Gold-STRC

Gold is the oldest store of value in continuous use, and it is also the largest pool of yield-starved capital in modern finance. The global above-ground gold market exceeds thirteen trillion dollars in value, yet the instruments that hold it for investors return nothing. Exchange-traded funds such as SPDR Gold Shares charge an annual expense ratio and distribute zero yield. Tokenized gold such as PAX Gold and Tether Gold faithfully represents allocated metal on-chain, and likewise distributes zero yield. A holder of gold today pays for the privilege of holding it, either through a custodial fee or through the opportunity cost of capital that earns no return. The asset preserves purchasing power across centuries, but it has never paid the holder for the service.

GOLD-STRC is a permissionless, immutable instrument on Ethereum that pays gold-denominated yield on gold collateral, with solvency that any observer can verify on-chain at any block. Each token is issued against PAXG, the regulated and gold-redeemable token from Paxos, held one-to-one inside an immutable contract. The protocol generates return from four structurally positive sources, lending of idle reserve gold, automated covered-call writing on gold options, conservative carry between spot gold and short-dated funding, and capture of the spread when new tokens are issued above par. Realized yield is distributed to holders as claimable PAXG dividends, and a portion accretes to net asset value so that the backing per token is monotone non-decreasing. The protocol targets a net distribution of approximately ten percent annually, framed throughout this document as a target conditioned on stated assumptions rather than a promise.

The design borrows its institutional logic from preferred-stock yield instruments, most directly from Strategy's STRC, a high-yield preferred instrument backed by a treasury balance sheet that attracted more than a billion dollars of demand. GOLD-STRC ports that mechanism to a larger and more liquid asset class, and it strengthens the transparency properties by removing the issuer entirely. There is no manager, no multisig, and no upgrade path. The contract that deploys the system destroys itself in the same transaction under EIP-6780, leaving an instrument that is sovereign of itself. What follows is the full mechanism, the mathematical proofs of its core invariants, the architecture of its yield engine, a quantitative risk framework that discloses rather than conceals, and a comparison to the instruments it is built to replace.

2.1 The yield gap in gold

Consider the economic position of a gold holder. Gold has no cash flow. It pays no coupon, distributes no dividend, and accrues no interest. Its entire return profile is the change in its spot price, which over long horizons has tracked the erosion of fiat purchasing power with remarkable fidelity. This is precisely why it is held. The investor who allocates to gold is not seeking growth; the investor is seeking the preservation of value against monetary debasement, geopolitical disorder, and the long arithmetic of inflation.

The problem is that holding gold is not free. A physical holder pays for vaulting, insurance, and assay. An ETF holder pays an expense ratio, commonly between fifteen and forty basis points annually, which is deducted from the fund's gold position and therefore slowly reduces the number of ounces represented by each share. A tokenized-gold holder pays either an explicit fee or the embedded cost of the issuer's business model. In every case the direction of value flow is the same. The holder pays the custodian. Value moves from the owner of the asset to the keeper of the asset. Over a decade, an expense ratio of forty basis points compounds to roughly four percent of principal silently transferred away, and that is before considering the larger opportunity cost, the yield the same capital could have earned in any interest-bearing instrument.

The scale of this gap is what makes it interesting. Most yield-extraction opportunities in finance are small because the underlying pools are small. The gold market is the opposite. With more than thirteen trillion dollars of above-ground value, gold is one of the largest asset classes on earth, comparable to the entire market capitalization of a major equity index, and essentially none of it pays a yield to the retail or institutional holder who is not also a sophisticated derivatives desk. The capital is enormous, the return is zero, and the gap has persisted not because it is economically necessary but because the legacy instrument structure was never designed to close it. An ETF is a passive custodial wrapper. It has no mandate, no machinery, and no incentive to generate return on the metal it holds.

The thesis of this document is that the gap can be closed structurally, transparently, and without a trusted intermediary. The machinery to do so, gold lending markets, listed and over-the-counter gold options, and on-chain money markets, already exists and is deep enough to absorb meaningful capital. What has been missing is an instrument that connects that machinery to the ordinary holder through code rather than through a fee-extracting institution.

2.2 What the protocol is

GOLD-STRC is an ERC-20 token on Ethereum. A participant mints the token by depositing PAXG into the protocol's router contract at a reference price of one hundred dollars of gold value per token, which this document refers to as par. The deposited PAXG becomes part of the protocol's reserve, held directly by the immutable contract and never rehypothecated to a third party in a way that removes it from on-chain custody. The protocol deploys the reserve into a layered yield strategy, described in full in Section 5, and the realized return is split between two destinations. A majority share accretes to the protocol's net asset value, raising the backing per token, and a minority share is set aside for distribution to holders as claimable PAXG dividends through an accumulator mechanism modeled on the reward-distribution pattern popularized by MasterChef-style staking contracts.

Redemption is the inverse of minting. A holder burns the token through the router and receives PAXG at the current net asset value, which by construction is at least the value at which the token was minted and generally higher. There is no lockup, no redemption queue, no exit fee imposed by the protocol, and no business-hours constraint. Settlement is atomic and occurs in a single Ethereum transaction.

Three properties distinguish the instrument from everything that precedes it. First, the net asset value floor only rises; Section 4 proves this as an enforced contract invariant rather than asserting it as a goal. Second, the protocol is sovereign of itself; Section 10 details the deployment pattern that leaves no administrative key in existence. Third, the token is a fully standard ERC-20 and therefore inherits the entire composability surface of Ethereum, usable as collateral, swappable on any decentralized exchange, and wrappable by any vault, which Section 12 analyzes both as an opportunity and as a source of external risk.

2.3 Document structure

The document proceeds from mechanism to mathematics to architecture, then to comparison and risk. Section 3 specifies the token accounting and the pricing logic. Section 4 states and proves the two load-bearing invariants, net asset value monotonicity and solvency. Section 5 details the five-layer yield architecture, with expected return, capacity, and bounded risk for each layer. Section 6 treats the par-stability mechanism as a control problem and demonstrates convergence. Section 7 describes the contract architecture. Section 8 analyzes the protocol game-theoretically. Section 9 compares GOLD-STRC to its peer instruments. Section 10 formalizes the trustlessness properties. Section 11 presents the risk framework without omission. Section 12 addresses economic security. Section 13 sketches future extensions that preserve trustlessness. Section 14 concludes. The appendices contain the full derivations, verification data, and a glossary.

3.1 Token accounting and the par-100 framing

The protocol denominates everything in PAXG, where one unit of PAXG represents one troy ounce of allocated London Good Delivery gold. All internal accounting, all pricing, and all dividend distribution are computed in PAXG terms, which means the instrument is gold-denominated end to end. A holder who thinks in dollars converts at the prevailing gold price, but the protocol itself never depends on a dollar value for its solvency logic. This is a deliberate design choice. An instrument that promised a dollar peg would inherit the fragility of every dollar-pegged construction; an instrument that accounts in gold and lets the gold price float is exposed only to the price of the asset its holders explicitly chose to own.

Par is not a peg.

The token is issued at a reference of one hundred dollars of gold value per token. The choice of one hundred as par is a framing convenience drawn from the preferred-stock world, where instruments are commonly issued and quoted against a round par value, and it makes the dividend rate legible as an annual percentage of a familiar base. Par is not a peg. The protocol does not defend a price of one hundred dollars and does not promise that the token trades at one hundred dollars. Par is the accounting origin against which the dividend rate is expressed and against which the issuance spread is measured.

Let S denote the total supply of GOLD-STRC tokens and let R denote the reserve of PAXG held by the protocol, both as integer quantities in their native token decimals. The net asset value per token, expressed in PAXG, is the ratio

with the convention that when S = 0 the NAV is defined by a fixed virtual floor described in Section 3.2. Every mint increases both R and S; every redemption decreases both. Yield deposits increase R while leaving S unchanged, which is the mechanism by which backing per token rises over time. The entire economic behavior of the instrument follows from how these two quantities are allowed to move relative to one another, and the constraints on their joint movement are exactly the invariants proved in Section 4.

3.2 NAV-based pricing with virtual reserves

Pricing a mint or a redemption requires a NAV, and a naive ratio R / S is undefined at the moment of first issuance when both quantities are zero. Worse, a contract that begins from a literal zero state is vulnerable to the inflation and donation attacks that have historically afflicted share-based vaults, in which a first actor mints a single base unit, donates a large quantity of the underlying directly to the contract, and thereby distorts the share price so that subsequent depositors are rounded down to zero shares and their deposits are captured.

GOLD-STRC neutralizes this class of attack with virtual reserves, a technique conceptually related to the virtual liquidity used in concentrated-liquidity automated market makers. The contract treats the reserve and supply as if seeded with a fixed virtual quantity that no actor owns and no actor can withdraw. Let v denote the virtual offset. The pricing NAV becomes

where v_R and v_S are constants chosen so that the initial NAV equals the intended par value in PAXG terms and so that the smallest economically meaningful mint cannot move the price by a manipulable margin. Because the virtual quantities are constants embedded at deployment, they never change, they are never claimable, and they impose a permanent lower bound on the denominator that makes the donation attack uneconomic. The first real buyer receives tokens priced against the virtual seed rather than against an empty contract, and every subsequent actor prices against a denominator that cannot be driven to a manipulable value.

The virtual-reserve construction has a second benefit. It defines a clean NAV at every point in the contract's life, including the degenerate states of zero real supply and the final redemption that returns real supply to zero, which removes an entire category of edge-case branching from the pricing path and therefore removes an entire category of potential implementation error.

3.3 Asymmetric spread and the 60-40 allocation

When a participant mints, the protocol does not issue tokens at exactly NAV. It applies a small issuance spread, so that the participant pays slightly more PAXG per token than the prevailing NAV. This spread is the protocol's fifth yield source, analyzed in Section 5.6, and it is also the mechanism that makes the NAV floor strictly rise on issuance rather than merely holding constant. The spread is asymmetric by design. It is charged on the way in, at mint, and it is not charged on the way out, at redemption, where the holder receives full NAV. The asymmetry ensures that the act of entering the instrument contributes value to the existing holders, while the act of exiting extracts only what the exiting holder is owed and nothing more.

The value captured by the protocol, from the issuance spread and from the realized yield of the four market-facing layers, is allocated in a fixed ratio. A constant fraction accretes to the reserve, raising NAV for all holders, and the complementary fraction is routed to the dividend accumulator for claimable distribution. The protocol fixes this split at sixty percent to backing accretion and forty percent to claimable dividends. The sixty-forty allocation is a constant set at deployment and cannot be altered. The economic reasoning is that backing accretion compounds, since value added to the reserve earns yield in subsequent periods, while claimable dividends serve the holder who wants realized cash flow rather than mark-to-NAV appreciation. The split balances the compounding interest of long-term holders against the income preference of holders who treat the instrument as a yield-bearing position to be drawn from.

3.4 Dividend distribution via a MasterChef accumulator

Distributing dividends to a changing set of holders, fairly and without iterating over every address, is a solved problem in decentralized finance, and the protocol uses the canonical solution. The accumulator pattern, popularized by the MasterChef staking contract and used in countless reward systems since, maintains a single global variable representing accumulated reward per unit of supply, scaled by a large fixed-point factor to preserve precision. Let A denote the accumulated dividend per token, scaled by a precision constant P. When the protocol distributes a dividend of D PAXG across a supply of S tokens, it updates

Each holder's account stores a debt checkpoint d_i equal to the value of A at the time of their last interaction, multiplied by their balance. A holder's claimable dividend at any later time is

When a holder claims, transfers, mints, or burns, the contract first settles the outstanding owed_i, then resets the debt checkpoint to the current A scaled by the new balance. This construction distributes rewards in constant time per interaction, independent of the number of holders, and it is exact up to the rounding introduced by the precision constant P. Section 4.3 proves that the accumulator conserves value, meaning the sum of all claimable balances never exceeds the total dividends distributed, so the contract can never promise more than it holds.

The choice of PAXG as the dividend asset keeps the instrument gold-denominated through the entire value cycle. A holder mints with gold, the protocol earns on gold, and the holder claims gold. There is no point at which the holder is forced into dollar exposure or into a volatile reward token whose value is uncorrelated with the position they chose to hold.

3.5 Edge cases: the first buyer and the last seller

Two states in the life of the instrument deserve explicit treatment because they are where naive implementations fail. The first buyer enters when real supply is zero. As described in Section 3.2, the virtual reserve defines the price for this actor, so the first mint is priced against the virtual seed and produces a well-defined token quantity with no division by zero and no manipulable initial ratio. The first buyer receives tokens at par plus the issuance spread, exactly as every subsequent buyer does, and enjoys no special advantage and suffers no special penalty beyond the ordinary early-mover dynamics analyzed in Section 11.5.

The last seller exits when their redemption would return real supply to zero. The virtual reserve again ensures a clean computation. The redeeming holder receives PAXG at the current NAV computed with the virtual offset in place, the real supply returns to zero, the real reserve returns to whatever the virtual accounting implies, and the contract remains in a valid state from which a new first buyer can mint. There is no terminal state that traps residual value, and there is no path by which the last seller can extract more than the NAV-implied claim. The symmetry of the virtual construction across the first and last actor is what allows the protocol to make the strong monotonicity guarantee of Section 4 without carve-outs or special cases, and the absence of special cases is itself a security property, since every conditional branch in a financial contract is a place where an invariant can be violated.

The credibility of GOLD-STRC rests on two properties that are not asserted but enforced. The first is that the net asset value per token, measured in PAXG, never decreases under any valid operation. The second is that the protocol is always solvent, meaning the reserve always covers the obligation implied by the supply at the prevailing NAV. This section states each property formally and proves it. The proofs use only elementary algebra, because the contract logic is itself elementary; the strength of the guarantee comes not from mathematical sophistication but from the fact that the inequalities reduce to fixed numerical conditions that hold at every reachable state.

It is not a statement about market price, which floats freely, but a statement about the redeemable PAXG value of each token, which the contract guarantees can never fall.

4.1 NAV monotonicity, formal statement and proof

Let the state of the protocol be the pair (R, S) of reserve and supply, both nonnegative integers in native decimals, and let the pricing NAV be the rational quantity

with fixed virtual constants v_R > 0 and v_S > 0. The reachable operations are mint, redeem, and yield deposit. The claim is that each operation produces a new state (R', S') satisfying

Yield deposit. A yield deposit adds y > 0 PAXG to the reserve and leaves supply unchanged, so R' = R + y and S' = S. Then

since the numerator strictly increases and the denominator is fixed. Monotonicity holds strictly.

Mint. A mint of m tokens requires a PAXG payment p. The contract computes the required payment so that the buyer pays at least the prevailing NAV plus the issuance spread phi >= 0. Concretely the payment satisfies

and the new state is R' = R + p, S' = S + m. To show monotonicity it suffices to show

Cross-multiplying, since both denominators are strictly positive, the inequality is equivalent to

Expanding both sides and cancelling the common term (R + v_R)(S + v_S) reduces the inequality to

Dividing both sides by (S + v_S) and recognizing (R + v_R)/(S + v_S) = NAV(R, S), this is exactly

which is implied by the payment rule p >= m * NAV(R, S) * (1 + phi) for any phi >= 0. The NAV is therefore non-decreasing on mint, and strictly increasing whenever the spread phi is positive. The cross-multiplication form is significant for the implementation, because it lets the contract verify the condition using only integer multiplication and a single comparison, with no division and therefore no rounding in the check itself.

Redeem. A redemption of m tokens pays the holder p PAXG at NAV with no spread, so p <= m * NAV(R, S), and the new state is R' = R - p, S' = S - m. The contract pays the floor of the exact NAV claim, so the realized payment is bounded above by m * NAV(R, S). Monotonicity requires

By the identical cross-multiplication and cancellation, this reduces to

that is, p <= m * NAV(R, S), which holds because the contract pays the floor of exactly that quantity. The NAV is therefore non-decreasing on redemption, with the small strict increase that arises from the integer floor rounding in the protocol's favor by at most one base unit. This rounding is conventional and is always oriented so that residual value remains with the reserve rather than leaking to the redeemer.

Combining the three cases, every reachable operation satisfies NAV(R', S') >= NAV(R, S). By induction over any finite sequence of operations starting from the deployment state, the NAV is monotone non-decreasing for the entire life of the contract. This is the formal content of the claim that the backing floor only rises. It is not a statement about market price, which floats freely, but a statement about the redeemable PAXG value of each token, which the contract guarantees can never fall.

4.2 Solvency invariant, formal statement and proof

Solvency is the property that the protocol can honor the redemption of the entire supply at the prevailing NAV from the reserve it holds. Because NAV is defined as (R + v_R)/(S + v_S), the obligation to real holders is S * NAV and the available real backing is R. Solvency requires

In the protocol's accounting the dividend provision is held separately from the redemption reserve, so the cleaner statement is that the redemption reserve R always satisfies

This is a tautology under integer arithmetic given v_R, v_S > 0, which can be seen by observing that

and since the right side exceeds the obligation by the strictly positive virtual quantities, the real reserve R always covers the floor of the real obligation with room to spare. The virtual reserve therefore does double duty. It defines pricing at the degenerate states, and it guarantees that the solvency inequality holds with a strictly positive buffer at every state. The contract additionally checks the solvency condition on every state-changing call before any external token transfer executes, so that a hypothetical violation reverts the entire transaction atomically rather than allowing a partial state update. A failed solvency check is not a loss event; it is a reverted transaction with no effect.

4.3 Dividend accumulator correctness

The accumulator of Section 3.4 must conserve value, meaning that the sum over all holders of claimable dividends never exceeds the total PAXG that has been distributed to the accumulator. Let D_total be the cumulative dividends distributed, and recall the global accumulator updates by A <- A + (D * P)/S on each distribution of D across supply S. For a holder with constant balance b over a window in which the accumulator moved from A_0 to A_1, the credited amount is

Summing over all holders with their respective balances, and using that the balances at the time of each distribution sum to the supply S used in that distribution's update, the total credited across a single distribution of D is

so each distribution credits exactly D in aggregate, up to the floor rounding introduced by the integer division by P. Because every division floors, the aggregate credited is at most D, never more. Summing over all distributions, the total credited is at most D_total, which is the conservation property. The unclaimed remainder, the difference between D_total and the sum actually credited, is a dust quantity bounded by the number of distributions times one base unit per holder interaction, and it remains in the contract rather than being over-promised. The precision constant P is chosen large enough, on the order of 1e18 or higher, that this dust is economically negligible relative to any realistic dividend.

4.4 Decimal alignment and FullMath

PAXG carries eighteen decimals and GOLD-STRC is defined with eighteen decimals to match, which removes an entire class of scaling bugs that arise when an instrument's decimals differ from its reserve asset. Even with aligned decimals, the intermediate products in NAV and accumulator arithmetic can exceed the range of a single machine word. A multiplication such as m * (R + v_R) in the monotonicity check, or D * P in the accumulator update, can overflow 2^256 for large supplies and large precision constants. The contract performs these operations with full-width intermediate arithmetic, computing the 512-bit product and then dividing down to the final 256-bit result, using the FullMath approach established by Uniswap V3 for its fee and liquidity math. This guarantees that the multiply-then-divide sequence is exact and overflow-safe across the entire range of reachable values. The combination of aligned decimals and full-width intermediate math means the proofs of Sections 4.1 through 4.3, which are stated over the integers, hold exactly in the deployed implementation rather than approximately.

5.1 The five-layer stack, overview

The return distributed by GOLD-STRC is generated, not subsidized. There is no emission of a governance token to manufacture an attractive headline rate, and there is no reflexive mechanism by which the yield depends on continued inflows. The protocol earns from five independent layers, each of which has positive expected value on its own economic merits, and the combination is constructed so that the layers are imperfectly correlated across market regimes. When one layer compresses, another tends to expand, which is the source of the anti-fragility claim quantified in Section 5.7.

The return distributed by GOLD-STRC is generated, not subsidized.

The five layers are PAXG lending, automated covered-call writing on gold, cash-secured put writing, carry between spot gold and short-dated funding, and issuance-at-premium capture. The first four are market-facing and deploy the reserve into external venues; the fifth is endogenous and arises from the protocol's own issuance spread. Each subsection below states the economic source of the return, the mathematical structure of the expected yield, the capacity constraint that bounds how much total value locked the layer can absorb before its return compresses, the risk profile with quantitative bounds, and the integration approach by which the contract interacts with the external venue.

A general principle governs all four market-facing layers. The protocol never deploys reserve capital in a way that removes it from on-chain verifiability without a corresponding on-chain claim of at least equal value, and the solvency check of Section 4.2 runs against the full reserve including deployed positions valued conservatively. Capital that is lent is represented by the lending receipt token; capital that secures an option is represented by the collateral lock and the premium received; capital in a carry position is represented by both legs. At no point does the reserve accounting credit a position at more than its conservatively marked value.

5.2 Layer 1: PAXG lending, expected APY, capacity, risk

Economic source. Tokenized gold is useful collateral. Borrowers who are long gold exposure but need short-term liquidity, market makers who need inventory to fill gold-denominated order flow, and basis traders who borrow the spot leg of a carry trade all create natural borrowing demand for PAXG. A lender of PAXG into an over-collateralized money market earns the supply rate that clears this demand. The return is the compensation for providing liquidity to borrowers who post collateral worth more than they borrow.

Mathematical structure. In a utilization-based interest-rate model of the kind used by major on-chain money markets, the borrow rate is a piecewise-linear function of utilization u, the ratio of borrowed to supplied assets, and the supply rate is the borrow rate scaled by utilization and by one minus the reserve factor f. The supply APY is approximately

where r_borrow(u) rises steeply past an optimal utilization kink. For tokenized gold, observed utilization is moderate and the supply rate has historically ranged in the low single digits. The protocol models this layer conservatively at one to three percent on the deployed portion.

Capacity. Lending capacity is bounded by borrow demand. As the protocol supplies more PAXG, utilization falls unless borrow demand grows in step, and falling utilization lowers the supply rate. The capacity before meaningful compression is on the order of the existing borrow demand in PAXG money markets, which is finite and smaller than the other layers. The protocol therefore treats lending as a base layer that absorbs a portion of the reserve rather than the whole.

Risk. The risks are money-market smart-contract risk on the venue, and the risk that a borrower's collateral falls faster than it can be liquidated, leaving bad debt socialized across suppliers. Both are bounded. The protocol restricts lending to venues with conservative collateral factors and battle-tested liquidation engines, and it caps the fraction of reserve deployed to any single venue so that a total loss on one venue is bounded to that fraction. The expected loss is the product of a small venue-failure probability and a capped exposure, which keeps the risk-adjusted return positive.

Integration. The contract supplies PAXG to the money market and holds the interest-bearing receipt token. The receipt token's redeemable value is read for reserve accounting, marked at the lower of its nominal and oracle-implied value. Withdrawal for redemptions pulls from the most liquid venue first.

5.3 Layer 2: automated covered calls on gold, expected APY, capacity, risk

Economic source. A covered call is the sale of an upside option against an asset already held. The seller receives a premium today in exchange for capping the asset's appreciation above the strike for the life of the option. Because the protocol holds gold as its reserve, it is naturally positioned to write calls against that gold. The premium is compensation for forgoing gains above the strike, and over long samples the systematic sale of covered calls on a held asset has produced positive risk-adjusted return, a result documented in the equity-index covered-call literature and applicable to any asset with a liquid options surface.

Mathematical structure. The fair premium of a European call is given by the Black-Scholes formula

where N is the standard normal cumulative distribution function, K the strike, T the time to expiry, r the risk-free rate, and sigma the implied volatility. For a call struck a chosen distance out of the money and rolled at a fixed tenor, the annualized premium yield is approximately the per-period premium divided by the spot, times the number of periods per year. Holding moneyness and tenor fixed, premium income scales nearly linearly with implied volatility, so this layer's contribution rises in volatile regimes and falls in calm ones. At a gold implied volatility of fifteen, a monthly call struck a few percent out of the money yields a premium on the order of one to one and a half percent per month gross, before accounting for the periods in which the call finishes in the money and caps the upside.

Capacity. The capacity of this layer is set by the liquidity of the gold options surface, both listed and over-the-counter. Gold options are among the deepest commodity options markets in existence, so the capacity is large relative to lending, though writing very large notional in short tenors will move implied volatility against the writer. The protocol scales call writing to a fraction of reserve that the options surface can absorb without material price impact.

Risk. The defining risk of a covered call is opportunity cost, not loss of principal. If gold rallies sharply above the strike, the position forgoes the gains above the strike but does not lose gold below the premium received. The maximum regret is bounded and is exactly the appreciation above the strike that was sold. The protocol bounds this by writing calls on only a fraction of the reserve, so that a sharp rally still leaves the majority of the reserve participating in the upside, and by selecting strikes far enough out of the money that the probability of finishing in the money is modest. The reserve fund of Section 8.4 further smooths the periods in which calls finish in the money.

Integration. Option writing is executed against venues with on-chain settlement or through a conservatively margined structured-product wrapper, with the collateralizing gold locked and the premium received credited to reserve and dividend accounting per the sixty-forty split. Positions are marked at their current liquidation value for the solvency check.

5.4 Layer 3: cash-secured put writing, expected APY, capacity, risk

Economic source. A cash-secured put is the sale of a downside option backed by the cash required to purchase the asset if assigned. The seller receives a premium for the obligation to buy the asset at the strike if the price falls below it. For a protocol that wishes to accumulate gold at or below current prices, writing puts is economically coherent. The protocol is paid to commit to buying gold at a discount to today's price, an outcome it is content to accept because acquiring more gold below market only strengthens the reserve.

Mathematical structure. By put-call parity the European put premium is

with the same d1 and d2 as in Section 5.3. As with calls, premium income scales with implied volatility, so this layer is also volatility-sensitive and expands in stressed regimes. The protocol writes puts struck below spot using a portion of its USDC or short-dated funding capacity as the securing cash, which connects this layer to the carry layer of Section 5.5.

Capacity. Capacity is bounded by the protocol's willingness to acquire gold at the strike and by the put side of the options surface. Because assignment results in gold acquisition rather than loss, the binding constraint is the fraction of reserve the protocol is willing to hold as securing cash rather than as gold, which is a deliberate allocation decision rather than a market limit.

Risk. The risk of a cash-secured put is that gold falls well below the strike and the protocol is assigned, acquiring gold above the then-current market. The loss relative to spot at assignment is bounded by the distance the price has fallen below the strike, net of the premium received. Because the acquired gold is held, not liquidated, the position is a mark-to-market drawdown on freshly acquired reserve rather than a realized loss of existing reserve, and the premium provides a first-loss cushion. The protocol sizes this layer so that full assignment across all written puts still leaves the reserve composition within its target bounds.

Integration. Puts are written against securing cash held in a money-market position so that the cash itself earns a base rate while it waits, stacking the put premium on top of the carry return. Assignment converts cash to gold inside the reserve.

5.5 Layer 4: spot-to-spot and spot-to-USDC carry, expected APY, capacity, risk

Economic source. Carry is the return to holding a position financed at a lower rate than the position yields. Two carry structures are available. The first is spot-to-spot, in which idle reserve gold is lent as in Layer 1 while the protocol holds an offsetting claim, capturing the spread between venues. The second is spot-to-USDC, in which the protocol borrows USDC against gold collateral at a stablecoin borrow rate and deploys the proceeds into a higher-yielding but conservatively risk-managed position, capturing the spread between the gold-collateralized borrow rate and the deployment yield. The economic source is the term and liquidity premium between the funding rate and the deployment rate.

Mathematical structure. The net carry yield on deployed capital is

where y_deploy is the yield on the deployed proceeds, r_borrow is the stablecoin borrow rate, and LTV is the loan-to-value ratio at which the protocol borrows against its gold. The protocol borrows conservatively, at an LTV well below the liquidation threshold, so that the carry is positive across the normal range of stablecoin rates and the liquidation buffer is large.

Capacity. Carry capacity is bounded by stablecoin borrow liquidity and by the protocol's conservative LTV cap. Because the protocol deliberately borrows at low LTV, it uses only a fraction of its available borrowing power, which leaves headroom and bounds liquidation risk. Capacity is large in absolute terms because stablecoin markets are deep, but the protocol self-limits.

Risk. The dominant risk is a spike in the stablecoin borrow rate that inverts the carry, and the secondary risk is liquidation if the gold collateral falls and the LTV breaches the threshold. Both are bounded by the conservative LTV and by an automated deleveraging rule that unwinds the borrow before the liquidation threshold is approached. An inverted carry is closed rather than held, so the layer's contribution floors near zero in adverse funding regimes rather than going materially negative.

Integration. The contract maintains the collateral and borrow positions on a major money market, monitors the health factor through the oracle, and deleverages automatically when the health factor approaches a conservative floor well above the liquidation point.

5.6 Layer 5: issuance-at-premium capture, expected APY, capacity, risk

Economic source. When the token trades above par on the open market, an arbitrageur can mint at NAV plus spread and sell at the market price, capturing the difference. The protocol participates in this arbitrage by charging the issuance spread phi of Section 3.3 on every mint. The spread is pure protocol revenue contributed by the entering holder, and it is the layer that makes NAV strictly rise on issuance as proved in Section 4.1. The economic source is the demand to enter the instrument when it trades rich to par.

Mathematical structure. The revenue from this layer over a period is

so it scales with mint volume rather than with reserve size. In growth regimes, when mint volume is high relative to total value locked, this layer contributes a meaningful share of total yield; in steady-state, when the supply is stable, it contributes little. It is therefore countercyclical to the reserve-based layers in a useful way, since it is largest exactly when the protocol is growing and the reserve-based layers have not yet scaled.

Capacity. This layer has no capacity limit in the usual sense, because it does not consume external market depth. Its magnitude is bounded only by mint demand, which is endogenous to the protocol's adoption.

Risk. The issuance spread is a cost to entering holders, and an excessive spread would deter minting and reduce adoption. The protocol sets phi at a modest level so that the friction of entering is small relative to the yield earned by holding, which keeps minting attractive while still contributing to NAV accretion. There is no principal risk in this layer, only the adoption tradeoff.

Integration. The spread is applied in the router's mint path as part of the payment computation, requiring no external venue.

5.7 Combined APY across regimes

The total yield is the reserve-weighted sum of the layer contributions, and its character changes with the gold volatility regime because the options layers are volatility-sensitive while the lending and carry layers are volatility-insensitive. The protocol models three regimes by gold implied volatility, low-volatility with implied volatility below twelve, normal with implied volatility between twelve and eighteen, and high-volatility with implied volatility above eighteen. The following table presents target gross contributions by layer in each regime, expressed as annualized percentages on total reserve, framed explicitly as modeled targets under stated assumptions rather than realized results.

The gross total is reduced by the realized cost of calls and puts that finish in the money, by venue fees, and by the reserve fund's retention in stressed periods, after which the protocol targets a net distribution near ten percent in the normal regime. The structural observation is the one that supports the anti-fragility claim. In the low-volatility regime the options layers compress, but lending and carry hold and the par-stability mechanism of Section 6 recalibrates the dividend rate so that the distributed rate tracks what is actually earned rather than overpromising. In the high-volatility regime the options layers expand and the reserve fund accumulates a larger buffer, which is then released to smooth subsequent low-volatility periods. The design does not depend on any single regime persisting, and it does not break when the regime shifts; it reallocates emphasis across layers that were constructed to be imperfectly correlated.

6.1 The control problem

The dividend rate is the protocol's single control lever, and the par-stability mechanism is the closed-loop controller that sets it. The objective is not to peg the market price to one hundred dollars, which would be both impossible without infinite reserves and undesirable since the instrument is meant to float with gold. The objective is narrower and achievable. The mechanism adjusts the rate at which dividends are distributed so that the instrument's market price, expressed as a multiple of NAV, oscillates within a tight band around par rather than drifting persistently rich or persistently cheap. When the token trades below NAV, raising the distributed rate increases the carry of holding the instrument, which attracts buyers and lifts the price toward NAV. When the token trades above NAV, easing the rate reduces the incentive to crowd in, which relaxes the price back toward NAV. The control target is the price-to-NAV ratio, and the actuator is the dividend rate.

The reserve is never spent to support the price; it only ever grows under the monotonicity invariant.

This framing is deliberately a control problem rather than a market-making problem. The protocol does not quote two-sided markets and does not consume reserve to defend a price. It changes a single scalar, the per-epoch dividend rate, and lets rational arbitrageurs do the work of moving the price. The reserve is never spent to support the price; it only ever grows under the monotonicity invariant of Section 4.1.

6.2 Epoch-based dividend rate adjustment

Time is divided into epochs of fixed length. At the close of each epoch the controller observes the time-averaged price-to-NAV ratio over the epoch, obtained from the TWAP oracle of Section 7.4, and adjusts the dividend rate for the next epoch. Let x_k be the observed price-to-NAV ratio in epoch k, let r_k be the dividend rate for epoch k, and let the target ratio be one. The controller applies a proportional adjustment

where g is a fixed proportional gain, and r_min and r_max are constant bounds that cap the rate within a band the yield engine can actually fund. The gain and the bounds are constants set at deployment and cannot be changed. The sign of the adjustment is the stabilizing one. When the price is below NAV, x_k < 1, the term (1 - x_k) is positive, the rate rises, and holding becomes more attractive. When the price is above NAV, x_k > 1, the rate falls. The clamp ensures the controller can never promise a rate the engine cannot sustain, which is the property whose absence destroyed earlier algorithmic designs.

The rate is bounded above by what the yield engine actually earns, smoothed by the reserve fund. The controller cannot conjure yield; it can only allocate the realized yield between a higher current distribution and a larger reserve buffer. This is the essential discipline. The rate lever moves within the envelope of real earnings, never beyond it.

6.3 Convergence properties and stability bounds

Treating the price-to-NAV ratio as a dynamical system driven by the rate, a first-order model of arbitrageur response is that the next-period ratio moves toward an equilibrium determined by the current rate, with some responsiveness h,

where r_eq is the rate at which holders are exactly indifferent and the price sits at NAV. Substituting the controller law and linearizing around the equilibrium (x = 1, r = r_eq), the closed-loop dynamics of the deviation e_k = x_k - 1 follow

The deviation decays geometrically when the loop gain satisfies

which is the standard stability condition for a first-order discrete proportional loop. Within this range, perturbations to the price-to-NAV ratio decay rather than amplify, and the system returns to the band around par after a shock. The protocol selects the gain g conservatively so that g * h sits well inside the stable interval across the plausible range of arbitrageur responsiveness h, trading a slightly slower return to par for robustness against misestimating h. The clamp on the rate provides an additional global safeguard, since even under a gross misestimate the rate cannot leave the funded band, which bounds the worst-case behavior to a slow drift within the band rather than a divergence.

6.4 Comparison to algorithmic stablecoin failures

The death spiral that destroyed Terra and similar designs had a specific mechanical cause, and the GOLD-STRC mechanism avoids it by construction. In a reflexive algorithmic stablecoin, the peg was defended by minting a secondary token whose value depended on confidence in the system, so a loss of confidence reduced the value of the very instrument used to defend the peg, which accelerated the loss of confidence. The feedback loop was positive, meaning self-reinforcing, and once it began it could not be stopped because the defense mechanism consumed the asset whose value was collapsing.

GOLD-STRC has no such loop for three reasons. First, the instrument is fully backed by an exogenous asset, gold, whose value does not depend on confidence in the protocol; the reserve is real PAXG, not a reflexive seigniorage token. Second, the control lever is the dividend rate, not the minting of a confidence-sensitive token, so adjusting the lever does not dilute or endanger the backing. Third, the monotonicity invariant guarantees that NAV cannot fall regardless of market sentiment, so even in a scenario where the market price trades far below NAV, a holder can always redeem for the full NAV in PAXG, which places a hard floor under the price that no amount of negative sentiment can breach. The arbitrage of buying below NAV and redeeming at NAV is risk-free up to gas and execution, so the price cannot persist below NAV. The mechanism stabilizes the price from above through the rate lever and is floored from below by the redeemability invariant, and neither direction relies on confidence in a reflexive token. The failure mode that defines algorithmic stablecoins is therefore structurally absent.

7.1 The GoldSTRC token contract

The token contract implements the ERC-20 standard with eighteen decimals and carries the dividend accumulator of Section 3.4 in its transfer logic. Every balance-changing operation, transfer, mint, and burn, settles the affected accounts' dividend debt before adjusting balances, which keeps the accumulator exact across all token movements including ordinary peer-to-peer transfers. The contract has no owner, no pause function, no blacklist, and no mint function callable by any external party other than the router. The mint and burn entry points are restricted to the router address, which is itself immutable and set at construction. Beyond that single relationship the token is an ordinary, fully standard ERC-20, which is what makes it composable with the entire DeFi stack as discussed in Section 12.

7.2 The GoldSTRC router

The router is the contract through which all minting and redemption flows. It holds the pricing logic, the virtual-reserve constants, the issuance spread, the sixty-forty allocation split, and the solvency check. On a mint, the router pulls PAXG from the participant, computes the token quantity using the NAV-plus-spread rule, allocates the spread between reserve accretion and the dividend accumulator, verifies the solvency invariant, and instructs the token contract to mint. On a redemption, the router computes the PAXG owed at NAV, verifies solvency, instructs the token contract to burn, and transfers PAXG to the redeemer. The router also exposes the yield-engine interface of Section 7.5, through which realized yield is reported and allocated. Every parameter the router holds is either a constant or an immutable set at construction, so the router's behavior is fixed for the life of the deployment.

7.3 The trustless deployer

The deployer is a contract whose only purpose is to atomically create the token and the router, wire them to each other, seed the virtual reserves, and then destroy itself within the same transaction. The self-destruction is what guarantees that no privileged deployment key persists. The deployer pattern is detailed in Section 10.1; architecturally, its significance is that the end state of deployment is a token and a router that reference each other and no one else, with the creating contract gone from the chain.

7.4 The TWAP oracle wrapper

The par-stability controller of Section 6 requires a manipulation-resistant measure of the market price-to-NAV ratio. A spot price read from a single block is manipulable by a flash-loan-funded swap, so the protocol consumes a time-weighted average price. The oracle wrapper reads the cumulative-price accumulator of the primary trading venue, in the manner established by the Uniswap V3 TWAP design, and computes the geometric mean price over the trailing epoch window. Because the TWAP is an average over time, manipulating it requires holding a distorted price across many blocks, which is far more capital-intensive and risky for an attacker than a single-block manipulation, and the cost of sustaining the distortion is bounded below by the arbitrage that the distortion invites. The wrapper also cross-checks against a Chainlink gold-USD feed for staleness and sanity, with the staleness handling described in Section 11.4. The oracle wrapper has exactly one post-deployment mutable element, the one-shot setter discussed in Section 10.3, and it is otherwise immutable.

7.5 The yield engine

The yield engine is the set of adapters through which the router deploys reserve capital into the five layers of Section 5 and through which realized returns flow back. Each adapter encapsulates the integration with one external venue, a money market for lending and carry, an options venue for calls and puts, and presents a uniform interface to the router for deploying capital, marking positions conservatively for the solvency check, and reporting realized yield. The adapters are constrained by immutable caps on the fraction of reserve any single adapter may control, which bounds the loss from any single venue failure as discussed in Section 5.2 and Section 11.2. The engine reports realized yield to the router, which applies the sixty-forty split, and the engine never has the authority to move reserve capital except within the immutable caps and according to the immutable strategy logic.

8.1 Holder incentives

A holder of GOLD-STRC faces a simple decision and the protocol is designed so that the rational decision is to hold. The instrument pays a gold-denominated dividend and its NAV floor only rises, so the expected return to holding is positive in gold terms before any price appreciation. A holder who values current income claims dividends as they accrue; a holder who values compounding leaves the position to benefit from the sixty percent of value that accretes to NAV. Neither holder has an incentive to exit beyond their own liquidity needs, because exit forfeits future yield and is priced at NAV with no premium. The absence of an exit premium is important. The holder who exits receives exactly the NAV claim and contributes nothing to remaining holders, while the holder who enters pays the spread and contributes to remaining holders, which biases the population toward stable, long-duration holding.

8.2 Arbitrageur behavior across the band

Arbitrageurs enforce the price band. When the market price exceeds NAV plus the issuance spread, an arbitrageur mints at NAV plus spread and sells into the market, capturing the difference and increasing supply until the price is pushed back to the mint cost. When the market price falls below NAV, an arbitrageur buys in the market and redeems at NAV, capturing the difference and reducing supply until the price is pulled up to NAV. The first arbitrage is bounded by the spread, so the price can exceed NAV by at most roughly the spread before minting becomes profitable, which caps the premium. The second arbitrage is risk-free up to execution cost because redemption pays the full NAV that the monotonicity invariant guarantees, which floors the price at NAV. The band is therefore enforced from above by spread-bounded minting and from below by risk-free redemption, and the protocol spends no reserve to maintain it; the arbitrageurs are paid by the price discrepancy they close.

8.3 Liquidation dynamics under stress

The protocol itself takes leveraged positions only in the carry layer, and only at conservative loan-to-value with automated deleveraging well above the liquidation threshold, as described in Section 5.5. Under a sharp gold drawdown, the carry position deleverages before it can be liquidated, converting the borrow back to an unlevered gold position and forgoing further carry until conditions normalize. This means the protocol is a forced seller of nothing during a crash; it unwinds a borrow rather than dumping reserve gold. For holders, a crash lowers the dollar value of the gold-denominated NAV, exactly as it would for any gold holding, but it does not impair the gold-denominated NAV and does not trigger a cascade, because there is no leverage on the holder's position and no liquidation of the holder's claim. The instrument behaves under stress like the gold it holds, with the added cushion of accrued dividends, rather than like a leveraged derivative.

8.4 The role of the reserve fund

The reserve fund is the buffer that smooths the pro-cyclical components of yield. Options premium income is largest in volatile regimes and the cost of in-the-money options is also realized in those regimes, so the raw options contribution is lumpy. The reserve fund accumulates a portion of realized yield in good periods and releases it to support the distributed dividend rate in lean periods, which lets the par-stability controller of Section 6 hold a steadier rate than the raw earnings would permit. Game-theoretically the reserve fund is what allows the protocol to honor a stable distribution without overpromising, because the controller's rate cap is set against the smoothed earnings rather than the volatile raw earnings. The fund is governed by immutable rules for accumulation and release, not by discretion, so it cannot be raided and cannot be misallocated by any party. It is a mechanical shock absorber, and its presence is what converts a volatile stream of options income into a distribution that a conservative holder can rely on.

GOLD-STRC occupies a position that none of the existing gold instruments occupy, and the cleanest way to see this is to compare it directly against each peer on the dimensions that matter to a holder, backing, yield, custody transparency, redemption, mutability, and settlement.

GOLD-STRC expresses the same category against a larger collateral base, without an issuer, and with continuous proof of solvency.

9.1 GOLD-STRC versus SPDR Gold Shares

SPDR Gold Shares is the largest gold ETF and the reference instrument for institutional gold exposure. It holds allocated gold and discloses its bar list periodically, which is meaningful transparency by the standards of traditional finance but is a periodic snapshot rather than a continuous proof. Its expense ratio is deducted from the gold position, so a holder's effective ounces decline slowly over time, and it distributes no yield. Redemption is available only to authorized participants and only in large creation-unit blocks, so the ordinary holder exits by selling shares in the secondary market during exchange hours. GOLD-STRC differs on every dimension that involves the holder's economics. It pays a yield rather than charging a fee, it proves its backing continuously rather than periodically, and it allows any holder to redeem directly at any time. The tradeoff is that GOLD-STRC carries smart-contract and DeFi-venue risks that a regulated ETF does not, which Section 11 addresses directly.

9.2 GOLD-STRC versus PAXG

PAXG is the asset GOLD-STRC is built on, so the comparison is not adversarial; GOLD-STRC is a yield layer on top of PAXG. A holder of bare PAXG owns tokenized gold that returns nothing. A holder of GOLD-STRC owns a claim on a growing pool of PAXG that pays a gold-denominated dividend. The cost of the upgrade is the marginal smart-contract risk of the GOLD-STRC layer and the strategy risk of the yield engine; the benefit is the entire yield that bare PAXG forgoes. A rational PAXG holder who is comfortable with the incremental risk has a clear economic reason to prefer GOLD-STRC, since it dominates bare PAXG on yield while inheriting the same underlying gold custody at the Paxos level.

9.3 GOLD-STRC versus XAUT

Tether Gold is structurally similar to PAXG, tokenized allocated gold with no yield, issuer-controlled, with physical redemption gated behind a high minimum. The comparison reaches the same conclusion as the PAXG comparison. GOLD-STRC adds yield and continuous on-chain verifiability that the bare tokenized-gold instruments do not provide, at the cost of the incremental protocol risk.

9.4 GOLD-STRC versus STRC

This is the most important comparison because STRC is the institutional proof of concept for the mechanism. STRC is a high-yield preferred-stock instrument issued by Strategy, backed by the company's treasury balance sheet, designed to pay a high fixed-rate distribution to holders seeking yield on a credit-like instrument tied to a hard reserve asset. STRC attracted more than a billion dollars of demand, which is direct market evidence that sophisticated capital will allocate to a high-yield instrument backed by a hard reserve when the structure is credible.

GOLD-STRC ports the STRC logic, a high-yield instrument backed by a hard reserve, to three structural improvements. The reserve asset is gold, a larger and more liquid base than a single corporate balance sheet, which broadens the addressable market and removes idiosyncratic corporate credit risk. The issuer is removed entirely, replaced by an immutable contract, which removes the governance and discretion risk that any corporate issuer carries. And the solvency is proved continuously on-chain rather than through periodic financial statements, which collapses the information lag between the holder and the reserve to a single block. The demand that STRC demonstrated is evidence of appetite for the category; GOLD-STRC is the trust-minimized, larger-collateral expression of the same category. The honest qualification is that STRC's distribution is an issuer obligation with the legal recourse that entails, whereas GOLD-STRC's distribution is a function of realized on-chain yield with no legal issuer to pursue, which is a different risk posture rather than a strictly superior one, and Section 11 treats it as such.

9.5 GOLD-STRC versus algorithmic stablecoins

The comparison to algorithmic stablecoins is included to draw a sharp line, because a superficial reading might group any yield-bearing on-chain instrument with the reflexive designs that failed. GOLD-STRC is the structural opposite. It is fully backed by an exogenous asset, it does not defend a fixed peg, its yield comes from real external sources rather than from token emission, and as proved in Section 6.4 it has no reflexive feedback loop. The instruments share only the surface feature of living on-chain and paying yield, and they differ in every property that determines solvency under stress.

9.6 GOLD-STRC versus structured gold notes

Structured gold notes sold by banks offer gold exposure with an embedded yield or capped-upside profile, constructed from the same options building blocks GOLD-STRC uses internally. The difference is intermediation and transparency. A structured note is a bilateral obligation of the issuing bank, opaque in its construction, illiquid, minimum-sized for accredited buyers, and exposed to the issuer's credit. GOLD-STRC builds the same options exposures transparently on-chain, in a permissionless and fractional instrument that any holder can enter and exit at NAV, with the strategy logic visible in immutable code rather than hidden in a term sheet. The structured note is the closest traditional analog to the protocol's internal strategy, which is itself evidence that the strategy is sound, and GOLD-STRC's contribution is to disintermediate it.

10.1 The deployer pattern under EIP-6780

The strongest claim the protocol makes is that no party can change its rules, and that claim rests on the deployment pattern. EIP-6780 redefined the behavior of the selfdestruct opcode so that, outside of the special case of a contract created and destroyed within the same transaction, selfdestruct no longer removes code and storage but only transfers the balance. The protocol uses the preserved special case. The deployer contract creates the token, the router, and the oracle wrapper, wires their immutable references to one another, seeds the virtual reserves, and then calls selfdestruct on itself within that same creation transaction. Because the creation and destruction occur in one transaction, the deployer's code is genuinely removed, and with it any privilege the deployer held. The end state on-chain is a token, a router, and an oracle wrapper that reference each other and contain no reference to any surviving privileged address. There is no deployer left to upgrade them, because the deployer no longer exists.

The protocol does not ask to be trusted; it asks to be checked, and it exposes everything required to check it.

10.2 The absence of admin surfaces

Trustlessness is not only the absence of a deployer key; it is the absence of any administrative surface anywhere in the system. The token has no owner, no pause, no blacklist, and no discretionary mint. The router's parameters, the virtual constants, the issuance spread, the sixty-forty split, the dividend-rate gain and bounds, and the adapter caps, are all constants or immutables fixed at construction. The yield engine's adapters can move capital only within immutable caps and according to immutable logic. There is no function, callable by anyone, that changes an economic parameter of the protocol. This is a stronger property than decentralized governance, because there is no governance at all, and therefore no governance attack, no proposal capture, and no parameter that can be voted into a dangerous range. The protocol's behavior is fixed at the moment the deployer self-destructs.

10.3 The one-shot TWAP oracle setter as the only post-deploy mutation

Complete immutability has one practical tension. The TWAP oracle requires a trading venue to read from, and the primary liquidity pool for the token cannot exist until the token itself exists, which is a circular dependency that cannot be resolved entirely within the deployment transaction. The protocol resolves this with a single one-shot setter on the oracle wrapper that records the address of the primary pool exactly once, after which it is permanently frozen. The setter can be called a single time; once the pool address is recorded, the function reverts on every subsequent call. This is the only post-deployment mutation in the entire system, it affects only which pool the oracle reads, it cannot redirect funds, and it disables itself after one use. The protocol discloses this as the sole exception to total immutability rather than concealing it, because the credibility of the trustlessness claim depends on disclosing its one boundary precisely.

10.4 Verifiability properties

Every claim in this section is verifiable by any observer without trusting the protocol's authors. The contract bytecode is published and can be verified against the source. The absence of admin functions is confirmable by inspecting the verified source for any privileged modifier or owner reference. The deployer's self-destruction is confirmable from the deployment transaction trace. The immutability of every parameter is confirmable from the constant and immutable declarations in the verified source. The solvency invariant and NAV monotonicity are confirmable both by reading the source and by replaying the contract's state transitions against the proofs of Section 4. The protocol does not ask to be trusted; it asks to be checked, and it exposes everything required to check it.

The value of this section is its honesty. An instrument that hides its risks is not credible to sophisticated capital, and the bounded-loss arguments that follow are only persuasive if the risks they bound are disclosed completely first. The risks below are presented without minimization, and each is paired with the structural feature that bounds it where such a feature exists.

The value of this section is its honesty.

11.1 PAXG custodial risk

The reserve is PAXG, which is a claim on allocated gold held by Paxos, a regulated trust. This introduces a custodial counterparty that sits outside the protocol's trustless boundary. If Paxos were to fail, be subject to regulatory seizure, or fail to honor PAXG redemption, the protocol's reserve would be impaired regardless of the perfection of the on-chain code. This risk cannot be eliminated by smart-contract design, because the link between an on-chain token and physical metal necessarily runs through a custodian. The protocol bounds the risk in three ways. It uses a regulated and audited issuer rather than an unregulated one. It values the reserve honestly at the live market value of PAXG rather than assuming a fixed peg, so that any PAXG discount is reflected immediately in NAV rather than hidden. And Section 13.1 sketches the path to custodial diversification across multiple tokenized-gold issuers, which would reduce single-custodian concentration. The residual risk is real and is the single largest exogenous risk the protocol carries, and a prospective holder should size their position with that concentration in mind.

11.2 Smart contract risk

The protocol is code, and code can contain defects. A latent bug in the token, the router, the oracle wrapper, or a yield adapter could in principle be exploited, and because the protocol is immutable, a discovered bug cannot be patched in place. This is the cost of immutability; the same property that prevents a malicious upgrade also prevents a benevolent fix. The protocol bounds this risk by minimizing surface area, the core logic is small and the invariants are simple enough to prove, by independent audit from established security firms, and by the conservative adapter caps that bound the loss from any single venue-facing component. The mathematical invariants of Section 4 are checked on-chain on every state-changing call, so an exploit that attempted to violate solvency or NAV monotonicity would revert rather than succeed. This does not reduce the risk to zero; no audit and no proof can guarantee the absence of all defects in software that touches external venues. The honest statement is that the risk is bounded by minimized surface, enforced invariants, and capped per-venue exposure, and that it is nonzero.

11.3 Market risk and gold-USD exposure

A holder of GOLD-STRC is long gold. If the dollar price of gold falls, the dollar value of the position falls, exactly as it would for any gold holding. The protocol does not hedge gold-USD exposure and does not claim to; the instrument is for holders who want gold exposure and are seeking yield on top of it, not for holders who want to be insulated from the gold price. This is a feature rather than a defect, because a holder who did not want gold exposure would not hold a gold instrument. The gold-denominated NAV is protected by the monotonicity invariant; the dollar value is not, and is not meant to be. The risk is fully borne by the holder by design, and it is disclosed so that no holder mistakes a gold instrument for a dollar-stable one.

11.4 Oracle risk and Chainlink staleness handling

The protocol consumes two oracles, the TWAP from the primary trading venue for the price-to-NAV control loop, and a Chainlink gold-USD feed for cross-checking and sanity. Each carries risk. A TWAP can be manipulated by an attacker willing to hold a distorted price across the averaging window, though as discussed in Section 7.4 this is expensive and self-limiting. A Chainlink feed can become stale if its updaters fail, or can report a value during a period of extreme market dislocation that does not reflect executable prices. The protocol handles staleness explicitly by checking the feed's update timestamp and round data, and by reverting or falling back to conservative behavior when the feed is stale beyond a threshold rather than acting on a stale value. The control loop of Section 6 is additionally robust to oracle noise because it acts on a time-averaged ratio with a conservative gain, so a single anomalous reading does not produce a large rate swing. The residual oracle risk is bounded by the averaging, the staleness checks, and the conservative gain, and like all the risks here it is nonzero.

11.5 Asymmetric early-mover effects

The issuance spread and the sixty-forty accretion split create a mild asymmetry between early and late participants. Because every mint accretes value to existing holders through the spread, and because realized yield compounds into NAV over time, a holder who enters earlier and holds longer captures more accreted value than a holder who enters later. This is not a flaw, it is the ordinary time value of a compounding instrument, but it is disclosed because a prospective holder should understand that the instrument rewards duration and that the earliest holders enjoy a structural, though bounded, advantage. The advantage is bounded because the spread is modest and the accretion is shared pro rata among all current holders at each moment, so a later holder still earns the full forward yield from the moment of entry; they simply do not retroactively capture the accretion that occurred before they held. There is no mechanism by which early holders extract value from later holders beyond this ordinary compounding effect, and in particular the monotonicity invariant guarantees that a later holder can never be diluted below the NAV at which they entered.

11.6 Tail scenarios

Several low-probability, high-severity scenarios deserve explicit naming. A simultaneous failure of multiple DeFi venues in a systemic crisis could impair several yield layers at once; the adapter caps bound the loss but cannot eliminate correlated venue failure. A catastrophic failure of PAXG would impair the reserve as discussed in Section 11.1. A previously undiscovered contract defect could be exploited before it is found; the enforced invariants bound but do not eliminate this. An extreme gold-price dislocation combined with an oracle failure could cause the carry layer to deleverage at an unfavorable price. The protocol does not claim immunity to tail events. It claims that its losses in tail events are bounded by disclosed mechanisms, capped per-venue exposure, conservative leverage with automated deleveraging, honest reserve valuation, and the redeemability floor, and that a holder who has read this section can form a calibrated view of the tail rather than discovering it later. The combination of honest tail disclosure and bounded-loss structure is the posture the protocol takes toward risk, and it is the posture that sophisticated capital should expect.

12.1 Cost-of-attack analysis

An attacker seeking to extract value from the protocol must defeat one of the enforced invariants, and each is expensive or impossible to defeat. Defeating the solvency invariant requires causing the contract to pay out more than the reserve covers, which the on-chain check prevents by reverting any such transaction. Defeating NAV monotonicity requires minting below NAV or redeeming above it, which the cross-multiplication checks of Section 4.1 prevent. Manipulating the par-stability controller requires sustaining a distorted TWAP across the averaging window, which costs the attacker the arbitrage their distortion invites, on every block, for the duration; the cost grows with the size of the distortion and the length of the window, and the protocol sizes the window so that profitable manipulation is uneconomic. There is no admin key to steal because none exists. The attack surface that remains is the smart-contract and venue risk of Section 11.2, which is bounded by audit, minimized surface, and adapter caps rather than by economic cost, and is the honest residual.

No layer has unbounded downside.

12.2 Bounded-loss properties

The protocol's losses are bounded in every layer by construction. Lending loss is bounded by the per-venue cap. Covered-call regret is bounded by the appreciation above the strike on the written fraction of reserve. Cash-secured put loss is bounded by the assignment drawdown net of premium on the written fraction. Carry loss is bounded by the conservative LTV and automated deleveraging. Issuance capture has no loss, only an adoption tradeoff. No layer has unbounded downside, and no layer is leveraged beyond the conservative carry position, which itself deleverages before liquidation. The aggregate loss in any scenario is therefore the sum of bounded per-layer losses, each capped at a known fraction of reserve, which is the formal content of the bounded-loss claim. A holder can compute a worst-case bound from the disclosed caps rather than relying on the protocol to have avoided the worst case.

12.3 Composability risks

The same composability that makes GOLD-STRC useful also creates external risk that the protocol does not control. If GOLD-STRC is listed as collateral on a lending market, a defect in that market or an aggressive collateral parameter set by that market could create liquidation cascades involving GOLD-STRC that the protocol did not design and cannot prevent. If GOLD-STRC trades in a pool with thin liquidity, the market price can deviate from NAV further and longer than in a deep pool, though the redeemability floor still bounds the downside. These risks live outside the protocol's trust boundary, in the third-party venues that integrate the token, and the protocol discloses that its composability is a double-edged property. The internal invariants protect the holder's NAV claim regardless of what external venues do, but a holder who deploys GOLD-STRC into a risky external venue inherits that venue's risk on top of the protocol's own. The protocol's guarantees extend to the redeemability of the token at NAV; they do not extend to the safety of every venue that might list it.

The protocol as deployed is complete and immutable, and nothing in this section alters it. Future extensions are new contracts that compose with the existing deployment, not upgrades to it, which preserves the trustlessness of the original while allowing the ecosystem around it to grow.

13.1 Multi-jurisdiction custody diversification

The single largest exogenous risk, disclosed in Section 11.1, is concentration in one tokenized-gold custodian. A future reserve composition could hold a basket of tokenized-gold instruments from independent issuers across jurisdictions, so that the failure of any one custodian impairs only its share of the reserve rather than the whole. Because the protocol values reserves at live market value, a diversified basket would be marked honestly and would reduce single-custodian concentration without changing the accounting model. This extension would be expressed as a new reserve adapter in a future deployment, and it directly addresses the concentration risk that this document identifies as the protocol's chief vulnerability.

13.2 Cross-chain deployment via canonical bridges

The instrument is defined on Ethereum, where PAXG and the deepest gold liquidity live, but the same contract standard can be deployed on any EVM chain, with the token bridged through canonical, trust-minimized bridges rather than wrapped by a discretionary custodian. A cross-chain deployment would extend access to holders on other networks while preserving the immutability and the redeemability floor on each chain, provided the bridge itself meets the protocol's trust-minimization bar. The protocol treats bridge security as a first-class consideration, since a weak bridge would import risk that the core design works to exclude.

13.3 Senior and junior tranches

The most economically significant extension addresses the criticism that a target near ten percent is too aggressive for the most conservative capital. The reserve's yield can be tranched. A senior tranche would receive a lower, more stable distribution with first claim on yield and on the reserve fund's buffer, suitable for capital that prioritizes stability over rate. A junior tranche would receive the residual yield, higher in expectation and more variable, absorbing the first loss in adverse periods in exchange for the upside in favorable ones. Tranching is the standard structured-finance technique for serving distinct risk appetites from a single asset pool, and it would let GOLD-STRC serve both the conservative allocator who wants a stable gold-denominated coupon and the yield-seeking allocator who wants the full expected return. The tranches would be separate tokens with a fixed waterfall encoded immutably, composing with the existing reserve rather than modifying it.

13.4 Restaking integration

GOLD-STRC, as a standard ERC-20 with a rising NAV floor, is a natural collateral for restaking and vault systems that seek yield-bearing, low-volatility-in-gold-terms assets. Future integrations could allow GOLD-STRC to serve as a base asset in restaking wrappers, stacking additional protocol-level rewards on top of the instrument's native yield, for holders who accept the additional smart-contract risk of the wrapper. As with all composability, this lives outside the core trust boundary and is enabled by the token's standard interface rather than by any change to the protocol.

Gold has paid its holders nothing for the entire history of finance, not because yielding gold is impossible but because the instruments that hold gold were never built to generate or distribute return. We have described an instrument that closes that gap structurally. GOLD-STRC issues a standard token against tokenized gold, deploys the reserve into five independent and imperfectly correlated yield sources, distributes the realized return as gold-denominated dividends, and accretes the remainder to a net asset value that the contract proves can only rise. The instrument is sovereign of itself; its rules are fixed at deployment, its deployer destroys itself in the same transaction, and no party holds a key that can alter its behavior. Its solvency is not attested periodically but proved continuously, checkable by any observer at any block.

The thesis is not that gold should be abandoned for something newer; it is that the holders who already own the largest yield-starved asset pool in the world deserve a structure that pays them for holding it, with transparency that exceeds anything the legacy custodial wrappers offer and with risk that is disclosed honestly and bounded by construction. The institutional appetite for high-yield instruments backed by hard reserves is already demonstrated by the demand STRC attracted; GOLD-STRC expresses that same category against a larger collateral base, without an issuer, and with continuous proof of solvency. The mathematics in Section 4 is the load-bearing core, the yield architecture in Section 5 is the engine, and the risk framework in Section 11 is the honest accounting of what can go wrong. We invite the reader to verify each of them against the deployed code rather than to take any of it on faith, because the protocol's entire design philosophy is that it should be checked, not trusted.

A.1 Full derivation of the mint monotonicity condition

Beginning from the requirement that NAV not decrease on a mint of m tokens against payment p,

Both denominators are strictly positive because v_S > 0 and supply is nonnegative, so cross-multiplication preserves the inequality direction,

Expand the left side,

Expand the right side,

Subtract the common term (R + v_R)(S + v_S) from both sides,

Divide by the positive quantity (S + v_S),

The payment rule charges p = ceil(m * NAV * (1 + phi)), which for phi >= 0 satisfies p >= m * NAV, completing the derivation. The use of the ceiling in the payment computation orients the rounding in favor of the reserve, so the realized inequality is strict by at least the rounding increment whenever phi = 0 and strict by the spread otherwise.

A.2 Full derivation of the redeem monotonicity condition

For a redemption of m tokens paying p,

Cross-multiplying and cancelling the common term as above yields

which, multiplying by negative one and reversing the inequality, is

that is p <= m * NAV. The contract pays p = floor(m * NAV), which satisfies the bound, and the floor again orients rounding in favor of the reserve so NAV is non-decreasing through redemption.

A.3 Reserve-fund smoothing model

Let realized gross yield in epoch k be Y_k, a random variable with regime-dependent mean and variance. The reserve fund retains a fraction of yield above a smoothing target and releases when yield falls below it. Let the smoothed distributable yield be Z_k and the fund balance be F_k. A simple linear smoothing rule is

with alpha in the open interval from zero to one a fixed smoothing constant. The distributable series Z_k is an exponential moving average of realized yield, whose variance is reduced relative to Y_k by a factor of approximately alpha / (2 - alpha), which for a small alpha is a substantial reduction. The fund balance F_k rises when realized yield exceeds the smoothed distribution and falls when it lags, acting as the integral buffer that absorbs the difference. The constraint F_k >= 0 is enforced; if the fund would go negative, the distribution is reduced rather than the fund overdrawn, which is the mechanism by which the controller's rate cap stays within real earnings.

A.4 Covered-call expected-value sketch

For a call written at strike K on reserve gold at spot Spot, rolled at tenor T, the per-period profit is the premium C received minus the payoff max(Spot_T - K, 0) at expiry. The expected per-period profit under the pricing measure is, by the definition of the Black-Scholes price, equal to the cost of carry on the premium, but under the physical measure with a positive gold risk premium and the empirical tendency of realized volatility to fall below implied volatility, the systematic writer captures the variance risk premium. The expected profit is approximately

and the gap between the premium C, priced at implied volatility, and the expected payoff under realized volatility is the variance risk premium that the covered-call literature documents as positive on average across liquid options markets. The protocol does not assume this premium is large; it assumes only that it is nonnegative in expectation, which the empirical record supports, and it bounds the regret of the in-the-money case as described in Section 5.3.

At the time of writing this document describes the protocol design ahead of the publication of final mainnet addresses. Upon deployment, the following artifacts will be published and independently verifiable, and a reader should confirm each before interacting with the protocol.

GoldSTRC token        : <published at deployment>
GoldSTRC router       : <published at deployment>
TWAP oracle wrapper   : <published at deployment>
Yield engine adapters : <published at deployment>
Deployment transaction: <published at deployment, showing same-tx selfdestruct>
Verified source       : <published on the block explorer>
Audit reports         : <published by the engaged security firms>

Verification checklist for a prospective holder. Confirm the token's source is verified on the block explorer and contains no owner or pause function. Confirm the router's parameters are declared constant or immutable. Confirm from the deployment transaction trace that the deployer contract executed selfdestruct within the creation transaction. Confirm the one-shot oracle setter has already been called and is now frozen. Confirm the reserve balance of PAXG held by the protocol against the supply, and compute the NAV independently. Confirm the audit reports correspond to the deployed bytecode. The protocol's trustlessness claims are only as good as a holder's willingness to perform this check, and every item on it is independently verifiable without the cooperation of the protocol's authors.

Accumulator. The global variable tracking accumulated dividend per token, scaled by a precision constant, used to distribute rewards in constant time per interaction.

Carry. The return to holding a position financed at a rate below the position's yield.

Cash-secured put. A short put option backed by the cash needed to purchase the underlying if assigned.

Covered call. A short call option written against an underlying asset already held.

EIP-6780. The Ethereum improvement that restricts selfdestruct to balance transfer except when a contract is created and destroyed in the same transaction, which the protocol's deployer uses.

FullMath. Full-width intermediate arithmetic that computes a multiply-then-divide exactly without intermediate overflow, established by Uniswap V3.

Implied volatility. The volatility input that equates a model option price to its market price, the central driver of option premium.

Issuance spread. The small premium over NAV charged on minting, which accretes value to existing holders and makes NAV strictly rise on issuance.

MasterChef pattern. The reward-distribution design that maintains accumulated reward per share to pay a changing set of holders without per-holder iteration.

NAV. Net asset value, the reserve per token expressed in PAXG, computed with virtual offsets.

Par. The accounting reference of one hundred dollars of gold value per token, an origin for the dividend rate, not a defended peg.

PAXG. PAX Gold, a regulated token redeemable for allocated London Good Delivery gold, the protocol's reserve asset.

Reserve fund. The buffer that retains yield in favorable periods and releases it in lean periods to smooth the distributed rate.

STRC. Strategy's high-yield preferred-stock instrument backed by a treasury balance sheet, the institutional analog that demonstrated demand for the category.

TWAP. Time-weighted average price, a manipulation-resistant price measure averaged over a window, used by the par-stability controller.

Virtual reserve. Fixed constants added to reserve and supply in the NAV computation that define pricing at degenerate states and neutralize donation and inflation attacks.

1. Black, F. and Scholes, M. The Pricing of Options and Corporate Liabilities. Journal of Political Economy, 1973. The foundational option-pricing formula used in the premium derivations of Section 5.

1. Markowitz, H. Portfolio Selection. Journal of Finance, 1952. The basis of the imperfect-correlation argument for combining yield layers in Section 5.7.

1. Ross, S. The Arbitrage Theory of Capital Asset Pricing. Journal of Economic Theory, 1976. The arbitrage-pricing logic underlying the band-enforcement argument of Section 8.2.

1. Adams, H. and others. Uniswap V3 Core. 2021. The source of the TWAP oracle design referenced in Section 7.4 and the FullMath approach in Section 4.4.

1. Ethereum Improvement Proposal 6780, SELFDESTRUCT only in same transaction. 2023. The basis of the trustless deployer pattern in Section 10.1.

1. The MasterChef staking contract, SushiSwap. 2020. The reward-accumulator pattern adapted for dividend distribution in Section 3.4.

1. Whaley, R. Return and Risk of CBOE Buy Write Monthly Index. 2002. Empirical support for the covered-call variance risk premium cited in Section 5.3 and Appendix A.4.

1. Strategy. STRC preferred-stock instrument disclosures. The institutional analog discussed in Section 9.4.

1. Paxos. PAX Gold whitepaper and attestation reports. The reserve asset described in Section 11.1.