# Doré Protocol
> Commodity trade finance, formally verified.
## The ceiling
The ceiling answers one question: over the declared design space, what is the
most the protocol can earn while surviving every stress scenario and keeping
every counterparty at the table?
### The shape of the result
Protocol profit is a **residual**. The borrower pays a coupon; the holder
takes a pass-through; the insurer, reinsurer, hedge desk and service providers
each take their charge; what remains is the protocol's. So the ceiling is
> advance × (borrower's alternative cost of capital) + treasury carry
> − every other player's outside option − real costs
which is the intermediation spread, stated as an inequality.
### Calibration
The original model used placeholder seeds that put the facility spread below
the treasury yield — under which the model preferred *less* lending. Corrected
against the deck's 9–12% facility band, the ceiling is **357 / 462 / 567 basis
points** across that band.
The admissible set does not change under recalibration, and there is a theorem
explaining why: no stability coordinate reads the facility spread
(`stability_ignores_facility_spread`). Recalibration changes what the protocol
*earns*, never what it *survives*.
### The participation-feasible optimum
Once every player has an outside option, the optimum is an advance of 7500 bps
funded against a 2500-bps buffer, a pass-through of 450 bps, and a coupon of
1000 bps — clearing **404 bps** before the protocol's own cost base.
It is *elegant* in a provable sense: every player it controls is paid exactly
its outside option, because slack costs the protocol precisely itself and buys
nothing in the stability gate.
### The frontier
The optimum exists only at a high enough borrower alternative:
| Borrower's alternative | Protocol residual |
| ---------------------- | ----------------- |
| 10% | 254 bps |
| 12% | 404 bps |
| 14% | 554 bps |
At a 400-bps cost base, break-even needs about 11.6%. Inverting the claim:
the $50m threshold is right if and only if the operator's alternative cost of
capital is about 12% — which pins the one number the deck never discloses.
## Onchain
This page covers the part of the subject that is genuinely new: what happens
when a commodity facility is represented onchain, which DeFi primitives it
meets there, and — the question that matters most — what tokenization does and
does not transfer.
### The skeptic's challenge, stated properly
> Tokenization by itself does not create liquidity.
The equation *private loan + ERC-20 = liquid RWA* is false, and any design that
depends on it fails. Wrapping a claim changes its representation, not its
enforceability, its verifiability, or the existence of a buyer.
What DeFi does well is act **after** the real-world asset has become a credible,
enforceable, monitorable claim. Then it makes that claim easier to fund,
transfer, tranche, refinance and compose. It is a weak fit, by itself, for
title, inspection, legal perfection, assay, sanctions screening and
enforcement — the entire truth layer.
The corollary is the design rule: **DeFi does not make a bad or unverifiable
asset good. It makes a good verified claim easier to fund.**
### Three kinds of truth, never to be mixed
This is the most useful distinction in the whole subject, and it determines
what any onchain system may legitimately claim:
Only the third is provable. Treating an attestation as a proof, or a legal
opinion as a computation, is the category error that makes verified systems
dangerous rather than safe.
Two consequences follow immediately.
**A zero-knowledge proof over false input is still a valid proof.** ZK proves
computation over committed inputs — not physical or institutional truth. It
cannot tell you the gold is there.
**Attestation freshness is first-class.** Evidence has an `asOf` and an
`expiresAt`, and stale evidence must automatically remove permission rather
than merely raise a flag. In the Doré kernel this is
`stale_evidence_cannot_authorize`.
### What formal verification is actually for
Formal verification and simulation solve different problems. Simulation
estimates uncertain reality. Verification proves the consequences of supplied
assumptions and authenticated facts. Neither substitutes for the other, and
**a perfectly verified protocol can still lose money** — correctness is not
economic judgment.
The right targets are deterministic rules: issuance caps, advance and LTV
limits, waterfall priority, draw gating, concentration caps, mandate checks,
claim lineage and reuse limits, state-transition permissions. The wrong target
is the economics of a five-year note. The best *first* target is a draw-gating
state machine.
And the proof obligation must **expose its assumptions rather than axiomatize
physical reality**. A system that assumes the metal exists has proved nothing
about the metal.
### The DeFi primitives underneath
These are execution layers. None of them can verify offchain reality — which is
precisely why a verification layer sits before and above them.
**Isolated lending markets.** A market is a tuple of collateral asset, loan
asset, liquidation loan-to-value, oracle and interest-rate model. If debt rises
past the permitted threshold relative to collateral value, the position is
liquidated. Isolation solves risk *containment* — one bad market does not
infect another. It does not solve valuation or exit: **liquidation can be
theoretical without a buyer.**
**Curated vaults.** Depositors supply one asset; a curator allocates across
approved markets and adapters subject to caps and risk identifiers. This moves
the underwriting question from the depositor to the curator; it does not remove
it.
**Shared liquidity layers.** Lending, vault borrowing and exchange liquidity
drawn from one foundation, enabling high loan-to-value on suitable collateral.
Efficiency, not safety.
**Yield tokenization.** A yield-bearing token is standardised and then split
into a principal claim (bought at a discount, redeemable at maturity) and a
yield claim. This *transforms* the yield claim — it does not remove liquidity
or credit risk from it.
### Leverage, and the metric that keeps it honest
Recursive borrowing — deposit, borrow, redeposit — inflates headline totals
without financing a single additional trade. The discipline is a rule and a
metric.
**The rule:** leverage is a *distribution* feature. It must never be the reason
the underlying credit appears solvent.
**The metric:** **real deployed capital** — the capital actually financing
commodity transactions — reported separately from total value locked and from
gross leveraged exposure. Twenty times TVL is not twenty times commodity
financing. Reuse is economically productive only when the borrowed capital
funds a *new independent trade*.
The related discipline on the claim side: **every derived position must carry
lineage back to the underlying claim**, and multiple representations of the
same claim must never be treated as independent collateral. This is the
onchain form of the double-pledge fraud from
[the risk page](/cf-risk), and it deserves the same intolerance.
### Comparable structures
A recurring pattern across credible RWA designs is a **two-token split**: a
liquid, non-yielding dollar unit backed by cash-equivalents, and a separate
staked, yield-bearing token carrying the credit exposure. Redemption terms
differ sharply between the two — the liquid unit at par on demand, the credit
token subject to cooldowns, queues or actuarially defined liquidity limits.
Doré's [drUSD and sdrUSD](/contracts) follow that shape deliberately. The
closest end-to-end precedent in the market takes an awkward offchain asset,
standardises it into secured credit, wraps it as a yield token and then places
it in a liquidity venue. Commodities are materially harder than that precedent's
collateral, because the facts are **private, moving and
jurisdiction-dependent** — which is the entire argument for building the
verification layer first.
### What this implies for the design
**The scarce work is the adapters, not the contract.** Standardising the
machine-readable interface above heterogeneous legal contracts is the difficult,
defensible part. The token is the easy part.
**Own the semantics; keep every regulated or physical partner replaceable.** The
trust boundary is explicit: partners enforce offchain — perfecting and releasing
liens, moving commodity, transferring title, collecting payments, filing
insurance claims, seizing collateral, running KYC. The protocol owns
orchestration and meaning.
**Tokenization does not remove the securities layer.** Under any serious
regulator, a tokenised debt claim is still a debt claim. The
[legal position](/legal) page states where that leaves us, on sourced text.
## Financing instruments
There appear to be dozens of commodity-finance structures. There are really
only a few, distinguished by **what stage of the trade they finance** and
**where repayment comes from**. Learn those two axes and the catalogue
collapses.
### The organising question: what repays this?
| Repayment source | What it means | Structures |
| ---------------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| The trade itself | Repayment comes from the sale or receivable generated by *this* transaction — self-liquidating | Transactional trade finance, receivables discounting, factoring |
| Future production | Repayment comes from goods that do not exist yet | Prepayment, pre-export finance, offtake finance, streams, royalties |
| The borrower's balance sheet | Repayment comes from the business generally | Corporate facilities, revolving credit |
| Realising collateral | Repayment comes from selling what secures it | Inventory and warehouse-receipt finance, repo, sale-and-leaseback |
Self-liquidating structures are the safest and the most operationally
demanding, because the security is only as good as the control over the goods
and the proceeds.
### By stage of the trade
#### Before the goods exist — production finance
**Prepayment / pre-export finance.** A financier or buyer prepays a producer in
exchange for future deliveries or repayment out of future sales. The exposure
is to production itself: failure, country risk, offtake dispute.
**Offtake finance.** Locks in access to production. Repayment can be *in
physical delivery* rather than cash, which is why an offtake contract is a
financing instrument and not merely a sales contract.
**Streams and royalties.** An upfront deposit buys a percentage of future metal
at a fixed delivery payment (a stream), or a percentage of revenue net of
smelting and refining charges (a net smelter return royalty). These are the
longest-dated instruments in the industry.
#### While cash is out — purchase and inventory finance
**Transactional / self-liquidating trade finance.** The financier supplies the
working capital for a specific purchase and is repaid from that trade's own
sale.
**Inventory / warehouse-receipt finance.** The lender advances against eligible
inventory held in an approved warehouse or controlled custody arrangement. The
formula is *inventory + custody control + haircut*, and every word carries
weight — inventory without control is not collateral.
**Repo.** Title transfers outright with an agreed repurchase, which sidesteps
some security-perfection questions and creates others.
**Borrowing base / revolving facility.** The permitted exposure is recomputed as
inventory and receivables move, rather than fixed at drawdown. This is the
structure that matches a repeating trade cycle, and the one where advance rate
and eligibility rules do the real work.
#### After the sale — receivables finance
**Receivables discounting and factoring.** Cash is advanced against invoices
already owed by buyers. The credit shifts from the borrower toward the buyer,
which is why buyer approval and credit insurance matter more here than
collateral does.
**Supplier finance.** A buyer's credit standing is used to pay its suppliers
early. Commercially this strengthens strategic suppliers; financially it
converts supplier risk into buyer risk.
**Forfaiting.** Purchase of a term receivable without recourse to the seller —
the point being that the seller is genuinely out of the risk.
#### Documentary instruments — the promise layer
**Letters of credit** (sight, usance, confirmed, standby) and **documentary
collections** (documents against payment, documents against acceptance) do not
supply money so much as restructure *who must be trusted*. A confirming bank's
promise replaces an unfamiliar buyer's promise.
**Demand guarantees and standbys** pay against a conforming demand rather than
against proof of underlying default — which is precisely why the documents
examined must conform exactly.
The recurring feature across this family: **conformity is a documentary test,
not a factual one.** A discrepant bill of lading defeats a claim even when the
goods arrived perfectly.
### The two coordinates that price the structure
**Advance rate** — what fraction of collateral value may be drawn. **Haircut** —
the remainder, which absorbs price moves, liquidation costs, assay differences
and plain uncertainty. A worked example in our sources runs a 70% maximum
advance against $10m of eligible gold, capping debt at $7m with a 30% haircut;
a shorter-tenor custody-backed facility runs 50%.
A haircut is not a fee and not a reserve. It is the lender's estimate of the
gap between **NAV and liquidation value**, and it must be set against
liquidation value and recovery *time*, not against carrying value.
### Aggregation is a different business
Once credit is aggregated or distributed, you leave trade finance and enter
structured finance. The purpose is to separate the operating borrower from the
investment claim: an SPV owns the assets, and a waterfall allocates cash and
losses by explicit rules across senior, mezzanine and junior/first-loss.
This is where most of the tokenization discourse actually lives, and it is
worth being precise that it is a *distribution* technology. It changes who
holds the claim; it does not improve the claim.
### Where these are formalized
Of the 100 archetypes in the encyclopedia, 29 run as executable Lean instances.
The instanced families are documentary credits and collections, open-account
structures (trade loan, receivables discounting, factoring, supplier finance,
forfaiting), structured commodity finance (producer prepayment,
warehouse-receipt finance, commodity repo, securitization), production finance
(metal stream, production payment, NSR royalty), risk transfer (funded
participation, whole-turnover credit insurance), derivatives (physical and
financial forwards, futures with margin, Asian options, warrants, electronic
bills of lading) and pool tranching.
Record-only — structure fixed, not yet executed — includes borrowing base,
pre-export finance, offtake-linked prepayment, tolling, inventory finance,
collateral- and stock-management agreements, non-payment and political-risk
insurance, reinsurance and ECA guarantees. Equipment sale-and-leaseback has no
record at all.
## Who finances what
Commodity finance is populated by institutions that each control one scarce
capability and trade with each other for the rest. This page is the capability
map, then a sourced map of real institutions occupying each layer.
### The capability map
| Actor | What it actually brings | What it will not do |
| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Global banks | Balance sheet, documentary instruments, correspondent network, FX and hedging | Take exposures outside a regulated box: small tickets, new borrowers, full country limits, unevidenced control |
| Commodity traders and merchants | Origination, physical knowledge, resale channels, logistics, hedging | Act as a neutral lender — they earn from the whole relationship, not a coupon |
| Trading conglomerates | Many layers at once: originator, offtaker, operator, data source, guarantor, capital provider, distributor | Be replaceable in the chain they occupy |
| Private credit funds | Speed, complexity tolerance, bespoke structuring | Price like a bank — they charge complexity, illiquidity, speed, risk and information premia |
| Development finance institutions and export-credit agencies | Catalytic risk-taking in markets private capital avoids | Move without mandate, eligibility, policy objectives and procurement rules |
| Insurers and reinsurers | Risk capacity that turns a risky asset into something conservative capital can hold | Provide liquidity, or cover exclusions |
| Exchanges, warehouses and CCPs | Price formation, standardised delivery, clearing | Verify a bilateral facility's private facts |
| Asset managers and institutional allocators | Scale | Hold anything outside mandate, however attractive |
Two readings of this table matter.
**A trading house may accept an exposure a pure lender rejects**, because it
earns from the physical relationship as well as the financing. That is not
mispricing; it is a different business model with different information.
**Institutional capital is constrained by mandate, not by size.** The task is
never "find more money". It is converting a messy local trade into an
institutionally holdable claim.
### Why banks reject good economics
Banks optimise a constrained, regulated balance sheet. They are not seeking to
fund every positive-return transaction, and rejection is usually not a view on
the trade at all. The stated reasons repeat:
* ticket too small to cover underwriting and servicing cost
* borrower too new, no banking history
* country or concentration limit already full
* collateral control hard to evidence
* sanctions and compliance burden high
* legal structure unfamiliar
This is **institutional rejection**, and it is distinct from **economic
rejection** — a genuinely unattractive risk-adjusted return. Institutional
rejection is the softer target, because it can be addressed by construction.
### The capital formation clock
The gap that kills otherwise-viable deals is temporal. A transaction may need
cash **in days**. Diligence, investment committees, documentation, subscriptions
and settlement take **weeks or months**.
Standardised eligibility and pre-positioned capital turn underwriting from a
one-off fundraising event into continuous allocation. That, rather than a lower
rate, is what a protocol can actually offer a borrower — and it is why
[time is part of price](/cf).
### The industry map
The institutions below are the seed set behind the Doré archetype corpus. Each
row is sourced to a primary product page rather than a directory listing, and
each was checked on the date recorded in the catalogue. The purpose is to show
which layer each institution occupies, and which archetypes its public products
correspond to.
This is a map of the *seed* set, not a census of the industry.
#### Global bank
| Institution | Scope | Public products and structures |
| ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Citi](https://services.citi.com/solutions/trade-working-capital) | Global | Trade Payables Finance; Supplier Finance; Dynamic Discounting; GARP receivables; Distribution Finance; credit-insured AR; commercial/usance LC; SBLC/guarantee; import/export loans … |
| [HSBC](https://www.europe.business.hsbc.com/en-gb/solutions/commodities-and-structured-trade-finance) | Global | Commodity & Structured Trade Finance; borrowing-base finance; receivables finance; traditional documentary trade; guarantees; trade loans; supply-chain finance |
| [ING](https://www.ingwb.com/en/sector/commodities-food-and-agriculture) | Global | Trade & Commodity Finance; Structured Commodity Finance based on commodity flows/cash flows; producer working capital/investment finance |
| [J.P. Morgan](https://www.jpmorgan.com/payments/solutions/trade-and-working-capital) | Global | Supply chain finance; receivables/invoice finance; inventory finance; trade loans; import/export LCs; dynamic discounting; export & agency finance |
| [Société Générale](https://wholesale.banking.societegenerale.com/en/wholesale-solutions/sectorial-approach/trade-and-sustainable-commodities/) | Global commodity hubs | Transactional secured commodity finance; pre-export finance; prepayments; secured borrowing base; unsecured corporate finance; RCF; acquisition finance |
#### Commodity trader
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Mercuria](https://mercuria.com/mercuria-energy-group-secures-copper-concentrate-offtake-agreement-with-geotechmin-ood-and-enters-strategic-financing-partnership/) | Global | Offtake-linked producer prepayments; revolving credit facilities; inventory prepayment examples |
| [Trafigura](https://www.trafigura.com/news-and-insights/publications/corporate-brochures/commodities-demystified/prepayments-demystified-an-addendum-to-the-commodities-demystified-guide/) | Global | Commodity prepayments; offtake-linked finance; refined-metals borrowing base; credit-insured receivables/prepayments facility; trade-receivables ABS/securitization; RCF/term facilities |
#### Exchange/CCP
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------- |
| [CME Group](https://www.cmegroup.com/markets/commodities.html) | Global | Agriculture/energy/metals futures and options; cleared OTC swaps; physical/financial commodity risk management |
| [Intercontinental Exchange (ICE)](https://www.ice.com/about/exchanges-clearing) | Global | Energy/agriculture/metals futures/options; OTC/physical products; clearing; physical delivery across selected markets |
#### Agribusiness/commodity merchant
| Institution | Scope | Public products and structures |
| ---------------------------------------------------------------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------- |
| [Bunge](https://investors.bunge.com/~/media/Files/B/Bunge-IR/documents/shareholder-meeting-materials/bunge-2024-annual-report.pdf) | Global | Trade structured finance using LCs/time deposits/FX; trade receivables securitization |
#### Commodity merchant + finance
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Cargill Trade & Capital Markets](https://www.cargill.com/price-risk/trade-capital-markets) | Global | Letters of credit; supplier prepayment; warehouse finance; receivables discounting; trade credit insurance; cross-border structured finance; FX/credit/money-market risk management |
#### Digital trade standards
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------ |
| [ICC Digital Standards Initiative](https://dsi.iccwbo.org/our-work) | Global | Key trade documents/data elements; paperless/electronic trade interoperability |
#### Exchange/warehouse network/CCP
| Institution | Scope | Public products and structures |
| ------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------ |
| [London Metal Exchange](https://www.lme.com/en/Trading) | Global metals | Physically deliverable metal futures; options; TAPOs; monthly-average futures; approved brands/warehouses/warrants |
#### Industry standards body
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------- |
| [BAFT](https://baft.org/member-tools/templates-standard-documents/) | Global banking | Master Trade Loan Agreement; Master Participation Agreements / risk participation |
#### Multilateral finance
| Institution | Scope | Public products and structures |
| ---------------------------------------------------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [IFC](https://www.ifc.org/en/what-we-do/sector-expertise/trade-and-supply-chain-finance) | Emerging markets/global | Trade-finance guarantees; letters of credit; promissory notes/bills; bonds/guarantees; pre-export funding; warehouse-receipt finance; risk-sharing facilities; supply-chain/invoice finance |
#### Multilateral guarantee
| Institution | Scope | Public products and structures |
| --------------------------------------------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------- |
| [MIGA / World Bank Group Guarantee Platform](https://www.miga.org/all-guarantees) | Emerging markets/global | Political-risk guarantees; trade-finance guarantees; credit guarantees; trade loans; LC confirmation |
#### Reinsurer / specialty insurer
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------------------------------------------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Swiss Re Corporate Solutions](https://corporatesolutions.swissre.com/insurance-solutions/credit-surety/trade-credit-insurance.html) | Global | Whole-portfolio trade credit; excess of loss; key-account selective; single-buyer; political-risk extensions; commodity/trade credit solutions; surety |
#### Royalty & streaming finance
| Institution | Scope | Public products and structures |
| --------------------------------------------------------------------------- | ------------- | ------------------------------------------------------ |
| [Franco-Nevada](https://www.franco-nevada.com/about-us/our-business-model/) | Mining/global | NSR/gross/profit royalties; streams; working interests |
#### Standards body
| Institution | Scope | Public products and structures |
| ---------------------------------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------- |
| [ICC](https://2go.iccwbo.org/explore-our-products/ebooks/trade-finance.html) | Global | UCP 600 documentary credits; URC 522 collections; URDG 758 demand guarantees; URF 800 forfaiting; trade rules |
#### Streaming finance
| Institution | Scope | Public products and structures |
| ------------------------------------------------------------------------------------------ | ------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| [Wheaton Precious Metals](https://www.wheatonpm.com/about/Our-Business-Model/default.aspx) | Mining/global | Precious-metal/cobalt streams: upfront deposit + percentage of future metal + delivery payment; guarantees/security in some deals |
#### Trade-credit insurer
| Institution | Scope | Public products and structures |
| --------------------------------------------------------------------------------------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------- |
| [Allianz Trade](https://www.allianz-trade.com/en_US/what-is-trade-credit-insurance/global-solutions.html) | Global | Trade credit insurance; specialty structured/single transaction; political risk; surety/bonds/guarantees; top-up cover |
#### UN legal harmonization
| Institution | Scope | Public products and structures |
| ----------------------------------------------------------------------------------------------- | ------ | -------------------------------------------- |
| [UNCITRAL](https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_transferable_records) | Global | Model Law on Electronic Transferable Records |
#### UN/intergovernmental legal harmonization
| Institution | Scope | Public products and structures |
| ------------------------------------------------------ | ------ | ----------------------------------------------------- |
| [UNCITRAL / UNIDROIT](https://uncitral.un.org/en/mlwr) | Global | Model Law on Warehouse Receipts, paper and electronic |
### What to take from the map
**No single institution spans the chain.** Banks hold documentary and
balance-sheet layers; traders hold origination and physical knowledge; insurers
hold risk capacity; exchanges hold price formation and delivery. The gaps
between them are where facilities fail — and, per the [gap
analysis](/cf), where the financing opportunity actually lives.
**Streaming and royalty houses are the long-dated end.** They finance production
that does not exist yet, against a percentage of future metal or revenue. Their
presence in this map is a reminder that commodity finance runs from 14-day
inventory advances to multi-decade royalties, and the same vocabulary covers
both.
**Multilateral institutions are not generic capital.** Their risk-taking is
catalytic: it improves private senior risk so that more capital participates.
But it arrives with mandates, eligibility rules and procurement obligations
attached.
## Risk, collateral and protection
Financing a commodity trade means holding a bundle of quite different risks and
then taking them apart. This page is the taxonomy, the security stack that
addresses it, and — importantly — what protection does *not* do.
### The risk taxonomy
| Risk | The question it asks |
| ---------------------- | ----------------------------------------------------------------------- |
| Existence | Do the goods exist, in the stated quantity and quality? |
| Title | Does the borrower own them, and can that be established independently? |
| Security | Is the lien or pledge validly created, perfected, and correctly ranked? |
| Priority | If several parties claim the same goods, who actually comes first? |
| Control | Can anyone release, substitute or move the goods without the lender? |
| Credit | Will the borrower or the buyer pay? |
| Price and basis | Does the value move against the advance before it is realised? |
| Performance | Does delivery, assay or documentation fail? |
| Legal and jurisdiction | Under which law does ownership pass, and where is enforcement real? |
| Liquidity | Can the position be exited when cash is needed, at a price near NAV? |
| Compliance | Sanctions, AML, provenance and export eligibility |
The first five are the ones outsiders collapse into "collateral", and they are
five genuinely separate questions. A lender can be right about existence and
wrong about priority, and lose everything.
### The security stack
Our sources are emphatic that these are distinct concepts and that conflating
them is how facilities fail:
**Possession · custody · legal title · beneficial ownership · security interest ·
lien and priority · control · perfection.**
Two consequences follow.
**Control is not location.** Knowing where goods are is worth little if someone
else can instruct their release. Release instructions matter as much as the
warehouse address — which is why the control package is a pledge *plus* a
custodian release undertaking, not a pledge alone.
**Documents are weak without an independent verifier.** A financing document is
only as strong as some party's ability to confirm location and prevent
unauthorised release, substitution or double pledge. This is the point at which
tokenization is powerless: **a token cannot repair a broken physical-control
chain.**
### The canonical fraud
> The same commodity, warehouse receipt, or receivable pledged to multiple
> financiers. Every lender believes it has collateral; only one may have first
> priority, or the asset may not exist at all.
This is the most expensive recurring failure in commodity finance, and it is
worth understanding why it recurs: each lender's diligence is individually
reasonable. The defect is only visible from a vantage point no single lender
occupies.
It is also the clearest case for machine-checked state. In the Doré kernel a
second pledge over already-pledged stock is refused outright
(`whr_double_pledge_rejected`), as is a pledge over stock that does not exist
(`whr_phantom_stock_pledge_rejected`). Selling the same receivable twice is
refused in the receivables and factoring routes (`rd_double_sale_rejected`,
`fac_route_double_sale_rejected`), and repaying the same obligation twice in
the trade-loan route (`tl_double_repayment_rejected`). These are not detectors.
The state simply cannot be reached.
### Protection: insurance, guarantees, and their limits
Protection changes **who absorbs a defined loss**. It does not supply capital
and it does not create liquidity.
| Layer | What it covers |
| -------------------- | ------------------------------------------------------------------------------------------------------------ |
| Cargo / specie | Physical goods against defined transit and storage losses. Does **not** automatically cover borrower default |
| Credit / non-payment | Failure to pay, insolvency, restructuring, acceleration |
| Political risk | Expropriation, transfer and convertibility, political violence |
| Guarantees | A third party's promise standing behind the obligor |
| Reinsurance | Moves part of the insurer's exposure to another balance sheet |
| Cut-through | Lets the insured claim directly against the reinsurer |
#### The four things protection does not do
**It is not liquidity.** Insurance improves *recovery*; it does nothing for
tomorrow's cash need. A 90-day claim waiting period can reduce ultimate credit
loss while leaving a severe short-term liquidity hole. Protection and liquidity
are separate markets and must be underwritten separately.
**It does not cover everything.** Every policy has exclusions, and the
exclusions are where the losses concentrate.
**It may not be enforceable as assumed.** Policy rights are not automatically
assignable, and the party named as insured may not be the party expecting to
claim.
**It is not a substitute for capital.** It changes loss allocation among
existing balance sheets.
#### How this is formalized
Recovery *amounts* are bounded: `insuranceRecovery` and `reinsuranceRecovery`
are capped by limit, cap and actual loss, `stacked_protection_le_loss` prevents
layered cover from paying more than was lost, and `no_double_recovery` stops the
same loss being recovered twice.
Recovery *timing* is deliberately not modelled. The 90-day waiting period is
carried in the environment and then proved to be read by nothing
(`eval_arch_ignores_unmodeled_params`). We would rather record the sharpest
lesson in the source as an explicit exclusion than quietly assume it away.
### NAV is not liquidation value
A closing discipline that applies to every page on this site. Net asset value
is what the book says. Liquidation value is what a buyer pays under pressure,
after recovery time. Haircuts must be set against the second.
And **liquidity is not solvency**: a fully solvent portfolio can face a
liquidity crisis under a maturity mismatch with shallow or absent secondary
markets. Most commodity-finance blowups are liquidity events wearing a credit
costume.
## What commodity finance is
You cannot evaluate Doré without first understanding the industry it operates
in. This section teaches that industry — briefly, but structurally — before any
page describes the protocol. Read these five pages in order and the
[litepaper](/litepaper) will read as a set of engineering choices rather than
assertions.
### The one-sentence definition
Commodity finance is the business of **transforming messy real-world trades
into claims that specific balance sheets are willing and permitted to hold.**
Both halves of that sentence carry weight. *Willing* is an economic judgment —
is the risk worth the return. *Permitted* is a mandate, regulatory and
operational judgment, and it is the half that outsiders consistently
underestimate. A great many trades die on *permitted* while being perfectly
attractive on *willing*.
### It is a network, not a loan
The intuitive picture — a lender and a borrower — is wrong, and the error is
expensive. Commodity finance is **a network of actors each controlling a
different scarce capability.** Capital reaches a trade only after passing
through a chain:
```
real trade → origination → underwriting → control / protection → capital
```
Each arrow is a place a transaction can die. And the capabilities are not
equally scarce, which is the single most useful thing to know about this
industry:
Money is the *least* scarce input on that list. Any strategy premised on
"bringing capital to commodity finance" is competing in the one category with
the least shortage. The scarcity is in verification.
### Why good trades go unfunded
A market gap is not "people need money". It is **a repeatable reason why
economically attractive transactions fail to reach willing capital.** Four
failure modes account for nearly all of it:
The last one deserves emphasis because it is the least discussed and the most
tractable. **Bespoke finance has a minimum economic ticket size.** A trade can
be genuinely profitable, genuinely low-loss and still unfundable because the
cost of structuring and monitoring it exceeds what the facility earns. Lower
that marginal cost and you do not merely move existing loans onchain — you
create financeable supply that did not exist before.
> The opportunity is the conversion layer between a real transaction and a
> financeable claim.
### Three distinctions worth memorising
**Profitability is necessary; financeability is constructed.** A trade does not
become fundable by being good. Someone has to build the evidence, the security
and the legal wrapper that make it holdable.
**Institutional rejection is not economic rejection.** A bank declining on
jurisdiction, ticket size or workflow is saying nothing about risk-adjusted
return. Institutional rejection is the softer target of the two, because it can
be addressed by construction rather than by better luck.
**Opacity is itself a price.** A lender facing unverifiable state prices two
things: the economic risk, and the uncertainty about whether reported state is
true. The second premium is pure friction, and it is recoverable.
### Time is part of price
A borrower may rationally pay a **higher annualised rate for capital that
arrives immediately** on a short, profitable trade. This is not irrationality
or desperation — it falls directly out of return on capital, which is margin
per cycle times turns per year. Capital that arrives in three days and capital
that arrives in three months are different products at different prices, even
at the same rate.
This is why the [pipeline page](/pipeline) treats cycle length as a first-class
economic variable rather than an operational detail.
### Scope discipline
One warning the source curriculum is emphatic about, and this documentation
follows. **The broad trade-finance gap is not the commodity-finance addressable
market.** Global trade volume, total trade-finance instruments, and unmet
trade-finance demand are three different numbers, and none of them is the
market for any given protocol.
No authoritative global commodity-finance figure appears in our sources, so
none appears in this documentation. The honest addressable market is the subset
of transactions that can actually be verified, legally structured, priced,
monitored and funded through a system — which is a construction problem, not a
market-sizing exercise.
### Where to go next
| Page | What it covers |
| ------------------------------------------- | ---------------------------------------------------------------------------------- |
| [The commodity pipeline](/pipeline) | The physical and financial chain, stage by stage, with the formal coverage of each |
| [Financing instruments](/cf-instruments) | The structures, organised by what they finance and where repayment comes from |
| [Risk, collateral and protection](/cf-risk) | The risk taxonomy, the security stack, and what insurance does and does not do |
| [Who finances what](/cf-market) | The capability map and a sourced map of the institutions active in each layer |
| [Onchain](/cf-defi) | What tokenization does and does not transfer, and the DeFi primitives underneath |
## DrUSD — the payment leg
A fiat-referenced token: reserve-backed, redeemable one-for-one at will.
### Invariants
**Full backing, at all times.** `reserve >= totalSupply` is asserted after
every operation that touches either. This is the executable form of the
minimum-value rule: reserve assets must at all times equal or exceed the total
value of outstanding redemption claims. A design declaring less than full
backing is provably outside the architecture grammar.
```solidity
function _assertBacked() private view {
if (reserve < totalSupply) revert BackingViolation(reserve, totalSupply);
}
```
**Redemption at par, on demand.** No queue, ever, on this leg — the rule is
redemption at par no later than T+2. A queue here would require a regulator
extension, and there is a theorem showing the optimum's queue is compliant
only because it is scoped to the fund token.
**Reserves are not the protocol's capital.** Reserve assets cannot be lent,
advanced, or used as venue liquidity. There is deliberately no function that
moves reserve anywhere except to a redeeming holder.
### Tests
| Test | Discharges |
| ------------------------------------ | ------------------------------------ |
| fully backed after mint | `fractional_backing_fails_min_value` |
| redeems at par with no queue | `v020_compliant_with_scoped_queue` |
| backing exact across many operations | the at-all-times reading of the rule |
## FacilityRegistry — the settlement gate
Registers facility occurrences and gates their settlement.
### Why the due-time gate exists
The occurrence's due date was recorded but not enforced for most of this
project's life. An external review rejected the corpus over it: a production
payment could settle at world-time 30 against a day-60 due date and be marked
performed. The fix was made at the primitive level, not the fixture level, and
rippled through eighteen fixtures.
The contract enforces it first, unconditionally, before it looks at anything
else — the same order as the proved primitive.
```solidity
if (block.timestamp < o.dueAt) revert Premature(o.dueAt, uint64(block.timestamp));
```
### Append-only receipts
Settlement writes a receipt naming **who actually collected**. Nothing rewrites
it.
That matters because of a laundering attack found in review: a monitor that
checked the *current* owner could be defeated by transferring the claim after
a wrong-owner collection. Judging on immutable receipts instead of mutable
ownership closes it, and there is a theorem — the verdict is unchanged by any
reassignment.
### Tests
| Test | Discharges |
| ---------------------------------------- | ------------------------------------------- |
| refuses settlement before due | `settlement_never_premature` |
| settles at the due time | `vpp_second_installment_ok` |
| refuses a replay | `alreadyPerformed` |
| refuses collection by a stranger | `subrogation_violation_needs_wrong_owner` |
| records who collected, immutably | `link_violation_immune_to_reassignment` |
| due times are independent per occurrence | `vpp_premature_second_installment_rejected` |
## SdrUSD — the yield leg
A pro-rata share of the strategy pool, redeemable through a queue whose length
matches the facility cycle.
### Invariants
**Holders bear loss first.** A loss reduces net asset value, so it falls on
holders by construction rather than by policy. This corrects an error found by
auditing the player model: the economic layer had been paying this holder a
fixed yield, making it a creditor, while the kernel and the legal
classification both treat it as a share that absorbs loss ahead of the
protocol.
**Fair-share burn.** A redemption pays `floor(shares × NAV / totalShares)` —
never more than the pro-rata claim.
**The queue matches the cycle, and is enforced.** Claiming before maturity
reverts, exactly as the settlement primitive refuses a premature occurrence.
The length is the facility cycle: shorter promises liquidity the assets do not
produce; longer locks holders up for nothing.
```solidity
if (block.timestamp < c.maturesAt) revert QueueNotMatured(c.maturesAt, uint64(block.timestamp));
```
**Redemptions price at request time.** A later loss cannot claw back a priced
claim; it falls on the holders who stayed. That is what a queue *is* — a claim
fixed at the moment it joins.
### Wired to the facility lifecycle
Staking moves tokens — it previously credited shares without taking any drUSD,
which is an assertion rather than a transfer. A settled facility occurrence
books into net asset value through `accrueSettled`, behind two gates that
mirror the proofs: the occurrence must genuinely have settled, which the
registry permits only at or after its due time, and it may be booked at most
once. Without the second gate one coupon could be accrued repeatedly,
inventing value.
#### The bug the tests found
The first version booked the coupon to net asset value **without receiving the
cash**. A redeemer priced at the raised value could then not be paid — the
vault held a thousand against a claim of eleven hundred. Accrual now delivers
the coupon in the same call, and `backing()` exposes the assets actually held.
The invariant that came out of it: **net asset value never exceeds backing** —
the vault-level echo of the reserve rule, one layer up from where it was
already proved for the payment leg. It existed nowhere until a test written
against the deck's own five-step flow demanded it.
### Tests
| Test | Discharges |
| ------------------------------------------------- | ------------------------------------- |
| refuses a claim before maturity | `settlement_never_premature` |
| pays after exactly one cycle | `QueueMatchesCycle` |
| never pays above the pro-rata share | `FairShareBurn`, `burn_payout_le_nav` |
| holders bear loss, not the protocol | the player-audit correction |
| pricing survives later loss | queue semantics |
| refuses a replayed claim | `alreadyPerformed` |
| refuses to accrue an unsettled occurrence | `settlement_never_premature` |
| accrues a settled coupon, raising the share price | the deck's accrual step |
| books a coupon at most once | `alreadyPerformed` |
| never books value it does not hold | vault-level COBS 19A.7.1 |
| runs the full cycle end to end | the deck's five steps |
## LiquidationWaterfall
On a breach of the minimum-value rule or a pooling event, proceeds are
distributed in a fixed order: holders first up to par value, then any further
holder entitlement under the white paper, then general creditors.
### The two properties
**The first tier is capped at par.** Holders receive `min(pool, parTotal)` —
never more, whatever the pool.
**General creditors wait.** While the pool does not cover par, the third tier
receives nothing.
Both are proved in the formal development and tested unconditionally here: for
every pool size tested, the first tier never exceeds par and never exceeds the
pool.
### Conservation
The three tiers sum to exactly the pool. Nothing is created or lost in the
distribution — the contract-level echo of the surplus identity.
### Tests
| Test | Discharges |
| ------------------------------------------------ | ----------------------------------------- |
| holders first, capped at par | `frt_distribute_holders_first_par_capped` |
| general creditors get nothing while par is short | same theorem, third conjunct |
| the pool is conserved exactly | `surplus_identity` |
| the cap holds for every pool | unconditional reading |
## Contract architecture
Four contracts, each implementing rules that were proved before they were
coded. The test suite is the bridge: every test names the theorem or the
sourced provision it discharges.
| Contract | Job | Governing rule |
| ---------------------------------------------- | ----------------------- | -------------------------------------------------------------------- |
| [`DrUSD`](/contracts-drusd) | the payment leg | full backing at all times; redemption at par, on demand |
| [`SdrUSD`](/contracts-sdrusd) | the yield leg | pro-rata share; fair-share burn; queue matched to the facility cycle |
| [`FacilityRegistry`](/contracts-facility) | the settlement gate | no settlement before due; append-only receipts |
| [`LiquidationWaterfall`](/contracts-waterfall) | distribution on failure | holders first, capped at par |
### The design rule
Where the formal development and convenience disagree, the development wins.
Two examples worth stating plainly.
The payment leg has **no redemption queue and cannot be given one**, because
the queue is compliant only when scoped to the fund token. A queue on the
payment leg would need a regulator extension.
The yield leg's holders **bear loss first**, because a share is a share. An
earlier version of the economic model paid them a fixed yield, which quietly
made them creditors and moved the loss to the protocol. The contract
implements the share.
### Running the suite
```bash
cd dore-contracts
yarn install
npx hardhat test
```
Twenty-four tests, all passing. The names are the specification.
### What is tested, and what is not on-chain at all
The suite is 24 Hardhat tests over 476 lines of Solidity, and every test names
the Lean theorem or ADGM provision it discharges — so a failing test points at a
specific claim made elsewhere on this site rather than at a vague regression.
Covered by tests: the settlement gate refusing early settlement, replay and
collection by a non-beneficiary; drUSD backing held exactly across many
operations and par redemption with no queue; sdrUSD paying no more than the
pro-rata share, pricing a redemption at request time, and making **holders**
bear loss rather than the protocol; a full stake → settle → accrue → queue →
claim cycle; and the liquidation waterfall paying holders first, capped at par,
conserving the pool exactly.
**Now the part that matters more.** These four contracts implement the *token
and settlement* layer only. Much of what this documentation describes has **no
Solidity representation whatsoever**:
| Not on-chain | Where it actually lives |
| ----------------------------------------------------------------------------- | ------------------------------------------------------------- |
| Collateral, pledges, priority, the double-pledge refusal | Lean only — `whr_double_pledge_rejected` and friends |
| Insurance, reinsurance, recovery and the waterfall of protection | Lean only — `insuranceRecovery`, `stacked_protection_le_loss` |
| The monitor and its receipt-based verdicts | Lean only — `CorpusLink.lean` |
| The legal feasibility engine | Lean only — `LegalEngine.lean` |
| Borrowing base, advance rate, eligibility | Lean only — `Facility.lean` |
| The entire physical pipeline: production, purchase, custody, transport, assay | Not modelled in Solidity; see [the pipeline](/pipeline) |
Three further limits, stated plainly:
* **No third-party audit.** A passing suite the authors wrote is a strong
internal gate and is not an audit.
* **Nothing is deployed.** There is no deployment script, no network
configuration and no address on any chain, testnet included.
* **No fuzzing or invariant testing.** The tests are example-based. The
invariants they check are proved in Lean over all inputs, but the Solidity
is checked only at the points the tests visit.
## Development
### Layout
```
DoreFormal/ the Lean 4 development — 81 targets, no sorry, no axioms
dore-contracts/ Hardhat project — 4 contracts, 19 tests
docs-site/ this documentation
encyclopedia/ the product corpus and the legal source registry
```
### The formal development
```bash
lake build # 81 targets
.claude/bin/loop-test # build + hygiene gate
```
The hygiene gate fails on any `sorry`, `admit`, `native_decide`, custom axiom
or compiler warning. Axiom audits are run on every headline theorem; the
development uses only `propext`, `Classical.choice` and `Quot.sound`, and many
results use none.
### The contracts
```bash
cd dore-contracts
yarn install
npx hardhat test
```
Tests are named after the theorems they discharge. If a contract changes such
that a named property no longer holds, the test that fails tells you which
proof you have contradicted.
### The documentation
```bash
cd docs-site
npm install
npm run dev # local
npm run build # static output in dist/
```
### House rules
**Never claim a theorem that does not exist.** A docstring in this project
once named a theorem as the thing binding two halves of a module together; the
theorem did not exist, and the halves were unconnected. Grep every name you
cite before shipping.
**Report frontiers, not tuned successes.** Where a result depends on an
unverified input, publish the boundary at which it changes rather than picking
an input that makes it pass.
**Say what is not modeled.** Each module carries an explicit "is not grounded"
section. Those sections are the most useful part of the development to a
reader deciding how much weight to put on it.
## How Doré makes money
The business model is one sentence: **Doré originates commodity-finance yield,
passes most of it to token holders, and keeps the spread.** Everything below is
that sentence with numbers on it — the plan as the investor deck states it,
then what our own proofs say about whether the plan closes.
The deck is a hashed source (`cc0d990f…29e91a`, August 2026) and every figure
attributed to it here is quoted rather than paraphrased.
### Where the yield comes from
The claim is not that Doré earns more by taking more risk. It is that an entire
asset class sits outside on-chain credit, and its yield reflects operational
difficulty rather than volatility.
| What is funded on-chain today | Backing | Yield |
| ------------------------------------ | ---------------------- | ---------- |
| Tokenised treasuries | US government paper | 4.0–4.5% |
| Staked / structured stables | Derivatives funding | 3.5–7% |
| On-chain private credit | Mixed | 4–9% |
| GPU and AI hardware loans | Depreciating equipment | \~8% |
| **Physical commodity trade finance** | **Metal in custody** | **10–15%** |
The reason the last row is unfilled is structural. Basel capital rules pushed
banks out of exactly this lending after 2008 — not because it defaults, but
because it is small-ticket, operationally intensive and unattractive against
risk-weighted capital. The demand did not go away and the collateral did not
get worse. That is the same diagnosis as [the gap](/cf), stated from the
capital side.
### The split
The deck's yield model is a deliberate glide path: pass nearly everything
through early to win deposits, then step the pass-through down as the reserve
grows.
Two things make this credible on its own terms. A 7.5% pass-through is roughly
double what the largest yield-bearing dollars pay. And the retained margin is
not a fee levied on the holder — it is the spread between what commodity
borrowers pay and what on-chain capital expects.
### Why it scales
Protocol revenue is the retained margin times the reserve, and the cost base is
close to fixed:
| Reserve | Revenue at 4.5% |
| ------- | --------------- |
| $50m | $2.25m |
| $100m | $4.5m |
| $200m | $9.0m |
| $500m | $22.5m |
| $1.0bn | $45.0m |
The deck's year-one cost base is itemised — ADGM SPV $10–15k, FSRA
authorisation $120–160k including $50k of locked regulatory capital, counsel
$220–280k, audit and attestation $180–260k, monitoring $90–130k. Roughly
$620–845k, against which **$50m of reserve covers the cost base** and
everything past that is margin.
The scaling argument is that the same team runs $1bn that runs $100m, so
**originated capacity, not operating capacity, sets the ceiling** — and
originated capacity is stated as exceeding $875m across gold, silver and
copper. Whether headcount really stays flat across a twentyfold increase in
reserve is a judgment, not a proof, and we do not model it.
### What our proofs say about the plan
This is where the documentation stops repeating the deck and starts checking it.
**The ceiling agrees with the deck's framing.** Calibrated on the deck's own
disclosed coordinates, the maximum a protocol in this design class can earn in
a calm year is **462 basis points**, inside a band of 357–567 across the deck's
stated range (`deck_ceiling_band`). The deck's 4.5% target and the proved
ceiling are the same order of magnitude, which is a real, non-trivial
agreement: the plan is not fantastical.
**But the target sits above the participation-feasible optimum.** Once every
player has an outside option it must be paid, the optimum at a 12% borrower
alternative clears **404 bps**, not 450 (`participation_frontier`). The payoff
is linear in the borrower's alternative at 75 bps per 100, so a 450-bps margin
requires a borrower alternative of **12.62%** (`deck_margin_target_needs_1262`).
The deck's facility page states the asset yield as **9–12%**. Its opportunity
and comparison pages state the asset class at **10–15%**. A 12.62% requirement
is *outside* the first band and *inside* the second.
So the finding is precise and it is not that the plan fails. It is that the
deck is internally inconsistent about its own yield, and its revenue target is
reachable only under the wider framing. Anyone underwriting this should ask
which number is the real one, because the answer determines whether the
steady-state margin is achievable at all.
### Four things a careful reader should check
Reading the deck against the project's own later analysis surfaces four places
where the marketing runs ahead of the documents. We publish them because a
reader would otherwise find them during diligence, and because the discipline
this project is built on makes concealing them absurd.
**The stated yield is inconsistent.** 9–12% on the facility page, 10–15% on the
opportunity and comparison pages, "approximately 12%" blended in the yield
model. These cannot all be the operative number.
**The insurance is described more broadly than the policy supports.** The deck
says a non-payment policy "covers the full USD 300m" and that a cut-through
clause gives the noteholder "direct recourse" to the reinsurer. The later
capstone analysis, working from the actual policy, records that the **Tranche 1
policy names a different insured and a USD 10m insured amount**, and that those
policy rights **cannot be assigned without the leading insurer's approval**;
loss-payee status needs an approved endorsement. Its explicit instruction is
not to promise direct insurance rights that the documents have not granted.
**"Instant exit" overstates the redemption design.** The deck's liquidity page
is headed *slow underneath, instant on top* and says anyone can exit
immediately at market. The later analysis reverses the second half — *slow
underneath, **honest** on top* — and warns against promising stablecoin-style
instant redemption against illiquid private credit unless someone has
explicitly committed the liquidity. The 30-day queue is the real primary
redemption path; the pool is a secondary market, and secondary markets can
trade at a discount.
**The leverage flywheel is a distribution feature, not financing.** The deck's
growth page shows 3× to 20× loops implying returns from 14% to 103%. The deck
itself labels the table illustrative and not a projection, which is fair — but
the deeper point is that **a leverage loop creates no new commodity financing**.
Twenty times TVL is not twenty times deployed capital. The honest metric is
[real deployed capital](/cf-defi), reported separately from total value locked.
### The bottom line
The economics work if two conditions hold: the asset class genuinely pays above
about 12.6% to the facility, and the protocol reaches roughly $50m of reserve to
clear its fixed costs. The first is a question about the market and is
currently answered inconsistently by our own primary source. The second is a
question about distribution.
Neither is a question about the protocol's design, and that is the useful
result. The design's maximum has been searched exhaustively and proved; what
remains uncertain is priced input, not architecture.
## ADGM position
The legal work is done against operative text, fetched and hashed, not against
summaries. Ten documents are in the source registry with SHA-256 hashes and
recorded effective dates.
### Where each instrument stands
**drUSD** is a fiat-referenced token. The classification is *mechanical* on
sourced text — it is derived, not assumed. What remains is the permission
grant and ongoing compliance, both named precisely rather than waved at.
**sdrUSD** meets the collective-investment-fund definition mechanically, so it
is a Unit. The route is the qualified-investor fund: private placement only,
all holders professional clients, a minimum subscription, and notification
rather than registration. The blocker is the fund-manager permission — and in
this framework naming the exact missing permission is a *resolved* outcome,
not an open question.
**The secondary venue** turns on a recognition order. Operating a
protocol-owned venue is a regulated activity in its own right, and the issuer
may not operate one at all.
### The honest headline
**No architecture is legally feasible today**, unconditionally, for every
design in the grammar. The classification questions are answered; the
permissions are not held. That theorem exists specifically so that no amount
of optimization can quietly assume the problem away.
See [Sourced provisions](/provisions) for the specific rules.
## Litepaper
**Financing the metal before it is money.**
Commodity finance fails in a specific, diagnosable way: a trade can be
profitable, the metal can physically exist, the buyer can be waiting — and
capital still does not arrive, because nothing in the chain converts a real
transaction into a claim a lender can independently verify.
Doré is that conversion layer. Every load-bearing claim below is machine-checked
against a formal kernel or a hashed legal source, and names the theorem or
provision that carries it.
| | |
| -------------------- | ----- |
| Theorems | 1,499 |
| Lean modules | 78 |
| Archetypes recorded | 101 |
| Executable instances | 29 |
| Contracts | 4 |
| Kernel edits | 0 |
### 1. The gap
The mistake that sinks most commodity-finance ventures is treating the gap as a
shortage of money. It is not. Capital is abundant and actively looking for yield
backed by something real. The gap is **a repeatable reason why economically
attractive transactions fail to reach willing capital** — and it sits in the
institutional filters between commerce and money, not in the supply of either.
> The opportunity is the conversion layer between a real transaction and a
> financeable claim.
A trade must cross four bridges to become fundable, and it dies if any one is
missing:
| Bridge | What is broken |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| The asset exists, but is not visible | The lender cannot independently establish title, custody, quantity, quality, or repayment state |
| The risk exists, but is not separable | Credit, price, legal, logistics, fraud and liquidity risk arrive bundled into one opaque exposure |
| The capital exists, but cannot enter | Mandate, regulation, jurisdiction, ticket size or operational cost blocks an otherwise attractive investment |
| The demand exists, but costs too much to serve | Diligence, documents, monitoring and servicing exceed the economics of a smaller facility |
A bank can therefore reject perfectly good economics — small ticket, new
borrower, full country limit, heavy compliance burden, collateral control hard
to evidence, unfamiliar legal structure. None of those are judgments about the
trade. They are judgments about the filter.
That framing is deliberately narrow. There is no authoritative global
commodity-finance figure in our sources and we do not quote one. The addressable
market is the subset of transactions that can actually be verified, legally
structured, priced, monitored and funded through a system.
### 2. The pipeline
Nine stages and two clocks — set out in full on [the commodity
pipeline](/pipeline) page. The short version: the physical chain and the
financial chain are not synchronised, cash leaves before cash returns, and every
stage in between creates a document, a risk, and an opportunity for the claim to
become unverifiable.
The second clock is the one that kills deals which survive everything else. A
transaction may need cash **in days**, while diligence, investment committees,
documentation, subscriptions and settlement take **weeks or months**. That is
where a protocol has a structural advantage over a committee — not because
onchain capital is cheaper, since it is often dearer, but because it can arrive
on the timescale the trade actually runs on.
### 3. What Doré is
Doré does not begin with a token. It begins with a **claim**: a formal object
carrying who owes what, to whom, when it falls due, what evidence discharges it,
and what security stands behind it. Registration is canonical and append-only,
and settlement is gated on the claim's own terms — `settlement_never_premature`
proves a facility cannot be settled before its due time.
That closes the first two bridges at once. Title, custody, quantity and
repayment state stop being narrative and become state a lender reads directly.
And because each risk attaches to a named leg of the claim rather than to the
trade as a whole, the bundle comes apart.
**drUSD** is a payment instrument: par redemption, on demand, no queue, and the
contract refuses to mint against reserves it does not hold.
**sdrUSD** is a pro-rata share of the financing book — not a coupon and not a
deposit, but a claim on net asset value that absorbs loss ahead of the protocol.
Our own earlier model got this wrong, paying holders a fixed rate and quietly
turning them into creditors. The contracts implement the share.
Under both sits a liquidation waterfall implementing a rulebook order rather
than a designer's preference, and a monitor whose verdicts are computed from
settlement receipts — so `link_verdicts_immune_to_world_events` holds and a
violation cannot be laundered by reassigning a beneficiary.
### 4. Why the method is the moat
Every protocol in this category says it is audited. Doré makes a stronger claim:
the properties that matter are **proved**, in Lean 4, against a kernel that has
not been edited once across 101 archetypes and 1,499 theorems. An audit is a
skilled human reading code and not finding a problem. A proof is a machine
confirming that a class of problem cannot occur.
#### The system refuses to reason from law it has not read
This is the single most important design decision in the project. Legal rules
carry a source reference with a hash, and `eval_unsourced_never_feasible` proves
the feasibility engine cannot return a favourable verdict from an unsourced
rule — not a lint warning, a theorem. When the law changes materially,
`material_legal_change_stales_compliance_certificate` makes the certificate
bound to the old text provably stale.
The consequence is that our regulatory claims are bounded by what we actually
fetched. The dirham-referenced token route resolves to feasible-with-conditions
on fetched rulebook text. The fund-side route lands honestly on an unresolved
fact naming a rulebook we have not sourced, with the closure path already
proved. A system that cannot say *"I do not know, and here is precisely why"*
will eventually say something false.
#### What proof caught that review would not have
An adversarial audit of our own commitment layer found it **uninhabited**. Every
theorem about it was true and every one was vacuous, because no value could
satisfy the premises — it proved things about an empty set. No amount of code
review finds that; it looks like a correct, well-tested module. It was caught by
attacking the formalization itself, then fixed with digests and a proper
encoding.
The same discipline killed a balance-sheet free lunch where an architecture
allocated 110% of net asset value, and forced a correction when a design
credited a first-loss tranche with absorbing losses it had never been priced
for.
### 5. The economics
Doré earns an intermediation spread: roughly 9–12% asset yield against a
disclosed alternative of 4.0–4.5%, most of it passed through. The interesting
question is not what that spread is today but what it can ever be, so the design
space was searched exhaustively and the maximum proved.
On the deck's disclosed coordinates the calm-scenario ceiling is **462 basis
points**, inside a band of 357 to 567 (`deck_ceiling_band`). The design that
attains it is *elegant* in a precise sense (`the_optimum_is_elegant`): no player
can be paid more without another being pushed below the option they would
otherwise take.
Seventeen players sit on a transfer ledger whose central property is an identity
(`surplus_identity`) — payoffs sum to real production margin plus external carry,
minus real destruction and cost. Every internal leg cancels. **Nothing is created
by bookkeeping.**
#### The severe corner
Naming an absorption order is not the same as applying it, so the ledger routes
credit loss through the waterfall before anyone is paid. In a calm year this
changes nothing, because there is no loss to route. At the severe corner the
loss is 693 basis points:
Read that as a holder, not as the protocol. The single-agent model had been
charging the protocol for losses a correctly specified capital stack puts on
holders and sponsors — flattering the protocol's downside while hiding the
holder's. A severe year takes a holder's entire coupon and then some. Better
published as a theorem than discovered as a complaint.
### 6. Time beats price, roughly six to one
A commodity borrower does not compare your coupon to a bank's rate. It compares
it to its own return on capital: margin per cycle times turns per year. Two
things follow, both proved. Velocity is a price lever
(`roc_rises_with_velocity`). And capital is never satiated
(`capital_pays_for_itself`) — while the coupon sits below the return on capital,
the charge never exceeds what the capital earns, at any scale.
Then we added what a real gold cycle pays — vault, freight, specie cover,
sourcing audit, customs, and a correspondent bank moving money twice a cycle —
with deliberately modest numbers, so any failure would be structural rather than
pessimism. The result is negative: **at a 1% margin on a 30-day cycle the
completed pipeline does not finance itself** (`modest_pipeline_breaks_participation`).
The decomposition matters more than the verdict. The borrower starts with 25 bps
of slack — 900 gross against 875 of cost. The fee stack adds 45, already an
overrun. But the rail's five days cost a further **150 basis points of gross
return**, because a 30-day cycle turns twelve times a year and a 35-day cycle
only ten. The correspondent bank is the sharpest actor in the pipeline, and it
appeared in no earlier model of ours.
One caveat belongs with that claim rather than in a footnote. The five rail
days are an assumption, not a measurement: our source states its 14-day cycle
as the whole time before cash returns and gives no settlement-rail figure
anywhere. Adding five days is conservative, but the 150 bps driving the
six-to-one ratio rests on that addition. Two further seams — a financing-rate
basis mismatch and a 5-point advance-rate difference — are set out on
[the pipeline page](/pipeline).
#### The frontier met a document
A commodity-finance course supplied on 4 September carries a worked deal — the
first attributable source for either coordinate. At **1.50% over a 14-day
cycle**, with every fee charged and the rail's five days added, the pipeline
returns **2,137 bps of gross against 920 of full cost** — 2.3× cover
(`sourced_worked_deal_clears`). Nor is it near an edge: holding the margin, the
cycle stretches to 35 days before failing; holding the cycle, the margin falls
to 0.65% (`sourced_deal_slack`).
So the negative result is a statement about *that* cycle, not about physical gold
trade. The mapping is sound on the one point that could have been a double
count: the primer's 1.50% is stated before freight, refining and insurance —
exactly the stack we charge separately.
This is a **teaching example inside a sourced document, not an operator's
disclosed economics**. It moves the coordinates from "no source at all" to
"attributable and quoted", nothing further.
### 7. Why this is the future
Tokenised real-world assets have spent this cycle solving the wrong bottleneck.
Liquidity was never the scarce input; underwriting was. The reason a $2m gold
facility cannot get funded is not that no one has $2m — it is that establishing
what is true about that facility costs more than the facility earns. Every
serious participant pays, repeatedly and manually, for the same handful of
facts: who owns it, where it is, what it is worth, what discharges it, and
whether the structure is legal where it sits.
That cost is the whole gap, and it is the one cost a formal system genuinely
collapses. Once the claim, its evidence schema, its security interest and its
legal route are machine-checkable, diligence stops being a per-deal expense and
becomes a per-**archetype** one. This is why the encyclopedia matters more than
any single facility: 101 archetypes recorded, 29 executed as live instances
against the kernel, and the marginal cost of the next deal in a known shape
approaches zero. That, not a token, is what makes small tickets financeable —
precisely the bridge that was missing.
The direction of travel looks unambiguous. Capital is getting more
mandate-constrained, not less; regulators are converging on rulebooks explicit
enough to encode; and the cost of formal methods keeps falling while the cost of
a discovered legal defect keeps rising. In that world the durable advantage
belongs to whoever can *demonstrate* the properties of their claims rather than
assert them — to the counterparty, to the regulator, and to the person holding
the token.
It disciplines our own roadmap too. The widest legal gate the design currently
passes is proved (`dore_ceiling_v020`), and so is the fact that the owned-venue
route sits outside today's feasible set
(`owned_venue_outside_feasible_set_today`). We know which door is shut and what
would open it.
### 8. What is not proved
A document like this is usually where the qualifications get small. Ours are the
point, because the discipline that produces them is what we are selling.
| Item | Status |
| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| Operator margin per cycle, and cycle length | **Partly sourced.** A hashed teaching example (1.50% / 14 days) brackets both frontiers; no operator has disclosed its own |
| Insurance premium, monitor fee, every player's outside option | **Unverified.** Not disclosed by any source; carried as declared parameters |
| Default rate, recovery haircut, basis volatility, hedge cost | **Unverified.** The course names no benchmark, venue or hedging mechanics |
| Market-maker retainer and issuance fee | **Unverified.** Held at zero rather than invented; the payoff theorem gives the sensitivity |
| Fund-side legal route | **Open.** Lands on an unresolved fact naming an unsourced rulebook; closure path proved |
| Documentary-credit legal wrappers | **Open.** Rest on ICC texts not yet fetched |
| Islamic instruments | **Open.** Six archetypes recorded; instancing source-gated, since shariah rulings are interpretation |
| Smart contracts | **Tested, not audited.** 24 passing tests naming their theorems; no third-party audit, nothing deployed to any chain |
None of these is a proof gap. Each is a place where the system refuses to assert
something it cannot source — the behaviour we built it to have. The list gets
shorter by supplying documents and measurements, not by rewriting proofs.
## The commodity pipeline
Most of this documentation describes what Doré proves. This page describes what
Doré is *about*: how a physical commodity actually moves from the ground to a
buyer, who touches it, what paper is created at each step, and where financing
attaches. Everything downstream — the claim schema, the archetypes, the cost
model, the ceiling — is a formalization of the process on this page.
If you are new to commodity finance, read this first. If you are here for the
result, jump to [why the pipeline is hard](#why-the-pipeline-is-hard).
### Why financing fails
The instinct is to treat commodity finance as a shortage of money. It is not.
The gap is a **repeatable reason why economically attractive transactions fail
to reach willing capital** — and it lives in the institutional filters between
commerce and money, not in the supply of either.
A trade has to cross four bridges to become fundable, and it dies if any one is
missing:
| Bridge | What is broken |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| The asset exists, but is not visible | The lender cannot independently establish title, custody, quantity, quality, or repayment state |
| The risk exists, but is not separable | Credit, price, legal, logistics, fraud and liquidity risk arrive bundled into one opaque exposure |
| The capital exists, but cannot enter | Mandate, regulation, jurisdiction, ticket size or operational cost blocks an otherwise attractive investment |
| The demand exists, but costs too much to serve | Diligence, documents, monitoring and servicing exceed the economics of a smaller facility |
A bank can therefore reject perfectly good economics. A trade with a real buyer,
physical collateral and an attractive margin still fails when the ticket is too
small, the borrower too new, the country limit full, the compliance burden
heavy, the collateral control hard to evidence, or the legal structure simply
unfamiliar. None of those are judgments about the trade.
> The opportunity is the conversion layer between a real transaction and a
> financeable claim.
That sentence is the whole project. The stages below are what has to be
converted.
### The pipeline, stage by stage
Two chains run in parallel and have to stay in step: the **physical** chain
(the metal moves) and the **financial** chain (someone is out of pocket until
it is sold). Financing exists because the two are not synchronised — cash
leaves before cash returns.
Each stage below names what happens, what paper it creates, what goes wrong,
and where Doré formalizes it.
#### 1. Production
The chain begins at a producer or mine and runs producer → trader → refiner →
warehouse/custodian → buyer. The financier's exposure here is to something
that does not exist yet, which is why the instrument is a **prepayment**: a
financier or buyer prepays a producer in exchange for future deliveries, or
repayment out of future sales.
*Goes wrong:* production failure, country risk, offtake disputes — future-asset
risk in general.
*Formalized:* `CorpusProduction.lean` (metal stream, production payment, NSR
royalty) and the producer-prepayment instance in `CorpusStructured.lean`.
#### 2. Purchase — the working-capital gap opens
The trader pays the supplier **before** the downstream buyer pays the trader.
That timing mismatch is the entire reason commodity finance exists; everything
else is machinery for making it safe to bridge.
The primer's worked example is worth stating in full because the rest of this
site is calibrated against it: a trader buys **$10,000,000 of eligible gold**
on a **1.50% gross spread — $150,000 — before freight, refining, insurance and
losses**.
*Goes wrong:* broken sale, fraud, title defect, delay, price and basis risk.
*Formalized:* trade loan and self-liquidating structures in
`CorpusOpenAccount.lean`; `tl_double_repayment_rejected` blocks paying the same
obligation twice.
#### 3. Transport, assay and refining
The metal moves and is assayed or refined. Cash stays tied up throughout, so
every day here is a day of financing cost. Assay matters legally as well as
physically: it is what converts "some gold" into a specified quantity and
fineness that a claim can reference.
*Protection, not financing:* cargo and specie cover protects the goods against
defined transit and storage losses. It does **not** automatically cover
borrower default — a distinction that collapses in most pitch decks.
*Formalized:* assay is real coverage, not a placeholder. `Lot.lean` carries
gross and fine quantity as separate dimensions with `LotWellFormed` requiring
fine ≤ gross, and `cannot_refine_without_required_assay_evidence` blocks
refining without the assay certificate. Short delivery is
`pp_short_cargo_rejected` — delivering 7 against a 10-unit right returns
`.quantityMismatch` rather than discharging anything.
#### 4. Warehouse and custody — the lender takes control
The commodity sits in an approved warehouse or a controlled custody
arrangement, and the lender advances against it with a haircut. This is where
paper becomes decisive: **warehouse receipts and bills of lading**.
The course names the classic failure here, and it is worth quoting because it
is the single most expensive fraud in the industry: *the same commodity,
warehouse receipt, or receivable being pledged to multiple financiers.*
*Formalized, and this one is exact:* `whr_double_pledge_rejected` — a second
lender attempting a pledge over stock already pledged is refused at the world
layer with a specific error, not a warning. `whr_phantom_stock_pledge_rejected`
does the same for stock that does not exist. These are the two frauds that have
killed real commodity lenders, and they are unrepresentable rather than
detected.
#### 4b. Refining, and what happens to the lender's security
Refining is a transformation: metal goes in, less metal comes out, and the
difference has to be accounted rather than assumed. `Lot.lean` enforces
conservation in each dimension separately — `transformation_no_fine_creation`
and `chain_conservation` — so a tolling stage cannot mint fine metal.
The question a lender actually asks here is whether its security survives the
transformation. It does, and that is proved: `transform_carries_security`.
#### 5. Crossing borders
The metal passes producer country → transit → warehouse or refinery → buyer
country. At each boundary the applicable law can change **when ownership
transfers, whether a security interest is effective, how insolvency is treated,
whether proceeds can move, and who can enforce**.
*Goes wrong:* title uncertainty; a lien or pledge not created, perfected, or
correctly ranked; borrower or custodian insolvency; sanctions and AML
ineligibility; enforcement uncertainty across forums.
*Formalized — partly, and this is the weakest stage in the development.* The
legal question is covered: `LegalIR.lean` binds every rule to a hashed source
and `eval_unsourced_never_feasible` proves the engine cannot return a
favourable verdict from law it has not read. The *physical* border is not:
there is no customs event, no export-licence gate, no freight leg, no
Incoterm, and `ActorRole.transporter` exists but no theorem uses it. Transport
and customs appear in the development only as basis-point placeholders in the
cost model. Stated here rather than left for a reader to discover.
#### 6. The draw and monitoring loop
Stages 3 to 7 are not a straight line — a control loop runs across them, and it
has five steps:
1. the borrower requests a draw;
2. independent evidence confirms eligible collateral exists;
3. financing is released only up to the permitted advance rate;
4. release of collateral requires repayment or authorised substitution;
5. monitoring updates exposure as inventory moves.
*Formalized:* `CorpusLink.lean` computes monitor verdicts from settlement
receipts, so `link_verdicts_immune_to_world_events` holds — a violation cannot
be laundered by reassigning a beneficiary or discharging the obligation
somewhere else. The advance-rate limit is a well-formedness constraint on the
architecture itself, not a runtime check.
#### 7. Sale, then repayment
The sale to the buyer or offtaker is the commercial event that produces
repayment cash; where it has already generated an invoice, receivables finance
and factoring attach here. Proceeds then repay the advance through a waterfall.
The primer completes its example here, and this is the number that reframes the
whole business: the 14-day financing cost is **approximately $42,200** — that
is $10m at 11% for 14 days — leaving roughly **$107,800** of the $150,000
spread. Financing cost is incurred only for the days capital is actually
outstanding, which is why velocity, not rate, is the lever.
*Formalized:* `settlement_never_premature` — a facility cannot settle before
its due time; `rd_double_sale_rejected` and `fac_route_double_sale_rejected`
block selling the same receivable twice.
#### 8. Aggregation into an investable product
Once credit is aggregated, an SPV separates the operating borrower from the
investment claim, and a waterfall allocates cash and losses across senior,
mezzanine and junior/first-loss tranches.
*Formalized:* `CorpusPools.lean` instances tranching (`trn_waterfall_allocates_loss`,
`trn_junior_blocked_under_stress`) over the generic `Waterfall.distribute`,
and `LiquidationWaterfall.sol` implements the rulebook order onchain. NAV
share redemption is separate, in `Strategy.lean` — `burn_payout_le_nav`. The
instanced tranching is two-layer senior/junior; mezzanine is expressible in
the n-layer distributor but is not instanced.
#### 9. Distress, if it comes
If the transaction fails, the cost stack continues: workout, collections,
security enforcement, insurer claim, asset realisation, dispute resolution.
The course is blunt about the trap: a 90-day claim waiting period can reduce
ultimate credit loss while leaving a severe short-term **liquidity** gap.
Solvency and liquidity are different failures.
*Formalized — and here is an honest limit.* The recovery *amounts* are covered:
`insuranceRecovery`, `reinsuranceRecovery`, `stacked_protection_le_loss` and
`no_double_recovery` all bound what protection can pay. The recovery *timing*
is not. The 90-day delay is carried as `insClaimDelayDays` in the deck
environment and is then **proved to be read by nothing** —
`eval_arch_ignores_unmodeled_params`. So the sharpest distress lesson in the
course is deliberately recorded as outside the model rather than quietly
assumed into it.
### The other timing mismatch
There is a second clock, and it is the one that kills deals that survive
everything above. A transaction may need cash **in days**, while diligence,
investment committees, documentation, subscriptions and settlement take
**weeks or months**.
That is the same velocity problem as stage 7, moved to the capital side, and it
is where a protocol has a structural advantage over a committee. Not because
onchain capital is cheaper — it is often dearer — but because it can arrive on
the timescale the trade actually runs on.
### Does the pipeline pay for itself?
With the stages named, the question becomes measurable. It is answered below,
and the answer depends entirely on two numbers.
### Why the pipeline is hard
The financial model charged a borrower a coupon, a protocol fee and monitoring.
A real gold cycle also pays for a vault, secure freight, specie cover, a
responsible-sourcing audit, customs, and a correspondent bank that moves money
twice per cycle.
Adding them — with deliberately modest numbers, so that any failure would be
structural rather than pessimism — produces the sharpest result in the whole
development.
#### The borrower is a physical trader
A commodity borrower does not compare your coupon to a bank's rate. It compares
it to its **return on capital**: margin per cycle times turns per year. A 1% net
margin on a 30-day cycle is a 12% return; the same margin on a three-week cycle
is 17%.
Two consequences follow, both proved. Velocity is a price lever — a shorter
cycle strictly raises the sustainable coupon. And capital is never satiated:
while the coupon sits below the return on capital, the coupon charge never
exceeds what the capital earns, at any scale. More capital is always wanted.
#### The result
At a 1% margin on a 30-day cycle, **the completed pipeline does not finance
itself.**
The decomposition matters more than the verdict. The borrower began with 25
basis points of slack. The fee stack adds 45 — alone an overrun. But the
settlement rail's five days cost a further **150 basis points of gross
return**, because a 30-day cycle turns twelve times a year and a 35-day cycle
only ten.
**Time beats price roughly six to one.** The correspondent bank is the
sharpest actor in the pipeline, and it appeared in no earlier model.
#### The frontiers
Rather than tune inputs until the model clears, the development reports where
it clears:
* **Velocity**, at a 1% margin: a 30-day cycle fails; 21 days clears.
* **Margin**, at 30 days: 1.0% and 1.2% fail; 1.5% clears.
* **Coupon**: no coupon clears both sides at 1% and 30 days. Cutting to 7%
wins the borrower but leaves the protocol 179 basis points against a
400-point cost base.
* **Scale**: making that work needs a cost base under 179 bps — roughly $112m
of reserve.
One term helps, and it is proved: because the operator owns the refinery, an
intra-group refining fee leaves the group's capacity to service the note
unchanged.
Every pipeline cost here is unverified. What is claimed is the frontier. The
failure is conditional on two numbers only the operator can supply: **margin
per cycle, and cycle length.**
#### The frontier now meets a document
The frontiers above were published because no source supplied the two numbers.
The founder primer does supply them, inside a worked example — and that example
**clears comfortably**.
At 1.50% over a 14-day cycle, with every fee charged and the rail's five days
added, the completed pipeline returns **2,137 basis points of gross against 920
of full cost**. That is 2.3× cover, against a 1%/30-day case that fails
outright. Nor is it near an edge: holding the margin, the cycle can stretch to
35 days before it fails; holding the cycle, the margin can fall to 0.65%.
So the negative result is a statement about *that* cycle, not about physical
gold trade. Both published frontiers are now bracketed by a document rather
than open at one end.
One caution, stated because it is the honest one. This is a **teaching example
inside a sourced document, not the operator's disclosed economics**. It moves
the two coordinates from "no source at all" to "attributable and quoted"; it
does not make them the operator's numbers, and the calibration used elsewhere on
this site is deliberately left where it was. The primer says the same thing in
its own words: *capital velocity explains the economics; it does not prove
safety.*
#### Three places this comparison is looser than it looks
An adversarial pass over this page found three seams worth stating plainly,
because each one moves a headline number.
**The rail's five days may already be inside the fourteen.** The course states
14 days as the whole cycle *before the trader receives cash back*, and gives no
settlement-rail delay anywhere. The model adds 5 rail days on top. That is
conservative — dropping the addition would raise the worked deal's gross from
2,137 to roughly 2,925 bps — but the 150-bps rail cost that drives "time beats
price six to one" is an **assumption stacked on a course figure that may already
contain it**, not a measurement.
**The financing rates sit on different bases.** The course charges 11% annual
simple on the full $10m purchase. The model charges a 10% coupon on a 75%
advance, plus protocol and monitor fees, giving 875 bps of NAV. Those are
different rates on different denominators, and nothing here reconciles them —
so the $42,200 above and the basis-point results below are adjacent, not
comparable.
**The optimum advances more than the course's example.** The published optimum
runs a 75% advance rate; the course's worked deal caps at 70% with a 30%
haircut, and its short-tenor example runs 50%. Gross return is linear in the
advance rate, so every headline number on this page inherits that 5-point
difference. The model has no collateral-haircut field at all — the haircut
machinery lives in the borrowing base (`itemNetValue`, `draw_within_borrowing_base`)
and is uncalibrated.
None of these breaks a proof. Each is a modelling choice that a reader
comparing our numbers to the course's would otherwise have to reverse-engineer.
### How much of the corpus is executable
One ratio belongs on this page rather than buried in a report: of the 100
archetypes recorded in the encyclopedia, **29 are executable Lean instances**
and the rest are records only. A record fixes the archetype's structure,
parties and intended compilation; an instance runs it against the kernel and
proves its positives and negatives. When this documentation says an archetype
is *covered*, check which of the two is meant.
## Every player
Doré is a two-sided market. It only exists if both sides are onboarded: claim
issuers who need capital, and holders who supply it. A model that maximizes
protocol profit while starving either side is a spreadsheet, not a design.
So every party gets a payoff and an outside option, and the design must keep
all of them at the table.
### The ledger
Seventeen players over a transfer ledger. Its central property
is an identity: the payoffs sum to real production margin plus external carry,
minus real destruction and cost. Every internal leg cancels. Nothing is
created by bookkeeping.
That identity is the basis-point echo of a kernel-level fact: over payments
between named parties, cash deltas sum to zero.
### Where the money is
The protocol's coordinate in that ledger is exactly the objective the ceiling
maximizes — proved, not asserted. The credit loss is split the way the
protection stack splits it: the write-off, what the estate returns, and what
the insurer pays, rather than collapsed into a single number.
### Findings that only a multi-player view produces
**The profit-maximal design is infeasible.** The design that earns most in the
class pays holders nothing and buys no hedge. A single-agent ceiling would
have crowned it.
**The prior baseline starved the holder.** It paid 400 basis points against a
disclosed 450-point alternative — and the single-agent objective was quietly
collecting the difference.
**The first-loss tie was an artifact.** A tranche credited with absorbing loss
but never paid for it ties the optimum. Priced at its own outside option it
costs 150 basis points and buys nothing, because liquidity binds before
absorption does.
**Holders bear loss first.** The model originally paid the yield-leg holder a
fixed rate, making it a creditor — while the kernel and the legal
classification both make it a pro-rata share that absorbs loss ahead of the
protocol. The contracts implement the share, not the coupon.
### Who actually eats a bad year
Naming an absorption order is not the same as applying it. The ledger now
routes the credit loss through the waterfall before anyone is paid, and the
routing is bounded: the three layers together can absorb at most what was
actually lost. Relief cannot be manufactured by bookkeeping any more than
profit can.
Routing it changes nothing about the published ceiling. That number is a
calm-scenario maximum, and in calm there is no credit loss, so every
absorption leg is zero and the same design wins at the same number. This is a
theorem, not an argument.
At the severe corner it changes everything. The loss there is 693 basis
points, and the protocol bears none of it:
| layer | absorbs | note |
| ------------------ | ------- | -------------------------------- |
| first-loss tranche | 0 | not bought in the optimal design |
| yield leg (sdrUSD) | 450 | its entire period flow |
| sponsor equity | 243 | the remainder |
| protocol | 0 | last in line, untouched here |
The protocol's severe-corner payoff improves from −989 to −296, by exactly the
amount absorbed above it. And the juniority holds where it matters: the yield
leg is wiped to zero before the sponsor is touched, and the sponsor before the
protocol.
**Read this as a holder, not as the protocol.** The single-agent model was
charging the protocol for losses that a correctly-specified capital stack puts
on holders and sponsors. It therefore overstated the protocol's downside while
understating what the yield leg is exposed to. A severe year takes a holder's
entire coupon and then some. That is now a theorem rather than an omission,
and it is the honest version of "holders bear loss first."
Two charges remain unwired, deliberately. The market-maker retainer and the
issuance fee are both zero in the calibrated environment because neither is
sourced. Charging an unsourced number would be inventing one. When they are
supplied, the payoff theorem gives the exact sensitivity without any
remodelling.
## What is proved, and what is not
The Doré formal development is a Lean 4 project of 81 build targets with no
`sorry`, no `admit`, no custom axioms and no `native_decide`. Every result
below is machine-checked. Every limitation below is recorded in the source
itself, not only here.
### Proved
**The kernel.** Money moves between named parties and is neither created nor
destroyed (`roster_cash_zero_sum`). A facility cannot settle before it is due
(`settlement_never_premature`) — a rule that was recorded but unenforced until
an external review rejected the corpus over it. A settlement writes a receipt
naming who actually collected, and no later reassignment can rewrite it
(`link_violation_immune_to_reassignment`).
**The economics.** The thirteen players' payoffs sum to real production margin
plus external carry minus real cost — every internal transfer cancels
(`surplus_identity`). With no production and no carry, the players cannot
collectively gain (`no_surplus_without_production`). The protocol's coordinate
in that ledger *is* the objective the ceiling maximizes
(`protocol_payoff_agrees`).
**The design.** Over the declared class, the participation-feasible optimum is
identified, and the constraints that bind at it are named: the borrower's
participation sets the price, the holder's sets the pass-through, loss
absorption stops the advance. Paying any player above its outside option costs
exactly the excess and buys nothing (`holder_slack_is_pure_transfer`), so
tightness is forced rather than assumed.
**The law.** drUSD satisfies the fiat-referenced-token definition mechanically
on sourced text (`drusd_meets_frt_definition`); sdrUSD satisfies the
collective-investment-fund definition (`sdrusd_meets_cif_definition`). A
sub-100% design fails the minimum-value rule outright. Holders rank first in
liquidation, capped at par.
### Not proved — and why it matters
**No architecture is legally feasible today.** This is unconditional and holds
for every design in the grammar: the permission is not granted. Optimization
cannot launder an open legal question, and there is a theorem saying so
(`no_architecture_legally_feasible_today`).
**The optima are grid optima.** The design space is a bounded, enumerated
grid. No continuous claim is made anywhere without a separate approximation
bound, and none is proved.
**The evaluator is a declared one-period model.** Seven shock coordinates are
read by nothing (`eval_arch_ignores_unmodeled_coords`). Market closure is an
explicit omission. Basis risk is the entire price channel for a hedged design.
**Most economic inputs are unverified.** Two calibration coordinates are
sourced to the deck; nine are not. Every player's outside option is unverified
— none is disclosed anywhere. Results depending on them are reported as
frontiers, not conclusions. See [The physical pipeline](/pipeline) for the
sharpest example.
**No comparison to other protocols exists.** Nothing here proves Doré is
better than any alternative. No competitor is modeled.
## Sourced provisions
Every rule below was parsed from operative text with a recorded hash. Where a
provision is quoted in the development, it is quoted verbatim with elisions
marked.
### Fiat-referenced tokens
| Rule | Content | Role in the system |
| ------------- | ------------------------------------------------------------- | ----------------------------------------------- |
| 19A.2 | white paper, published before issuance | a gate on launch |
| 19A.3.1 | issuer restricted from non-incidental regulated activities | why the issuer may not run the venue |
| 19A.3.2 | no dirham denomination | an outright prohibition |
| 19A.4.1 | redemption at par, no later than T+2 | why the payment leg has no queue |
| 19A.5.2 | reserves in a client account or non-objected reserve accounts | reserves are not protocol capital |
| 19A.5.3 | par-currency denomination | |
| 19A.6.1 | segregation per token | |
| 19A.7.1 | reserve value ≥ outstanding claims, **at all times** | the full-backing invariant |
| 19A.7.2 | valuation each day | the operational duty on top |
| 19A.8 | annual liquidity stress testing, large-scale redemptions | the environment's run scenario is of this class |
| 19A.9, 19A.10 | monthly attestation, annual audit | ongoing conditions |
| 19A.11.4 | liquidation order, holders first at par | the waterfall contract |
### Funds
The qualified-investor route: private placement, professional clients, a
minimum subscription, ongoing maintenance of those conditions, custody of fund
property with an eligible custodian, and management per constitution and
prospectus.
### Market infrastructure
A recognition order is the gate for operating a venue, with capital,
fair-and-orderly rules, free negotiability of admitted instruments, access
criteria and custody arrangements as ongoing obligations. Free negotiability
is the one whose protocol-side prerequisite the transfer machinery already
provides.