RAI Dollar: the immutable $1 stablecoin of DeFi

Most stablecoins have administrators: a team, a governance token, a multisig that can pause the contracts, swap an oracle, or change a collateral parameter. A certain lineage of stablecoins has rejected that design, instead choosing to deploy code that can't be changed and stablecoins that can't be frozen or censored. RAI Dollar (RD) is the newest of these immutable stablecoins, and it fixes specific gaps the earlier ones left open. To understand the gaps, let's start with the previous ungoverned CDP stablecoins.

A short history

LUSD (Liquity v1, 2021)

LUSD was the proof that an immutable CDP stablecoin could work. You locked ETH, minted LUSD at a 110% minimum collateral ratio, and the system functioned without admin keys, upgrade paths, or governance. The Stability Pool absorbed liquidations, and anyone could redeem LUSD for a fixed $1 of collateral at any time, a hard price floor.

The redemption price floor

Anyone can redeem 1 LUSD for $1 of ETH collateral, minus the fee. So whenever LUSD trades below that, buying the discount and redeeming is free profit — arbitrage buying lifts it back. That sets a floor at roughly $1 − fee.

The problem: a fixed, brittle rate

LUSD had no way to steer the cost of borrowing: a one-time fee at mint, then nothing. With no rate to adjust, LUSD couldn't respond to the risk-free rate, so when fiat stables began paying several percent, holders rotated out of zero-yield LUSD. It settled below a dollar, and the only correction left was redemption, grinding against the lowest-collateral troves for months. Borrowers were forced to hold extremely high collateral ratios of 500+% in order to avoid redemption. The protocol simply had no way to adapt to a changing rate market.

LUSD's borrow cost was a one-time fee, then zero, so its carry couldn't follow the risk-free rate. As Treasuries and the fiat stables that hold them started paying several percent, holders rotated out, LUSD settled below $1, and the only correction left was redemption grinding the lowest-collateral troves for months.

In addition to under-peg issues, LUSD's fixed, minimal rate demonstrated the inelasticity of CDP debt to low borrow rates, as it remained over-peg for extended periods. This protracted over-peg state required borrowers to re-buy $1 worth of debt at $1.02, $1.03, etc. when repaying their loan.

The mirror-image failure. With the borrow cost already at its floor, cheap debt couldn't attract enough new minting to meet demand — CDP debt is inelastic to low rates. So LUSD also spent long stretches above $1, and every borrower closing a loan had to buy back each $1 of debt at $1.02, $1.03, and beyond.

BOLD (Liquity v2, 2025)

BOLD improved upon LUSD's design. It added collaterals beyond ETH (wstETH, rETH) and user-set interest rates. Each borrower picks their own rate, which also determines their place in the redemption queue. Paying a higher rate means your trove is less likely to be redeemed against. This created a loose, user-involved feedback loop of low stablecoin prices → redemptions → users raise rates → yield rises → stablecoin price rises. A user manages their rate themselves or pays a 3rd party to manage it. However, a large enough redemption wave can still climb the queue and redeem your trove.

The problem: active management and bad debt

BOLD turned redemption into an auction where you bid for an opaque probability of not being redeemed. There is never a guarantee your trove won't be redeemed. Also, BOLD did not provide a resolution for when a single collateral branch produces uncollateralized debt; resolving it requires DAO voting to direct incentives.

BOLD orders the redemption queue by each borrower's self-set rate: the lowest rates are redeemed first. Paying more buys a better spot, but it's an auction, not a guarantee. A small redemption stops short of your trove; a large one climbs right past it. And it takes active management or a paid delegate to hold your place.

The over-peg structure remains

BOLD mitigates some of the potential over-peg forces, with LSTs offering less opportunity cost for minting and dropping the cost of short-term loans to 7 days of upfront interest charged. However, BOLD did not make major structural changes from LUSD that are meant to address the inelasticity of debt creation to low rates.

RAI (Reflexer, 2021)

RAI tackled the part Liquity's floor didn't: actively steering price. The redemption floor is the price where the redeemable value of the stablecoin makes it an attractive buy. In Liquity, the floor defends the coin below a dollar and does nothing above it, and can't adapt as conditions change. RAI adopted the 'governance minimized' ethos and used a PI controller to continuously adjust RAI's redemption price, aka par to lean against price volatility from both sides, making the coin less attractive to hold when the price spiked and more when the price dropped. It worked, and it proved a point:

A collateralized stablecoin can be stabilized with an automated par controller.

The problem: a mental hurdle

RAI, by design, only guaranteed the market would return to its floating peg, not a fixed $1 price. It was fascinating, but also using a floating price debt instrument was a large mental hurdle for many to overcome.

RAI's controller works, but it steers toward a floating target, not a fixed dollar. The redemption price wanders wherever the loop points it, and the market faithfully follows, so RAI stays stable without ever being $1. RAI Dollar keeps the same lever but pins its target to a dollar, moving it only in the extremes.

The lineage has proven three things:

• An immutable CDP stablecoin is possible
• Redemptions for crypto collateral set a reliable price floor
• A par controller can drive the market price of a stablecoin

Yet no single protocol had combined them all for a $1 stablecoin, while also automating borrow rates, addressing undercollateralized debt from a collateral failure and automating the complete incentive pipeline.

RAI Dollar

RAI Dollar is that combination: an immutable CDP stablecoin inspired by Liquity's redemptions and stability pool, steered by a RAI-style par controller, targeting $1, and designed with collateral failure in mind. Further automation of system interest rates removes active management and 3rd party trust, and automation of the fee pipeline keeps the protocol healthy and maximizes revenue to stakers.

• The peg is defended automatically, even in extremes. An on-chain controller sets a single system-wide rate from RD's market price, plus a second, bounded par lever for the extremes. RAI's idea is kept on a leash to keep the price near $1, not float around freely over time.
• Redemptions remain and have an opt-out. A trove owner can enable Redemption Shield, a guarantee they won't be redeemed against in normal operation, the certainty BOLD's queue can't offer.
• Stability Pool deposits automatically compound. Interest fees flowing to your SP deposits of RD automatically increment your balance. No need to separately claim and then re-deposit RD to make your deposit grow.
• Collateral set is expanded. ETH, its liquid-staking derivatives, BTC, gold, and a yield-bearing stable, each in its own branch of smart contracts, with separate borrow operations, interest rates, stability pools, liquidations and shutdown mechanisms.
• Automated fee and incentive pipeline. Fees are automatically delivered to stability pools and a Balancer stableswap pool in order to support protocol safety and excellent RD swap slippage. The amount delivered adapts to meet the protocol's needs. No more over-paying for liquidity or stability pool deposits.
• Undercollateralized branch debt gets settled. An automated self-funded repair for any unbacked debt remaining after shutdown, a first in the immutable CDP stable lineage.

The rest of this post walks through each, starting with the main controller.

Controlling rate and par

RAI controlled a single knob, the redemption price. RD splits stability across two automatic levers and only turns one at a time. Each answers a failure from the history above.

The rate lever

RD's answer to LUSD's fixed fee and BOLD's hand-managed rates is to set one automated system rate which is the basis for all collateral borrow rates. An on-chain PI controller reads a 24-hour TWAP of RD's market price and moves the system-wide borrow rate to hold the peg.

Below $1: system rate is raised; above $1: system rate is lowered

The controller nudges one system-wide borrow rate off its 2% bias, and the rate pushes on both sides of the market at once. Above peg it eases the rate — more borrowing (supply up) and thinner Stability-Pool yield (demand down). Below peg it does the mirror image. Either way, supply and demand both move RD back toward $1.

The loop leans about four-and-a-half times harder on the under-peg side (Kp_under = 4.5 × Kp_over), since defending a falling coin is the more urgent job; it's slew-limited to roughly 1%/hour so the rate drifts instead of jumping; and it's bounded to 0.25%–50% APY around a 2% bias. No manual, borrower-managed rates.

The par lever

The rate handles the everyday tug-of-war. For the rare case where it isn't enough, RD reaches for the thing RAI actually proved: you can move a stablecoin's market price by moving the price the protocol will redeem it at. Shifting the redemption price drags the market to meet it. RAI let its redemption price float wherever its controller pointed, with no target.

RD takes the mechanism and keeps it holstered until it's needed. Its internal redemption price, par, sits at exactly $1.00 under normal conditions. Only in a sustained, extreme deviation does the same controller move it (inside a hard $0.75–$1.30 band, no faster than $0.001/hour), and always in the direction that widens redemption arbitrage back toward a dollar.

Below $1: par is raised; above $1: par is lowered

Par is the price the protocol redeems at, and moving it pushes on both sides of the market at once. Below $1 the controller raises par — the redemption floor rises under the market price (demand up) while trove ICRs tighten (supply down). Above $1 it lowers par, and once par drops below market/MCR, minting-and-selling is instant arbitrage (supply up) while the floor recedes (demand down).

The price floor moves with par

Redemption settles at par, so the redemption floor sits a fixed fee below it: floor = par − fee. As the controller nudges par up and down over time, the floor tracks it, staying one fee lower the whole way. Par itself only moves in the bounded $0.75–$1.30 range, at most $0.001/hour.

Baton: RATE mode or PAR mode

A baton keeps the two levers from fighting: only one is live at a time. Two automatic levers, one fast and one slow, both bounded and both aimed at $1.

Picking the mode

Price error bands, colored by which output holds the baton. A dead band in the center where nobody acts; the RATE mode owns everyday errors just outside it; and only a large, sustained error hands the baton to PAR mode further out. One mode is responsible for any given error — never both.

Switching modes is not instant: it requires a dwell timer of 24 hours to hand par the baton and 12 hours to hand it back to rate, so a brief spike can't start a mode war.

Troves with Redemption Shield enabled are unredeemable

Redemption is what gives RD its price floor, but from the borrower's chair it has a sharp edge. If your trove without Redemption Shield sits near the front of the queue while RD trades below par, redeemers can take some of your collateral and write off an equal amount of your debt. Your ratio barely moves, but your position was partially closed and your collateral reduced on the protocol's timing, not yours.

A redemption walks the base book from the lowest ICR up. The trove it hits gives up some collateral to the redeemer and has an equal value of debt written off at par — so its ICR barely moves; it's a forced partial repayment, not a loss. Troves with Redemption Shield enabled are skipped entirely (except during branch shutdown).

RD turns that exposure into a priced choice. Switch on the redemption shield and your trove is guaranteed not to be redeemed against in normal operation. You pay a surcharge on top of the branch rate, and that surcharge isn't burned: it funds an exactly equal discount to every trove without Redemption Shield on the same branch.

The price of Redemption Shield floats with demand

When the Redemption Shield share is low, protection is nearly free. As that share climbs, it becomes more expensive. Past its 85% kink, the surcharge accelerates and the base discount deepens, as far as −50% APR. A trove's Redemption Shield setting can change at most once per 24 hours, so it's a stance you take, not something easily flipped back and forth to avoid redemption.

Both rates are priced off the branch's Redemption Shield share. The more of a branch that has Redemption Shield enabled, the further the two rates spread — the Redemption Shield rate rises and the base rate falls, with the surcharge funding the discount.

No Redemption Shield after collateral shutdown

The lone exception to Redemption Shield protection is shutdown. A branch being wound down walks troves both with and without Redemption Shield on the same schedule, because all debt needs to be cleared from a shutdown branch. The shield normally prevents redemption; once the branch is settling, troves with Redemption Shield enabled can be redeemed as well.

Stability Pool deposits auto-compound

The Stability Pool is a branch's first defense against collateral price volatility: depositors hold RD, and when a trove is liquidated the pool burns RD equal to its debt and hands depositors the seized collateral, usually at a discount to oracle price. Standard Liquity lineage to here.

What's different is that a depositor's RD balance grows on its own from fees. A dynamic slice of the branch's borrow interest is routed into the pool and folded straight into each depositor's balance, with no claim, no restake, no separate reward to manage.

Interest routed to the pool is folded straight into your deposit, so it immediately starts earning alongside your principal — no claim, no restake. Each accrual is therefore struck on a larger balance than the last (green), pulling away from the same fees left un-compounded (dashed). That widening wedge is interest on your interest, kept automatically. Rate shown is illustrative.

Collateral branches

RD launches on ETH and its liquid-staking derivatives (wstETH, rETH, weETH), BTC (WBTC, tBTC), a yield-bearing stable (sUSDS), and tokenized gold (PAXG).

Each collateral is its own branch: its own troves, its own set of contracts (Stability Pool, BorrowerOperations, etc.), its own price feed, its own borrow rate. Collateral borrow rates are determined by branch-level controllers that offset the system rate based on collateral utilization. If a collateral's debt is occupying too much of the global RD supply, the borrow rate is slowly raised. A collateral that is backing too little of global debt will see its borrow rate drop to encourage more minting.

Collateral shutdown

Collateral shutdown is not an admin or governance decision, but an automatic mechanism whose criteria are fixed in code.

Shutdown criteria

• A collateral's Total Collateral Ratio (TCR) falls below its Shutdown Collateral Ratio (SCR)

• A collateral oracle enters a failure state

• A blacklistable collateral blacklists or wipes the balance of the RD protocol itself

Shutdown mechanics

In these cases, anyone can initiate collateral shutdown, removing the collateral branch from the global redemption basket and starting a Dutch auction of that branch's collateral through direct redemption. Pricing opens at a 1% premium and, within the first hour, ramps to a 1% discount; from there discounts ramp up to 5% over the rest of the day for a TCR shutdown, and up to nearly 100% over two weeks for a dead oracle, clearing troves both with and without Redemption Shield until the branch's collateral is gone.

TCR-below-SCR shutdown. Pricing starts at a 1% premium (×1.01) and falls fast: within the first hour it crosses break-even (≈ 30 minutes in) and reaches a 1% discount (×0.99). From that kink it ramps gently over the remaining 23 hours to a 5% discount (×0.95) at day one — then holds there. The premium start makes forcing a shutdown worthless, since shutdown redemptions bypass the quota.

Fee flows are dynamic

RAI Dollar charges continuous, per-second interest to borrower troves. The interest fees are routed by two independent PI loops rather than a brittle, fixed split.

Stage one lives on each branch's FeeRouter and decides how much of that branch's interest is paid to Stability Pool depositors, the auto-compounding slice above. Stage two is the singleton GlobalFeeRouter, which takes the multi-branch remainder and divides it across LP stakers (a share driven by a PI loop on LP utilization), FEE stakers, and keeper rewards.

SP incentives are tuned per branch because a branch's pool can be thin or flush on its own. LP incentives are tuned globally because there's one canonical market with one liquidity number. The splits move continuously toward wherever the incentive has gone too weak.

Normal operation: borrow interest (in RD) from every branch is split between the branches' local Stability Pools and the singleton GlobalFeeRouter, which fans out to keeper rewards, LP staking, and FEE staking. Band widths are illustrative; the actual splits are set by PI controllers within a 10%–60% band. Redemption fees are not shown — they stay with the redeemed trove.

Dynamic Stability Pool allocation (Stage one)

Each branch's FeeRouter is a PI controller that measures SP utilization (smoothed by a 72-hour EMA) against the pool's target of 25% of branch debt, sending more interest to a thin pool to attract deposits and less to an oversupplied one. The allocation of the branch's fees is bounded to 10%–60%, with a 50% default and 5% deadband. The pools that most need loss-absorbing capital are automatically the ones paying most to attract it, and the yield lands automatically into RD depositors' positions.

The branch router sends a slice of borrow interest straight to Stability-Pool depositors. That slice rises when the pool is thin (below its target share of branch debt) to pull deposits in, and falls when the pool is over-supplied. It is bounded to 10%–60% and rests at its 50% bias near target.

Dynamic LP allocation (Stage two)

Stage two works similarly, but globally. The GlobalFeeRouter runs a PI controller on LP utilization: the RD Balancer pool's liquidity (a TWAL from the market oracle) over RD total supply, smoothed by a 72-hour EMA and steered toward an 8% target.

When the RD market is thin relative to supply, the controller raises the LP allocation to route a bigger share of the multi-branch remainder to LP stakers and pull liquidity in; when the pool is deep, it lowers it. The share is bounded to 10%–60%, rests at a 50% default near target, and holds still inside a 1% deadband. Deeper RD liquidity means tighter swap slippage, so the protocol buys exactly as much market depth as it needs, and whatever's left flows to FEE stakers.

Part of borrow interest is routed to LP stakers as RD. That share rises when LP depth is thin (pool liquidity below its 8% target share of RD supply) to pull liquidity in, and falls when the pool is deep. It is bounded to 10%–60% and rests at its 50% bias near target.

Undercollateralized: when shutdown redemptions can't clear all debt

If a shutdown branch has cleared all collateral from shutdown redemptions but still has debt left, it is deemed undercollateralized. The Aggregator names the undercollateralized branch the bad-debt sink, and the protocol starts diverting fees into it: 50% of the FEE-staker share of interest across the entire system, plus the redemption fees from every healthy branch (which are normally retained, not routed), all flow into the sink branch's payDebt.

LP and SP stakers are never diluted; the diversion falls on FEE stakers, who are the protocol's risk capital by design. There is no MKR-style dilution, no treasury, no vote. The system taxes its own healthy fee flow until the hole is filled, then goes back to normal.

---

If you want to see how the pieces fit, start with What is RAI Dollar and How it stays stable. For the machinery, read the Peg control, Fees, and Collateral shutdown.