Overview

The Anemos stablecoin is a Djed/Zephyr-style overcollateralized design. It targets a USD peg, backs it with a reserve of native ANM, and uses strict integer math so every node computes an identical result.

Mint and redeem against a floor

• Mint deposits ANM at the oracle price and issues stablecoin only if the post-mint collateral ratio stays above a floor (launch value ~400%). This minting-halt-below-floor rule is the anti-death-spiral mechanism, lifted from Djed’s formally verified bounds.
• Redeem burns stablecoin and returns ANM at the oracle price, reserve-ratio aware.

Both execute against the previously committed (lagged) oracle price, never an in-flight attestation in the same block, so a single block cannot be used to front-run the peg.

Balances as shares, interest as an O(1) index

Holder balances are stored as shares with a single global monotonic interest index $I$; the displayed balance is $\text{shares} \times I$. Accruing “golden-age” interest is therefore a single index bump — $O(1)$, with no per-account iteration — which keeps a full node light enough to run on Android (the Android app can run a full node; pruned/light is its default). Interest accrues to senior (USD) holders only and is the marginal overflow of the block-subsidy emission slice above the 1200% collateral target, measured on the instantaneous ratio (not a TWA band): only the slice landing above 1200% is paid to senior holders, while everything at or below 1200% builds the reserve. It is self-throttling: paying interest raises liabilities, the ratio falls back toward 1200%, the slice lands wholly in the reserve, and interest stops. (The junior Reserve Coin earns no interest — it gains by residual-equity appreciation; see below.)

A health-dependent reserve

Each block’s reward splits between the proposer (and delegate) and the stablecoin reserve. The reserve slice is not fixed — it is routed by the collateral-ratio time-weighted average (ratio TWA): build the buffer at a base rate in the comfort band, taper toward zero as the ratio weakens, and divert surplus to senior holder interest only when strongly overcollateralized. A hard validator-share floor (PhiMin, 75%) guarantees the proposer always keeps at least three-quarters of every block (BFT liveness); the comfort-band reserve slice and the above-target diversion are each bounded at 25%, so the validator share never falls below 75%.

Above-target senior yield (junior earns by appreciation)

Above the 1200% target — where the reserve slice would otherwise be zero and the whole reward goes to validators — the protocol diverts 25% of the block reward into the senior (USD) interest pool. The senior stablecoin is the only tranche that earns an APR, capped at 16%/yr. That yield is smoothed: above-target revenue accrues into a persisted interest pool and is paid out at a steady, capped per-block rate, so the realized senior APR is fair across time rather than lumpy — it works out to roughly the cap times the fraction of the year the chain spends over target, so the full 16% is reached only in a near-full-year sustained bull. Whatever the cap cannot pay simply stays in the reserve as extra buffer, which lifts the junior (Reserve Coin) residual equity. The diverted slice is minted into the reserve, so the move is conservation-exact, and the 75% validator-share floor still holds.

The junior tranche earns no cash yield. The Reserve Coin’s return is its residual-equity appreciation alone — its pro-rata claim on the over-collateralization (reserve value minus liabilities), which grows as the reserve buffer grows. Below the 1200% target there is no diversion at all — validators keep their full reward and there is no senior yield, by design (build in good times, nothing in distress).

Launch: the two-step reserve bootstrap

A fresh network faces a chicken-and-egg deadlock. There is no reserve yet, so the first MintStable is impossible — a full-value mint lands the post-mint collateral ratio near 100%, far below the ~400% floor, and minting halts. Funding the reserve first via MintReserve would itself be blocked the moment any supply exists, because the anti-hype max-collateral cap rejects equity injection once the system is already overcollateralized. The two guardrails that keep the steady state safe jam the launch.

Anemos resolves this with an explicit, capped two-phase launch, governed by one genesis parameter, BootstrapReserveTarget (default 75,000 ANM on testnet; 600,000 ANM on mainnet, where the target scales with the larger fair-launch supply), and one latching state bit, BootstrapDone:

• Phase 1 — fund the reserve (minting halted). Until the reserve first reaches the target, MintReserve bypasses the anti-hype cap so anyone can fund the reserve toward the target (75,000 ANM on testnet, 600,000 ANM on mainnet) regardless of ratio or supply, while MintStable is halted (rejected — no stablecoin can be minted until the buffer exists). All other guards are unchanged: deposits still flow into the reserve and the junior tranche, shares are still issued normally, and every overflow check still rejects rather than wraps, so no value is created from nothing.
• The latch. As soon as a MintReserve deposit brings the reserve to the target or above, BootstrapDone flips to true. This is a consensus fact — it is part of the committed state root, so every node agrees on the exact block the phase changes. The latch is monotone: once set it never reverts, even if the reserve later falls below the target through redemptions or a haircut.
• Phase 2 — normal operation. With BootstrapDone set, the normal rules resume: MintReserve is governed by the anti-hype cap again, and MintStable is enabled subject to the ~400% floor described above.

Setting BootstrapReserveTarget to 0 disables the bootstrap entirely — the system behaves as already-bootstrapped from genesis (minting enabled, reserve minting capped). In short: on a fresh network you seed the reserve to the target (75,000 ANM on testnet, 600,000 ANM on mainnet) with minting disabled, and then minting opens. The full treatment is in the whitepaper (§4.9).

Operating modes and restructuring

The module tracks an operating mode (normal → pre-terminal → terminal → restructuring). A mild senior insolvency does not immediately latch the terminal wind-down: the protocol can restructure — write the senior face down to its backed value and issue the shortfall as fungible recovery tokens (a deferred senior claim bought back at par from future surplus before the junior tranche earns again). The waterfall is senior ≻ recovery ≻ junior, enforced at redemption-time price. Only a catastrophic drop past a cumulative write-down floor falls through to the terminal pro-rata wind-down.

Reflexivity, stated plainly

The reserve is ANM-denominated, so its USD value tracks ANM’s price, and emission funding mints more of the same volatile asset. Ratio floors dampen the spiral but do not remove it — the only real backing is native market cap. The full math, conservation proofs, and risk register are in the whitepaper.

Using it from the wallet

To actually mint and redeem from the CLI wallet — including a worked send mint-stable / send redeem-stable example against the public testnet endpoint — see Stablecoin transactions in the wallet tutorial.