bounded three times — by the threshold, by the 38.2 % fraction, and by acting only on positions that entered below the current backing. The envelope of backing does not decline; corrections are bounded slack inside a ratchet.
- Outflow never lowers backing per token
With stablecoin collateral redemption is neutral and the fee stays behind. A token is a share of the reserve, not a debt; the claims on the reserve sum to exactly the reserve. There is no run to start. The value locked can shrink without any question of solvency.
- The two-loop wave is stable
The short loop damps corrections, the long loop damps growth through the finiteness of participants; every turn of either loop ends with backing not below where it began. The process neither runs away nor collapses.
- Corrections are born of growth, not of flight
Only a position that became cheap after the fact — after backing rose past its entry — can dilute. Corrections cluster in rises, where old participants take their gain, and are absent in outflows.
- A position is a zero-premium option; a rising mint price is a rising strike
For the saver, “the cost of entry rises” reduces entirely to a statement about strikes and needs no word about the market price.
- A strict protection level turns corrections into exits
At 23.6 % the headroom is small, cheap positions can close only in slivers, and — as the white paper notes — redemption becomes the better choice for them. The reservoir drains through redemption rather than dilution; backing stays near its record. Strictness is good for holders, neutral for the pool, and barely visible in everyday waves — the level is catastrophe insurance, and the lenient default is justified.
- The spender’s channel is off by default
The transfer fee is the only channel sized by use rather than by price, and the whole of “turnover feeds the floor” rests on it. Its default is zero; the holders switch it on from stage 2. Until they do, the spender’s role is a means of payment, not of accumulation.
- The realised width of the corridor is a choice of pool fee tier
The trader’s equilibrium band equals the cost of a round trip; on Arbitrum gas is negligible, leaving two pool fees and slippage. At a 1 % tier the band settles near two to two and a half per cent. The Uniswap fee tier is a protocol parameter in effect, though not in form.
Volatile collateral breaks the monotonicity of the floor. Demand is exogenous: the model says what the rules do with the demand that comes, not where it comes from. And the corridor’s bounds are held by arbitrageurs, who do not exist before liquidity does — the founders’ initial liquidity is a condition of the whole construction, not a gesture.