Docs
Powered by

Onchain / Offchain Structure

How legal title, bond documentation and enforcement map onto onchain positions, vault accounting and guardrails.

How legal title, bond documentation and enforcement map onto onchain positions and structural rights.

USD.estate runs on two record systems at once. Neither is complete by itself. The protocol's documents and contracts are designed so that the two stay synchronised at every material event.

The Two Layers

The offchain layer is the real-world legal, banking and property infrastructure:

  • The USD.estate Foundation and its Holding Subsidiary, both Cayman Islands entities
  • Bond documentation: final terms, prospectuses, securitisation compartment documents, trust and agency agreements
  • Issuer registers, paying agents and custodians
  • The real estate securing each bond, and the mortgages, pledges or equivalent security over it
  • Subscription agreements and investor onboarding of the Holding Subsidiary
  • Bank and custody accounts for USDC and tokenized T-bill fund holdings
  • The Services Agreement with the Operating Company and the agreements with approved institutions

This is where each bond is legally enforceable. It gives the protocol real rights in real courts: noteholder claims against a ring-fenced issuer, security over property enforced by a trustee or security agent, and ranking in insolvency.

The onchain layer is the USD.estate Protocol smart contracts:

  • USDest and its mint/burn controls, limited to allowlisted institutions
  • The sUSDest vault: ERC-4626 deposits and the ERC-7540 redemption queue
  • The BondPositionManager, an allowlisted ONCHAINID identity that holds the ERC-3643 bond tokens
  • The BasePositionManager, which custodies the USDC and T-bill reserve behind USDest and harvests base yield on it
  • The bond allowlist, guardrail parameters and timelock controller
  • Vault accounting: positions, accrued coupon, credit-event status, both share prices and the redemption queue

This is where each position is transparent, programmable and composable. Depositors get real-time visibility into holdings and cash flows, automated guardrail enforcement, and a tokenized claim (sUSDest) they can hold, transfer or use in other onchain products.

Why Both Layers Are Necessary

The offchain layer exists because:

  • Bonds are securities created by legal documents. Only those documents create coupon rights, security over property and enforcement remedies.
  • Bankruptcy remoteness depends on real entities and real separateness: segregated compartments, special-purpose issuers, and a dedicated holding subsidiary.
  • Coupons and principal usually originate in bank accounts at paying agents. Conversion to USDC and delivery to the protocol need real-world counterparties.
  • Real-world compliance (KYC/KYB, sanctions, tax, securities law) needs real-world actors.
  • Smart contracts cannot foreclose on a building. Only trustees, security agents and courts can.

The onchain layer exists because:

  • Depositors need a liquid, transparent, composable instrument to hold.
  • Allocation limits are only credible if enforced by code, not by policy.
  • Positions, coupon receipts and credit events become publicly verifiable in real time instead of sitting in private investor reports.
  • Automated accrual and settlement remove administrative friction and operational risk.
  • Timelocked parameter changes give depositors notice and an exit before exposure changes.

The Bond Token: The Bridge Between the Two Layers

Each position is held as an ERC-3643 security token issued by the bond's own token agent. The protocol does not mint a representation of the bond. The bond token is the issuer's own instrument.

The bond token represents:

  • A specific number of units of a specific bond (ISIN)
  • The holder's right to coupons and principal under the bond terms
  • The holder's standing in the issuer's register

Only a wallet with a valid ONCHAINID identity and the right claims can receive the token. The BondPositionManager's identity carries claims issued for the Holding Subsidiary, so the onchain holder and the legal holder are the same economic party.

Where the bond terms designate the token ledger as the register of holders, the onchain balance is authoritative. Where they do not, the issuer's or transfer agent's register is authoritative, and onchain balances are reconciled to it at every settlement, coupon and attestation.

Subscriptions settle delivery-versus-payment. USDC reaches the issuer only when the bond tokens are delivered to the BondPositionManager, so the onchain and offchain pictures of a position change at the same moment.

The Holding Subsidiary: Rules-Bound Holder

The Holding Subsidiary is a wholly owned subsidiary of the USD.estate Foundation. It acts only under the protocol's documents and rules. Those documents define a finite set of actions it may take and tie each one to a contractual trigger or to an onchain instruction from an authorised role.

During normal operations, the Holding Subsidiary:

  • Completes investor onboarding with issuers and maintains the identity claims of the BondPositionManager
  • Signs subscription agreements that match a subscription committed onchain by the strategy multisig
  • Receives coupon and principal notices and makes sure the cash reaches the BondPositionManager
  • Maintains the books and records that feed vault accounting. It transmits data and does not generate or modify substantive content

On a credit event, the Holding Subsidiary:

  • Confirms that a missed coupon or event of default has occurred under the bond terms
  • Records the credit event onchain, which stops coupon accrual for that position
  • Applies the published impairment rule once IMPAIRMENT_DELAY has run, or flags a formal insolvency or enforcement notice onchain (flagInsolvency) to open the early impairment path
  • Exercises noteholder rights (votes, instructions to the trustee, participation in enforcement) in line with the documented policy
  • Deposits recoveries into the vault and closes out the position onchain

What the Holding Subsidiary cannot do:

  • Transfer, pledge or encumber bond positions except to settle a redemption or maturity under the bond terms
  • Use bond positions or their proceeds for the liabilities of the Foundation, the Operating Company or any other party
  • Allocate to a bond that is not on the timelocked allowlist
  • Sell bonds early to fund depositor redemptions
  • Modify NAV methodology, the impairment rule or yield distribution outside the published rules

The Strategy Multisig: Bounded Discretion

Unlike a pure lending protocol, USD.estate gives the strategy multisig real, bounded discretion over allocation. It decides how much of the vault sits in the reserve versus bonds, and which allowlisted bonds to buy and when. The contracts bound that discretion.

The strategy multisig can:

  • Commit and cancel subscriptions to allowlisted bonds
  • Harvest base yield and deposit coupon and principal receipts
  • Service the redemption queue at epoch close
  • Request allowlist and parameter changes, which only the Foundation's proposer multisig can queue in the timelock

The strategy multisig cannot:

  • Allocate to a bond that is not allowlisted, or before its timelock expires
  • Breach the reserve floor or the per-issuer cap. The transaction reverts
  • Select individual users for redemption or reorder the queue
  • Redirect coupon or principal payments, or change NAV
  • Change a guardrail without going through the timelock

Capital Flow: End-to-End

The structure is easiest to follow as a sequence of flows that cross the onchain/offchain boundary:

  1. Reserve in (onchain): an approved institution deposits USDC and receives USDest. Part of the reserve is placed in a tokenized T-bill fund.
  2. Stake (onchain): any holder deposits USDest into sUSDest at the deposit share price.
  3. Subscription (onchain → offchain): the strategy multisig commits USDest to a subscription. At settlement, USDC goes to the issuer and bond tokens go to the BondPositionManager.
  4. Deployment (offchain): the issuer uses the proceeds under its bond terms, for example real-estate financing within a securitisation compartment.
  5. Coupons & principal (offchain → onchain): the issuer or paying agent pays USDC to the BondPositionManager. It is converted to USDest and deposited into the vault, stepping up the redemption share price.
  6. Base yield (onchain): T-bill yield on the USDest reserve is harvested and minted as USDest into the vault.
  7. Redemption (onchain): holders request redemption. At epoch close, available USDest is released to the queue in order.
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#eef0ff','primaryBorderColor':'#4d4dff','primaryTextColor':'#1e293b','lineColor':'#94a3b8','secondaryColor':'#e9f5f2','tertiaryColor':'#f8fafc','clusterBkg':'#f6f9fc','clusterBorder':'#dbe3ec','edgeLabelBackground':'#ffffff','actorBkg':'#eef0ff','actorBorder':'#4d4dff','signalColor':'#475569','signalTextColor':'#1e293b','labelBoxBkgColor':'#eef0ff','labelBoxBorderColor':'#4d4dff','noteBkgColor':'#fff7e6','noteBorderColor':'#c2a06a'}}}%%
sequenceDiagram
    participant I as Approved Institution
    participant U as USDest
    participant V as sUSDest Vault
    participant B as BondPositionManager
    participant X as Issuer / Paying Agent
    I->>U: Deposit USDC
    U->>I: Mint USDest
    I->>V: Stake USDest
    V->>B: Commit subscription (USDest)
    B->>X: USDC at settlement (DvP)
    X->>B: ERC-3643 bond tokens
    X-->>B: USDC coupon / principal
    B->>V: Deposit as USDest (NAV ↑)

Vault Accounting as the Depositor Ledger

Vault accounting is not a mirror or a reporting layer. It is the authoritative record of depositor entitlements. It records:

  • Each position: bond, units, carrying value, accrued coupon and status
  • Reserve balances held by the vault
  • Deposit and redemption share prices
  • Coupon, principal and recovery receipts with transaction references
  • Credit events and impairments
  • The redemption queue, request by request

Absent manifest error, vault accounting is determinative evidence of sUSDest entitlements, as set out in the Terms of Service.

Enforcement: Dual-Track Credit Events

When a credit event occurs, handling runs on both layers.

Onchain (immediate, rules-based):

  • The position is flagged as a credit event and stops accruing coupon in the deposit share price
  • New subscriptions to the affected issuer are blocked
  • If the impairment trigger is met, the carrying value is reduced to the published impairment value

Offchain (document-driven remedies):

  • The trustee, security agent or noteholder representative accelerates the bond under its terms
  • Security over the property or the property-owning vehicle is enforced, which may include a sale, receivership or restructuring
  • The Holding Subsidiary votes and acts as noteholder under the documented policy

Convergence (onchain reflection of the offchain outcome):

  • When recoveries are received, the Holding Subsidiary deposits them into the vault. The position is closed and NAV is trued up to the actual recovery. This is the final discrete NAV event of the credit-event lifecycle.

Why This Works

  • Every major state change (subscription, coupon, principal, credit event, recovery) is recorded in both layers
  • Settlement is delivery-versus-payment, so the two records cannot drift at settlement
  • The Holding Subsidiary is the single party with authority in both layers, which prevents coordination failure
  • Allocation discretion exists but is bounded in code and made visible by the timelock
  • Depositors can rely on the onchain record day to day without giving up the protections of legally enforceable, collateralised securities

© 2026 USD.estate Foundation. Documentation is provided for information only and is not an offer of securities or investment advice.