What happens to your money

This page follows a dollar from subscription to redemption, naming at each step who holds it, what legal instrument it has become, what could fail, and which contract call or provision governs it. It is written for someone deciding whether to allocate, not for someone deciding whether the idea is interesting.

Two tokens with one job each. drUSD, the payment leg, is backed by treasuries and cash equivalents, pays no yield, redeems at par on demand with no queue under COBS 19A.4.1, and bears no loss. Staking it produces sdrUSD, the yield leg, backed by insured asset-secured facilities, whose yield accrues to net asset value rather than paying a coupon, redeemed through a 30-day queue priced at request time — the secondary pool being a market, not a redemption right — and which absorbs loss ahead of the protocol. sdrUSD is a share, not a deposit: in a severe year the yield leg absorbs 450 basis points, its entire period flow, before the sponsor equity is touched and long before the protocol is. An allocator who cannot hold that should hold drUSD and earn nothing.

The journey, in eleven steps

1 · You subscribe. You send USDC and receive drUSD at par. drUSD is a fiat-referenced token backed by treasuries and cash equivalents — not by commodity credit. At this point you have taken no commodity exposure at all. Governed by: COBS 19A. Contract: DrUSD.mint, which reverts if the mint would break backing.

2 · You choose exposure, deliberately. Holding drUSD earns nothing. Staking it into sdrUSD enters the financing strategy. This is a separate, explicit act — the product never converts your payment instrument into credit exposure silently. Contract: SdrUSD.stake, which mints shares at the current net asset value.

3 · The vehicle acquires a claim — one claim. A single-purpose ADGM vehicle acquires one identified facility — and only one. It issues its own debenture against it. You never hold the underlying facility; you hold a share whose value derives from that debenture. Why one vehicle: pooling triggers the fund regime.

4 · The facility funds metal, and nothing else. Proceeds buy physical commodity. Not proprietary positions, not general corporate purposes. The metal bought with the money becomes the collateral pool.

5 · Control is established before value is advanced. The goods sit in approved custody, and the advance is limited to a fraction of eligible collateral — the rest is haircut, absorbing price moves, liquidation cost and assay differences. A second pledge over already-pledged stock is refused outright, as is a pledge over stock that does not exist. Proved: whr_double_pledge_rejected, whr_phantom_stock_pledge_rejected.

6 · Monitoring runs continuously. A monitoring firm the insurers approve, paid for by the borrower, verifies the collateral pool. Verdicts are computed from settlement receipts rather than from self-reported state, so a violation cannot be laundered by reassigning a beneficiary or discharging the obligation elsewhere. Proved: link_verdicts_immune_to_world_events.

7 · The trade completes and the coupon settles. Metal is refined and sold; proceeds repay. A settlement cannot be booked before its due time, and cannot be booked twice. Proved: settlement_never_premature. Contract: FacilityRegistry.settle, which writes an append-only receipt.

8 · Cash reaches the pool before NAV moves. The vault books the coupon only against cash it has actually received. We got this wrong once — an early version credited NAV without receiving the cash, inflating the share price out of nothing — so the contract now transfers before it accrues, and a test guards it. Contract: SdrUSD.accrueSettled; invariant nav() <= backing() along this path.

9 · Your share appreciates. sdrUSD does not pay a coupon. It is a share whose NAV rises as settlements accrue. This distinction is legal as well as economic: a fixed rate would make you a creditor, and you are not one.

10 · You exit — by one of two routes, which are not equivalent. Primary: request redemption and claim after the queue, matched to the facility repayment cycle. Your redemption is priced at request time, so a later loss cannot claw it back. Secondary: sell into the pool at market, immediately, at whatever the market pays — which may be below NAV. Contract: SdrUSD.requestRedemption then claim; previewRedeem prices it.

11 · If something fails, the waterfall runs. Holders are paid first, capped at par, before general creditors receive anything. The distribution conserves the pool exactly. Provision: COBS 19A.11.4. Proved: frt_distribute_holders_first_par_capped.

Where you sit in the capital stack

The most important sentence in this documentation, for an allocator: sdrUSD absorbs loss ahead of the protocol.

It is a pro-rata share, not a deposit and not a coupon.

At the severe corner the credit loss is 693 basis points, split 450 to the yield leg and 243 to sponsor equity, leaving nothing for the protocol. The first-loss tranche absorbs 0 because it is not bought; the sdrUSD yield leg absorbs 450, its entire period flow; sponsor equity absorbs the remaining 243, touched only after the yield leg is wiped to zero; and the protocol absorbs 0, last in line. In a severe year the loss routing puts 450 basis points on the yield leg — its entire period flow — before the sponsor's equity is touched and long before the protocol is. An early version of our own model got this backwards, paying holders a fixed rate and quietly making them creditors. The contracts implement the share.

If you require an instrument that does not absorb loss, the correct instrument is drUSD, and it pays nothing. That is the honest trade and we would rather state it here than have you infer it later.

What each party is obliged to do

Party	Obligation	Enforced by
The borrower	Service the facility; pay for monitoring	Facility documents; counter-indemnity
The custodian	Hold goods; release only against authorised instructions	Custody agreement; control package
The monitor	Verify the collateral pool independently	Appointment by the insurers
The issuer	Maintain backing at all times; value daily; notify breaches	COBS 19A.7.1–.7.3, to the FSRA
The attestor	Confirm reserves monthly, including a random-day test	COBS 19A.9.1(b)(iv)
The auditor	Test reserve composition and controls annually	COBS 19A.10
The protocol	Publish reserve state; never book NAV it does not hold	Contract invariant; verification

The four questions to ask us

If you are diligencing this, these are the questions that actually discriminate, and each has a page answering it:

Does the reserve exist and match supply, and can I check without you? → Verify the reserve
What is the legal wrapper, and is it licensed? → The ADGM position and why one SPV per claim
Where does the yield come from and is the margin achievable? → How Doré makes money
What do I lose in a bad year? → Risks and default and workout
What am I actually funding, and on what terms? → The first facility and fees and terms
Who can change the deal after I am in? → Governance

What is not yet true

Nothing is deployed to any chain. No attestor or auditor is engaged. No FSRA authorisation is in place. The mechanics above are implemented and tested in Solidity and proved in Lean, and the legal route is sourced — but this is a design you are diligencing, not a live system with an operating history. The roadmap states what has to become true.