Governance & Parameters

Who controls each USD.estate parameter, how changes are made, and the guardrails that bound allocation.

USD.estate is operated by the USD.estate Foundation. Parameters are enforced in smart contracts and can only be changed through a public timelock. No governance token has been issued.

Every core parameter is set out here: what it controls, who can change it, and how depositors are notified. The protocol's credibility rests on this principle: discretion exists, but it is bounded in code and visible before it takes effect.

For fees and how value flows through the protocol, see Protocol Economics.

Governance Structure

Body	Composition	Powers
USD.estate Foundation	Cayman Islands foundation company, governed by a board of directors and an independent supervisor	Owns protocol IP; controls the timelock proposer role; approves institutional counterparties; holds the pause authority (timelock proposer is a 3-of-5 Safe; the compliance multisig that maintains the mint/redeem allowlist is 2-of-3)
Strategy Multisig	3-of-5 Safe multisig	`STRATEGY_ADMIN_ROLE`: commits and cancels subscriptions to allowlisted bonds, harvests base yield, deposits receipts, services redemptions
Timelock Controller	Onchain delay contract; open executor	Queues and executes allowlist changes, guardrail changes, fee changes, role changes and upgrades. Only the Foundation multisig can propose; once the 48-hour delay has run, anyone can execute the queued call, so no keeper or insider can quietly sit on an announced change
Pause Guardian	2-of-4 Safe multisig, signers disjoint from the strategy multisig	`PAUSE_ADMIN_ROLE`: emergency pause only
Holding Subsidiary	Wholly owned by the Foundation; 2-of-3 Safe multisig	`CREDIT_AGENT_ROLE`: records credit events, impairments and recoveries under the published rule

Signer sets for the strategy multisig and the pause guardian must not overlap. Signer addresses and thresholds are published in Contract Addresses.

Bond Eligibility Criteria

This is the intake gate. Before any bond can receive capital from sUSDest, it must meet every criterion below and pass the allowlist timelock.

Not every real-estate exposure is good collateral for a dollar vault. The protocol accepts only debt securities that are legally ring-fenced, secured on real estate, independently valued and settleable in USDC.

Every criterion below must be met:

Instrument type: debt securities (notes or bonds) with an ISIN. No equity, no profit-participation instruments, no unsecured corporate debt.
Issuer structure: a bankruptcy-remote issuer or segregated compartment (for example a Luxembourg securitisation compartment), or a special-purpose bond issuer with a named paying agent.
Security & ranking: senior claim on real-estate collateral, directly or through the issuing vehicle's asset pool, with enforcement through a trustee, security agent or noteholder representative.
Maximum LTV: loan-to-value at subscription not above MAX_LTV_BPS (70%). 70% is a hard ceiling at subscription. Development and ground-up loans are underwritten to materially lower LTVs than the 70% ceiling. That tightening is an underwriting judgement by the strategy multisig, not an onchain limit — only the 70% ceiling is enforced in code.
Valuation: independent valuation no older than MAX_VALUATION_AGE (12 months), refreshed at least annually.
Tenor: remaining maturity not above MAX_TENOR (5 years / 60 months).
Currency & settlement: USD-denominated, or with coupons and principal paid or converted to USDC before reaching the protocol. Any FX exposure must be disclosed and priced.
Jurisdiction: issuer and collateral jurisdictions must be on the approved list. At launch the list centres on Western European jurisdictions with creditor-friendly insolvency regimes and reliable real-estate title systems (e.g. Luxembourg, Switzerland, Germany, France, the Netherlands), reviewed by counsel. This is the launch scope; the approved list is governed through the public timelock.
Token: ERC-3643 implementation with an identity registry that can allowlist the BondPositionManager, plus a published token agent and freeze/forced-transfer policy.
Disclosure: offering documents, periodic investor reporting, and data sufficient for the attestation procedures.

Any change to the criteria is published in these docs and takes effect only for bonds proposed after the change.

Allocation Guardrails

Guardrails are the limits the strategy multisig cannot cross. The contracts check them on every allocation, and a transaction that would breach one reverts.

The strategy multisig decides the split between reserve and bonds, and which allowlisted bonds to buy, at its discretion within these limits. Every change to a guardrail goes through the timelock, so depositors see it before it applies.

The guardrails below are the launch values set by governance, changeable only through the public timelock:

Reserve floor (RESERVE_FLOOR_BPS): 2000 bps (20%). The minimum share of vault NAV held as USDest after any new subscription is committed.
Per-issuer cap (ISSUER_CAP_BPS): 2000 bps (20%). The maximum share of vault NAV exposed to a single issuer group, including pending subscriptions.
Per-bond cap (BOND_CAP_BPS): 1000 bps (10%). The maximum share of vault NAV in a single ISIN.
Allowlist delay (ALLOWLIST_DELAY): 7 days. The minimum time between an onchain bond-allowlist proposal and first allocation. This delay applies to the bond allowlist only; the institutional mint/redeem allowlist is a compliance list with no delay.
Subscription expiry (MAX_SUBSCRIPTION_EXPIRY): 14 days. The maximum time USDest can stay committed to an unsettled subscription.

The 7-day allowlist delay exists for you. When a bond is queued, it is visible onchain and here before a single dollar can reach it. If you do not want exposure to it, you have that window to submit a redemption request or sell sUSDest on a secondary market — but note that a redemption request is serviced at the next epoch close, which may be up to 30 days away, so the two windows are not the same length.

Concentrated / non-diversified by design

The sUSDest portfolio is deliberately concentrated / non-diversified: a curated book of senior real-estate bonds, not a broad index. The 20% per-issuer and 10% per-bond caps bound single-name risk, but the vault may hold a small number of positions. The 20% per-issuer cap sits above diversified-fund convention on purpose. Depositors take concentrated credit exposure by design.

Reserve Assets for USDest

These parameters decide what backs USDest and how that backing is managed.

Eligible reserve assets: USDC, and tokenized short-dated US Treasury bill funds approved through the timelock. Approved funds must offer at least daily dealing, so the liquid reserve — USDC plus T-bill fund units — is genuinely available well inside the 30-day redemption epoch. Actual settlement follows each fund's published dealing terms.
USDC buffer (USDC_BUFFER_BPS): 500 bps (5%). The minimum share of the USDest reserve held as USDC for institutional redemptions.
Maximum swap slippage (MAX_SWAP_SLIPPAGE_BPS): 50 bps. Eligibility requires USDC coupons, so non-USDC receipts are exceptional; when one must be swapped it goes through a timelock-managed allowlisted router set with an onchain minOut bounded by this parameter.
Approved institutions: the Foundation maintains the mint/redeem allowlist after KYC/KYB. Additions and removals are compliance actions and are not timelocked.
Mint/redeem limits: set per institution at onboarding and reviewed periodically. These are per-counterparty limits rather than a single global cap.

Redemption Parameters

Epoch length (EPOCH_LENGTH): 30 days. The global redemption cycle. Epoch closes are scheduled, not drifting: the next close is always the previous close plus EPOCH_LENGTH, never the timestamp of the servicing call, so a late servicing transaction cannot push the calendar back for everyone.
Cutoff (EPOCH_CUTOFF): 48 hours before epoch close. After this point new requests go to the next epoch.
Queue ordering: FIFO. Changing it requires a contract upgrade through the timelock.
Minimum redemption (MIN_REDEEM_SHARES): 1e18 (1 sUSDest). The smallest request requestRedeem accepts, so the queue cannot be spammed with dust. There is no cap on how many requests one wallet may have open at once.

Credit Event & Impairment Rule

Credit event trigger: a coupon or principal payment not received by its due date plus the bond's contractual grace period, or an event of default declared under the bond terms.
Impairment trigger: a credit event outstanding for longer than IMPAIRMENT_DELAY, stored onchain as 604,800 seconds (7 calendar days) — the conservative encoding of "5 business days", since the contracts hold no business-day calendar. The credit agent can also trigger impairment earlier by calling flagInsolvency(bond, evidenceHash) against a formal insolvency or enforcement notice.
Impairment value: carrying value reduced to the lower of face value and IMPAIRMENT_HAIRCUT_BPS (8000 bps / 80%) of the issuer-reported collateral value attributable to the position.
Recovery true-up: on final recovery, carrying value is replaced by the actual cash recovered.

Protocol Upgrades & Integrations

The protocol will need to adapt as new issuers, reserve assets and integrations appear. No material change to its infrastructure happens without passing the timelock.

The parameters controlled this way include:

Smart contract upgrades: changes to the vault, USDest, position managers, guardrails and queue logic.
Oracle and data providers: sources for share-price feeds published to integrators.
External integrations: liquidity venues and money-market listings.

Protocol Fee Parameters

Every fee rate is a timelocked parameter. The protocol has three fee surfaces:

Base yield admin fee (BASE_YIELD_ADMIN_FEE_BPS): 1000 bps (10%). A share of T-bill yield taken when base yield is harvested.
Performance fee (PERFORMANCE_FEE_BPS): 1000 bps (10%). A share of bond coupon income taken when coupons are deposited.
Institutional mint/redeem fee (MINT_FEE_BPS, REDEEM_FEE_BPS): 0 bps at launch. No institutional mint or redeem fee is charged at launch; either may be set above zero only through the timelock.

See Protocol Economics.

Emergency Powers

Each core contract has a pause function controlled by PAUSE_ADMIN_ROLE. The pause guardian may use it only:

when a bug or active exploit is suspected;
when a dependency (USDC, a T-bill fund, a bond token or an oracle) is behaving abnormally; or
to open a short window for an emergency upgrade, which still goes through the timelock unless a critical-security exception applies.

While paused, balances stay put and all read functions keep working. Staking, redemption requests and servicing, USDest mint and burn, and coupon and principal deposits are suspended. ERC-20 transfers of USDest and sUSDest are never paused — holders can always move and trade their tokens.

Parameter Register

Values below are the launch values set by governance. They are concrete, not illustrative, and can be changed only through the public timelock.

Three controls deliberately sit outside the timelock, marked "No" below: the institutional mint/redeem allowlist and per-institution limits (compliance actions that must be immediate — a sanctions hit cannot wait 48 hours) and the emergency pause (which can only stop activity, never move value or change an economic term). Everything that affects the economics of USDest or sUSDest is timelocked.

Parameter	Current value	Changed by	Timelock
`RESERVE_FLOOR_BPS`	2000 (20%)	Timelock	Yes
`ISSUER_CAP_BPS`	2000 (20%)	Timelock	Yes
`BOND_CAP_BPS`	1000 (10%)	Timelock	Yes
`MAX_LTV_BPS`	7000 (70%)	Timelock	Yes
`MAX_VALUATION_AGE`	12 months	Timelock	Yes
`MAX_TENOR`	5 years (60 months)	Timelock	Yes
`ALLOWLIST_DELAY`	7 days	Timelock	Yes
`MAX_SUBSCRIPTION_EXPIRY`	14 days	Timelock	Yes
`EPOCH_LENGTH`	30 days	Timelock	Yes
`EPOCH_CUTOFF`	48 hours before epoch close	Timelock	Yes
`MIN_REDEEM_SHARES`	1e18 (1 sUSDest)	Timelock	Yes
`USDC_BUFFER_BPS`	500 (5%)	Timelock	Yes
`MAX_SWAP_SLIPPAGE_BPS`	50 (0.5%)	Timelock	Yes
`IMPAIRMENT_DELAY`	604,800 s (7 calendar days ≈ 5 business days)	Timelock	Yes
`IMPAIRMENT_HAIRCUT_BPS`	8000 (80%)	Timelock	Yes
`BASE_YIELD_ADMIN_FEE_BPS`	1000 (10%)	Timelock	Yes
`PERFORMANCE_FEE_BPS`	1000 (10%)	Timelock	Yes
`MINT_FEE_BPS`	0	Timelock	Yes
`REDEEM_FEE_BPS`	0	Timelock	Yes
Timelock delay	48 hours	Timelock (self)	Yes
Mint/redeem limits	Set per institution at onboarding	Foundation (compliance)	No
Institutional mint/redeem allowlist	n/a	Foundation (compliance)	No
Pause	n/a	Pause guardian	No

Every fee rate is bounded in code at 3000 bps; setters enforce range bounds (bps ≤ 10 000) but no cross-parameter checks, so an emergency change can never be blocked by an unrelated value.

Future Governance

The Foundation may move some parameter control to broader stakeholder governance over time. NOTE: nothing on this page promises or implies a governance token. Any future governance mechanism would be subject to legal, security and smart contract review, and would be documented here before launch.

Legal Disclaimer

USDest and sUSDest give no governance rights and no ownership of the USD.estate Foundation, its subsidiaries or the Operating Company. Nothing on this page is investment advice.