Backed issuance

A backed instrument, such as a stablecoin or a note, is minted against deposits of eligible assets into a reserve on the ledger. The reserve holds the assets, mints the backed units against each deposit and burns them against each payout, and checks its cover in the same transaction.

At a glance
Input	The backed instrument, the assets its reserve takes and their terms, which the issuer and the reserve’s holder accept once.
Output	A reserve: the assets it holds, locked on the ledger, and the backed units outstanding, always covered.
Settlement	Each mint or redemption is one transaction across the asset’s registry and the issuer’s: the deposit locked or the payout released, the backed units minted or burned, the cover checked.

The reserve

Term	What it is
Backed instrument	The instrument issued to investors, on the issuer’s registry. One reserve backs it.
Reserve	The contract that holds the assets behind the instrument and mints and burns it. The venue, the issuer and the reserve’s holder sign it.
Asset	What the reserve may hold: any registrar’s instrument, each with its price source and freshness, its haircut and an optional concentration cap.
Holder	A party of the reserve’s own, hosted by the issuer or a custodian it appoints. It owns every reserve holding, so the reserve stays apart from the issuer’s own book.
Cover	The reserve’s value after haircuts, over what is outstanding at the backed instrument’s price. It never falls below the minimum cover, of at least 1.

Par and accumulating

	Par	Accumulating
Price	1: one unit is one unit of account	The reserve’s value over what is outstanding, computed inside each mint and redemption
Yield	The issuer’s: it withdraws the reserve’s excess	The holders’: income is absorbed into the reserve and the price rises
For	A payment stablecoin, which pays its holders no yield	A note or another investment product

The rule

Inside every act that changes the reserve, before it commits:

Σ units × price × (1 − haircut) ≥ outstanding × backed price × minimum cover

and each asset’s share stays within its cap. Each price is the asset’s latest point from its price source, within its freshness window; an asset at par counts at 1. A mint and a withdrawal must leave the rule holding. A redemption, a top-up and an absorption may leave it short only where the cover does not fall. An act that would break it fails whole, and nothing moves. Every rounding favours the reserve: a mint pays the price rounded up and its units round down; a redemption is paid at the price rounded down.

The joint lock

Every reserve holding is the holder’s own, in its basic account, locked to the venue, the issuer and the holder together. None of them can release it alone: only the reserve can. The issuer locks its own assets in the reserve’s authority. Another registrar’s asset is locked through that registrar’s lock agreement, signed once by the registrar, the holder and the issuer: it lets the reserve lock and merge the asset’s holdings, never transfer them, and it ends only when the reserve holds none.

Opening a reserve

Backed issuance runs on two packages of its own, nodeasset-reserve and nodeasset-reserve-lock, on the venue’s Canton node and the issuer’s (Install). Without them on the venue’s node, the venue reads no reserve and cannot open one. The venue proposes the reserve, empty, under four eyes, and the issuer and the holder each accept it on their own node. For another registrar’s asset, the venue proposes that registrar’s lock agreement under four eyes, and the registrar, the holder and the issuer each sign it. The venue proposes the backed instrument’s supply terms from its policy, its cap, liquidate-only and its windows, and the issuer accepts them on its own node; every mint and redemption is charged to them.

Minting against a deposit

Who signs what

Transaction	Submitted by	Signed by	Seen by
Tx 1 · The order recorded: its legs, the price and the deadline			and its custodian;
Tx 2 · The allocation request (the token standard’s), naming the investor’s two allocations			and its custodian;
Tx 3 · The investor’s allocations: its deposit set aside on the asset’s registry, its receipt of the backed units readied on the issuer’s		, with each registry	Each registrar its own; as executor
Tx 4 · The request accepted		None
Tx 5 · Settle: the deposit paid to the holder and locked, the backed units minted, the supply terms charged, the cover checked	as executor	Nobody signs again	its legs; all of it; the asset’s registrar its own legs

Tx 5 is one transaction because the cover can only be checked on assets already locked, and the deposit arrives in the same settlement that mints the units. Nobody signs at Tx 5: the investor authorized its legs with its allocations, the issuer and the holder with their signatures on the reserve, and another registrar with its lock agreement. A redemption runs the same way back: the investor’s backed units are burned, and the assets they are worth leave the reserve to the investor, in one transaction; the cover is checked on what stays locked.

The reserve’s other acts

Act	By	What it does
Top-up	The holder	Adds its own units of an asset to a par reserve, minting nothing.
Withdrawal	The issuer	Pays a par reserve’s excess to the issuer, which is how it keeps the yield. The rule must hold after.
Absorption	The venue	Takes the income an accumulating reserve’s asset paid the holder into the reserve, which raises the price. Only income the reserve absorbs counts.
Report	The venue	Re-reads every locked holding and a fresh price for each asset on the ledger, and records a report the venue and the issuer sign: units, prices, haircuts, values, outstanding and cover. Daily, and on demand.
Amendment	The venue proposes, the issuer accepts	New terms: assets, haircuts, caps, freshness or the minimum cover. A tightening takes effect at once, a loosening after the reserve’s delay; terms the cover would fail under are refused.
Close	The venue or the issuer	Once nothing is outstanding: every holding unlocked to the holder, and every lock agreement released.

The backed instrument, the issuer, the holder, the valuation and the unit of account never change. A change to any of them is a new product.

Pausing

The venue has no gate of its own on the product. Stopping mints or redemptions is the issuer’s supply term: liquidate-only stops mints, and redemptions can be paused. The venue stops only its own orders: a hold on the backed instrument, from reconciliation or risk, stops its mints and redemptions. A short cover holds it too, which stops mints and lets redemptions go on. See Holds, freezes and issuer powers.

Worked example

A par stablecoin backed by units of a money-market fund on another registrar’s registry, priced by the fund’s administrator, minimum cover 1, no haircut:


The investor deposits	1,000 fund units, at the fund’s latest point of 1.002
Minted	⌊1,000 × 1.002 ÷ 1⌋ = 1,002 stablecoins
The rule after	1,000 × 1.002 × (1 − 0) = 1,002 ≥ 1,002 × 1 × 1
A redemption of 500	Pays 500 × 1 ÷ 1.002 = 499.001996 fund units, rounded down to the reserve’s six decimals

With a haircut of 0.02 the same deposit counts as 981.96, short of 1,002: the reserve’s holder first tops the reserve up with fund units of the issuer’s own, and the mint then settles on that margin.

Controls

The cover is checked inside every act that changes the reserve; an act that would break it fails whole.
No party alone can release a reserve holding: each is locked to the venue, the issuer and the holder.
The issuer and the holder accept the reserve once, and another registrar its lock agreement once; each mint and redemption settles the amounts the investor allocated.
Terms change only by an amendment the issuer accepts, and a loosening waits the reserve’s delay.
The proof of reserve is the ledger’s own report.
NodeAsset reconciles the reserve’s record against its locked holdings, what is outstanding against the backed instrument’s supply, and the cover against its minimum; a short cover holds the backed instrument.
The venue and the issuer see the reserve; the investor sees only its own legs; another registrar sees its agreement and its asset’s holdings.

Do it

POST /v1/reserves                                    # four eyes; the issuer and the holder then accept
POST /v1/reserves/{reserveId}/lock-agreements        # four eyes; another registrar, the holder and the issuer sign
POST /v1/reserves/{reserveId}/mints                  { "holderId": "alpha", "assetId": "FUND", "quantity": "1000" }
POST /v1/reserves/{reserveId}/redemptions            { "holderId": "alpha", "assetId": "FUND", "units": "500" }
GET  /v1/reserves/{reserveId}                        # holdings at the latest prices, value, cover, the latest report
POST /v1/reserves/{reserveId}/reports                # a report on the ledger, now
POST /v1/reserves/{reserveId}/amendments             # four eyes; the issuer accepts
POST /v1/reserves/{reserveId}:close                  # four eyes; nothing outstanding

Start here

Workflows

Foundations

The reserve

Par and accumulating

The rule

The joint lock

Opening a reserve

Minting against a deposit

Who signs what

The reserve’s other acts

Pausing

Worked example

Controls

Do it

​The reserve

​Par and accumulating

​The rule

​The joint lock

​Opening a reserve

​Minting against a deposit

​Who signs what

​The reserve’s other acts

​Pausing

​Worked example

​Controls

​Do it

The reserve

Par and accumulating

The rule

The joint lock

Opening a reserve

Minting against a deposit

Who signs what

The reserve’s other acts

Pausing

Worked example

Controls

Do it