Doré Protocol
Commodity trade finance, on-chain — with the economics and the law carried as machine-checked proofs rather than prose.
Doré finances the oldest secured lending there is: short-dated, insured purchase of physical metal that already exists. Two tokens do one job each. drUSD is the payment leg — treasury-backed, redeemable one-for-one at will, with no queue. sdrUSD is the yield leg — stake drUSD to take a pro-rata share of insured, asset-secured facilities. It is a share, not a deposit, and it absorbs loss ahead of the protocol.
At launch that is one facility, not a portfolio. The structure is one vehicle per facility by legal design, so early sdrUSD exposure is concentrated in a single obligor group, one commodity and one custody chain. Diversification is a later state, not the opening one — see risks.
Start here
| If you are | Read |
|---|---|
| New to commodity finance | What it is → the pipeline → instruments |
| Considering an allocation | What happens to your money → the first facility → fees and terms → risks → verify the reserve |
| Assessing the business | Litepaper → how Doré makes money → the simulation |
| Reviewing the formal work | What is proved → the ceiling → development |
| Checking the legal position | ADGM position → one SPV per claim → sourced provisions |
Unfamiliar term? The glossary covers the metal, the trade, the regulation and the on-chain vocabulary in one place.
What makes this different
Most protocols document intentions. This one ships a formal development in Lean 4 — 78 modules, roughly 1,500 theorems, a kernel that has not been edited once across 101 archetypes — that the contracts are built to satisfy, and a test suite in which every test names the theorem or provision it discharges.
| Claim | Where it is proved |
|---|---|
| Reserves cover outstanding claims at all times | COBS 19A.7.1; fractional_backing_fails_min_value |
| A settlement cannot happen before it is due | settlement_never_premature |
| A redemption never pays more than its pro-rata share | FairShareBurn, burn_payout_le_nav |
| The same collateral cannot be pledged twice | whr_double_pledge_rejected |
| A wrong-owner collection cannot be laundered | link_violation_immune_to_reassignment |
| Holders rank first in liquidation, capped at par | COBS 19A.11.4; frt_distribute_holders_first_par_capped |
| No player gains without production | surplus_identity, no_surplus_without_production |
| The system cannot reason from law it has not read | eval_unsourced_never_feasible |
Where the legal position actually stands
The baseline architecture passes the widest legal gate we have built, on
sourced rulebook text: dore_ceiling_v020. The payment leg meets the
fiat-referenced-token definition mechanically, and its route resolves to
feasible with conditions — the conditions being an Accepted-FRT determination
and ongoing COBS 19A compliance, both named in the result rather than assumed
away.
Three things are open, and the system says so mechanically rather than
optimistically: the Accepted-FRT determination has not been sought; the
fund-side route is resolved and closed — provedInfeasible, blocked on
the fund-manager permission, which is exactly why the structure uses
one SPV per facility; and owned-venue designs are proved to be outside the feasible set
today (owned_venue_outside_feasible_set_today).
What is not claimed
The economic results are grid optima over a declared model, not continuous claims. Every calibration input is marked sourced or unverified, and results depending on unverified inputs are reported as frontiers rather than conclusions — including the finding that the deck's own 4.5% margin target needs a borrower alternative above the yield band its facility page states.
Of 101 archetypes recorded, 29 are executable Lean instances; the rest are records. Nothing is deployed to any chain. There is no third-party audit, no engaged attestor or auditor, and no regulatory authorisation.
What is proved states the honest boundary; risks ranks what would most plausibly cause loss.