About | Bretton Woods

Introduction

$WOOD is a reserve-backed currency governed by a single issuance constraint: no unit is ever sold below the reserves behind it.

The backing is blended from exactly three assets: bitcoin, tokenized gold, and protocol-owned liquidity for $WOOD, meaning LP positions the treasury holds itself. The first two are scarce stores of value; the third gives the protocol trading depth it owns outright. Any liquid asset can be added as a bondable asset over time.

Supply enters four ways. A genesis sale at parity. Dutch auctions floored above backing. Staking rewards. Team options struck at backing itself. Auctions raise backing with every fill; genesis and options settle exactly at it, never below; rewards pay stakers, under a budget that section 09 makes precise.

Section 02 sets out the arithmetic of how the last backed system ended.

This system puts the constraint where a contract can hold it: at issuance. A contract verifies it on every sale; no operator applies a policy.

What broke in 1971

Bretton Woods is a village in New Hampshire. In July 1944, with the war still running, the Allied nations met there to design the monetary order that would follow it. The system signed in that room fixed the world's currencies to the dollar and the dollar to gold, created the IMF and the World Bank to police the arrangement, and governed global money for the next twenty-seven years. This protocol takes its name, and its lesson, from how that system ended.

The Mount Washington Hotel in Bretton Woods, New Hampshire — The Mount Washington Hotel, Bretton Woods, New Hampshire. Forty-four nations, July 1944.

Forty-four nations, the Mount Washington Hotel, July 1944. Keynes proposed a supranational unit called bancor, with creditors and debtors both pressed to correct. White proposed a simpler arrangement, more favorable to the United States, which then held the majority of the world's official gold.

White's proposal prevailed. The agreement fixed the dollar to gold at thirty-five dollars an ounce and every other currency to the dollar, leaving convertibility alive at exactly one window: foreign central banks, presenting dollars to the United States Treasury.

It held for two decades. Then the arithmetic caught up.

The coverage identity

Let R be the gold reserve in ounces, S the outstanding dollar claims, and p̄ the price fixed in advance. Coverage is the fraction of claims the vault can actually honor:

c(t) = \frac{R(t)}{\bar{p}\,S(t)} \qquad \color{#9b3c25}{\text{crisis when } c < 1}

(2.1)

A fixed redemption price and a growing claim pool run on separate schedules. The gap between them is the crisis.

Robert Triffin named it in 1960. Supplying the world with dollars meant running deficits, so S grew by design. Geology set R. Treaty fixed p̄. Two of the three terms moved against the third.

American gold fell from nearly twenty-two thousand tonnes in 1949 to about nine thousand by 1971. Foreign claims grew to several times what that covered at thirty-five dollars. Convertibility stayed legal long after it stopped being possible.

Everyone who ran the numbers understood the imbalance. France converted steadily through the sixties and shipped the metal home; the London Gold Pool spent itself defending the price and collapsed in 1968.

On a Sunday evening in August 1971, from Camp David, Nixon suspended convertibility and called the measure temporary. It stayed suspended.

The United States did not exhaust its gold. It still holds the largest official reserve in the world. What failed was the ratio between claims and reserves.

Most read the episode as proof that money needs backing. The record says something narrower: the redemption promise failed first, and the government cut the anchor loose to protect the reserve.

The defect was not convertibility itself. It was the fixed redemption price p̄.

Who does what

Six parts make up the system: a token, the treasury, operations, an auction, a callback, and a staking pool.

PART	WHAT IT IS	IN ONE LINE
$WOOD	Fee-on-swap ERC-20	Minted only by the treasury, only through published channels.
Treasury	Custodian	Sole minter. Holds the reserve. Owns every contract.
Ops	Operator	Runs auctions and reward streams. Cannot mint. Cannot touch reserves.
The auction	Dutch auction	Sells $WOOD above a floor. Proceeds go to the reserve.
The callback	Escrow for auction inventory and proceeds	Holds what the auction sells and what it takes in. Treasury-only.
Staking	Staking pool	Streams minted rewards per second over 7 days. Lock on principal, never on claims.

Operations proposes an auction; only the treasury can fund one.

Traders and holders. No permission is needed to hold, transfer, stake, or buy from a funded auction.

Treasury to channels. Minting happens for exactly four reasons: auction inventory, a sale round, a reward stream, an option exercise (section 10). Every mint is published.

Channels to reserve. Sale payment and auction proceeds land in the treasury and the callback.

The reserve

The backing is blended, and the blend is fixed at three assets: wrapped bitcoin, tokenized gold, and protocol-owned liquidity, meaning LP positions for $WOOD pools that the treasury owns itself rather than rents from mercenary providers. Bonding is broader, since the treasury can configure any liquid asset as bondable over time. There is no target composition and no rebalancing mandate.

Net asset value

We compute NAV off chain and publish it. The definition never moves, so nobody can improve the number by redefining it.

\begin{aligned} R &= \sum_i \left(\mathrm{reserve}_i \times \mathrm{price}_i \times \mathrm{haircut}_i\right) \\[0.55em] S &= \mathrm{totalSupply} - \mathrm{treasury} - \mathrm{ops} - \mathrm{callback\ inventory} - \mathrm{staking\ surplus} \\[0.55em] b &= \frac{R}{S} \qquad \text{backing per unit} \end{aligned}

(4.1)

Each subtraction removes supply that exists but has never been sold. Counting it would overstate the float and let the protocol sell too cheap. The definition only ever errs toward a higher floor.

Prices come from Chainlink on Ethereum for gold and bitcoin, cross-checked against the local bitcoin feed. LP positions are valued from the pool's reserves at those same prices, counting only the non-$WOOD side. The $WOOD portion is worth zero to NAV, so the reserve never counts its own token as backing. The system rejects any price older than the feed's maximum update interval plus fifteen minutes.

Every reserve asset must match what the canonical bridge reports before the treasury accepts it.

Accretion

Four lines of algebra carry the whole design.

Sell Δs new units at price p, denominated in reserve units per token. Reserve and supply both move:

b' = \frac{R + p\,\Delta s}{S + \Delta s}

(5.1)

Subtract the old backing and the result collapses:

b' - b = \frac{R + p\,\Delta s}{S + \Delta s} - \frac{R}{S} = \frac{\Delta s\,(p-b)}{S + \Delta s}

(5.2)

Numerator: S(R + pΔs) − R(S + Δs) = Δs(pS − R) = Δs S (p − b). Divide through by S(S+Δs).

Both Δs (units sold) and S + Δs (supply after the sale) are positive, so the sign of the whole expression is the sign of one bracket:

b' > b \iff p > b

(5.3)

Issuance raises backing per unit if and only if it is priced above backing per unit. There is no third case.

That is the entire policy. Set the auction floor above b (backing per unit) and every fill raises backing by construction. With a margin μ (the floor's premium over backing):

f \ge b(1 + \mu) \Longrightarrow b' - b \ge \frac{\Delta s\,b\,\mu}{S + \Delta s} > 0

(5.4)

Genesis runs at p = b, price exactly equal to backing, so it is neutral. Strictly it is the starting condition and not a use of the rule: before it, (4.1) divides by zero. Emissions run at p = 0, section 09. Team options exercise at p = b, section 10: neutral, like genesis.

Each auction fill lands above the floor and steps backing up. Emissions pull it down between fills. Section 09 gives the condition under which the steps win.

Try it · price against backing

Sell Δs = 100 units into S = 1,000 at price p, with backing b = 1.00. Drag the price.

Price against backing

p = 1.25

b′ = 1.0227

b′−b = +0.0227

ACCRETIVE · b′ > b

(5.3) in motion: the sign of b′ − b is the sign of p − b. There is no third case.

Additional accretion channels

The auction is the first accretion channel, not the last. Additional channels are planned, each taking value in above backing and passing it to the reserve, so that backing per unit compounds from more than one source.

Whatever form they take, each must satisfy (5.3) before it ships. A mechanism that cannot prove p > b, a price above backing, at the door does not become a channel.

Issuance

Only the treasury can mint. That authority is fixed the moment the token is created, so no deployer or intermediary ever holds it.

CHANNEL	PRICE	EFFECT ON B	GATE
Genesis sale	p = b₀	sets b₀	1,000 allowlist slots, 500 USDG each
Dutch auction	p ≥ b(1+μ)	accretive	Floor enforced by the auction contract
pWOOD exercise	p = b	neutral	Capped and vested, see 10
Reward stream	p = 0	dilutive	Policy only, see 09

There is no supply cap.

Bond markets

Bond markets are the principal issuance channel: a sequential Dutch auction run by Bond Protocol v1.0.0, a release audited by Sherlock and Zellic.

Price opens above the floor, decays while nobody buys, jumps on each fill, and re-tunes at intervals. The market cannot transact below the floor at any point.

Resting on the floor is expected behavior: the contract declines any trade below the accretion threshold, and unsold inventory returns to the treasury.

Vesting: 48 hours

Payouts vest over a fixed term of 48 hours. A buyer receives a fixed-term bond token at purchase and claims the underlying two days later.

Vesting does structural work. The reserve gets paid on day zero; the supply arrives on day two. A bond buyer cannot sell into the auction that issued them.

t = 0 · purchaset = 48 h · claim payout

BOND TOKEN HELD · PAYOUT LOCKED

quote → callback, at once · referrer = 0gross, teller is not a pair

RESERVE GROWS ON DAY ZERO · FLOAT GROWS ON DAY TWO

The reserve is paid immediately and the supply arrives two days later, so the buyer of a fill cannot be the seller into the next one.

The genesis sale

The genesis sale is a single round: one thousand allowlisted slots of five hundred dollars each, priced at net asset value.

WHITELISTED WALLETS	1,000
ALLOCATION PER WALLET	500 USDG
ROUND SIZE	500,000 USDG
PRICE	parity with NAV, p = b₀
PAYMENT TOKEN	USDG, 6 decimals
SETTLEMENT	all-or-nothing, one call

Each slot is the same size, so the arithmetic is one division. With NAV per token b₀ at the round:

x = \frac{500}{b_0} \qquad \sum x = \frac{500{,}000}{b_0} \qquad \text{tokens per slot, and per round}

(8.1)

The first price

Every later issuance is measured against a backing figure that already exists. Genesis has nothing to measure against. Circulating supply is zero, so (4.1) has no value and (5.3) has nothing to compare.

Any b₀ (the starting backing per unit) is internally consistent. The treasury picks it, the round fixes it, and everything in section 05 is measured from there.

TREASURY, ONE BATCHmint(Σx)approve(sale, Σx)setSlots(1,000 buyers)

WHITELISTED BUYERapprove(sale, 500 USDG)buy(x, 500e6)exact amounts, or revert

SETTLEMENT, ONE TX500 USDG → treasuryx $WOOD ← treasuryslot deleted

the sale contract holds nothing, cannot mint · exposure = the allowance, nothing more · round closes with approve(sale, 0)

Payment passes directly to the treasury and tokens come directly from it. The sale contract verifies eligibility; it never holds funds.

It holds nothing and cannot mint. The round closes cleanly the moment the treasury withdraws its allowance.

There is no owner. Its authority is the treasury, permanently.

Settlement is exact. A buyer always settles at precisely the terms they were quoted; anything else refuses to execute.

Slots are all-or-nothing. A failed leg leaves the slot intact for a retry, and an unused slot simply expires when the allowance goes to zero.

Staking and emissions

The treasury funds each reward stream, and staking pays it out continuously: per second, at a fixed rate, over a seven-day window. What streams is always exactly what was funded.

\mathrm{rate} = \frac{R_{\mathrm{funded}}}{D} \qquad D = 7\,\mathrm{days} \qquad \text{guard:}\quad \mathrm{rate} \le \frac{\operatorname{balance}(\mathrm{staking}) - T}{D}

(9.1)

Rewards come only from surplus. The guard in (9.1) subtracts every depositor's principal T, so a notify can never stream what stakers put in.

The guard is a bound, not a solvency check. Stake and reward are the same asset, which leaves one balance standing behind three separate claims: principal, rewards already earned and owed, and tokens that are genuinely free. The guard sees the first. Anyone recovering surplus by hand has to subtract the second as well.

surplus = balance(staking) − totalSupply − Σ earned(user)

Add that up across every address that has ever staked. Use balance − totalSupply on its own and you re-stream tokens somebody is already owed, until the last withdrawal reverts. The guard checks that same quantity, so it waves the wrong number straight through. Safer route: have every staker claim first, confirm the earned total sits at zero, then the short formula holds.

The emission budget

Rewards are the one channel priced below backing, so a budget binds them. Over a reward period with auction sales Δs (units sold) at price p and emissions Δm (units streamed to stakers), backing keeps rising when

\Delta m \le \Delta s\left(\frac{p}{b}-1\right) \Longrightarrow \Delta m \le \mu\,\Delta s \quad \text{at the floor}

(9.2)

From b′ ≥ b (backing after the period at least backing before) with S′ = S + Δs + Δm: Δs(p − b) ≥ b Δm.

Emissions per reward period may not exceed the auction premium, measured in units sold times the fraction by which they cleared above backing.

Swap fees, section 10, sit outside this budget entirely. They mint nothing, and the reserve share only raises R (the reserve).

The lock

stakewithdraw opens · any time after

PRINCIPAL LOCKED · 24 H

re-staking resets the clock

getReward: AVAILABLE AT EVERY POINT ON THIS LINE · NO LOCK · NO PAUSE PATH

The lock binds principal only. Nothing blocks claims; the contract has no branch that could.

The lock is capped at 7 days by a constant checked in both the constructor and the setter. A change to the duration applies to stakes already in place. Re-staking resets the clock on the whole position.

Withdrawal after the lock, and claims at any time, can never be paused.

The token and the fee

A standard, battle-tested ERC-20 with one addition: swaps through registered pools pay a 5% fee. Most of it buys reserves; the rest funds the team.

\mathrm{fee} = \left\lfloor \frac{v \cdot \phi}{10^4} \right\rfloor \qquad \phi = 500\,\mathrm{bps} \cdot \mathrm{ceiling}\ 1000 \cdot \mathrm{hard\ max}\ 1000

(10.1)

transfer: pair on either side?isAMMPair[from|to]

yes →no ↓

either exempt?isFeeExempt

no →yes ↓

FEE

FREE

always free: mint and burn short-circuit, from = 0 or to = 0

The condition is the presence of a pair, not the identity of a counterparty. Wallet transfers, mints, burns, staking, bonds and the sale carry no fee, and none of them needs an individual exemption.

One rule is absolute: no system contract is ever registered as a pair, so staking, purchases and the sale always settle in full.

Staking is fee-exempt from launch, so depositors are never taxed by accident.

Where the fee goes

The fee splits two ways. 80% buys reserve assets for the treasury: gold, bitcoin, and liquidity the protocol owns outright. The remaining 20% funds the team, operations and growth.

The larger share works like an accretion channel of its own. Fee revenue is existing supply changing hands, not new units entering, so by (5.2) it moves neither Δs (units sold) nor Δm (units emitted); every purchase it funds raises R (the reserve) against a fixed S (circulating supply), and backing per unit climbs.

Team options: pWOOD

One more instrument pays the team: pWOOD, an option token in the pOHM tradition with two corrections: a hard cap and automatic vesting.

TERM	VALUE
Strike	Backing per unit b, paid into the treasury on exercise
Supply cap	Cumulative $WOOD ever minted through exercise ≤ 15% of circulating supply at the time of each exercise
Vesting	Exercise rights vest linearly over 30 days from launch
Holder	One team address, fixed at deploy
Mutability	None. Strike, cap and vesting are immutable

The strike does the alignment work. Every exercise deposits b (the backing per unit) into the treasury for every unit minted, so backing per unit holds through exercise by construction; the option is worth exercising only when $WOOD trades above backing. The team earns nothing at the floor and everything above it, which is exactly the part the team is supposed to build.

Vesting is automatic. No cliff, no schedule to administer, no admin setter: one on-chain clock, the vested fraction v, opens the option gradually over the first 30 days.

v = clamp((now − launch) / 30 days, 0, 1)

v runs from 0 to 1 and stays there. At any moment, cumulative exercised $WOOD may not exceed v × 15% × circulating supply. Ten days in, the team can have exercised at most a third of its cap; at day 30 the full 15% is open. The contract enforces the bound on every exercise, so nothing can be front-loaded.

Circulating supply is defined conservatively, which keeps the cap small. It counts staked units and units in pools, and excludes everything the protocol holds or escrows. If holders cannot sell it today, it does not count.

Custody and authority

PARTY	POWERS
Treasury	Minting, all token policy, callback deposit and withdrawal, whitelist and blacklist, auctioneer guardian, staking owner, sale slots and allowance.
Ops	Market creation and closure, funding reward streams. Cannot mint, cannot reach reserves, cannot reach the callback beyond what the treasury deposited.
Anyone	Buy from a funded market, settle an assigned slot, stake, withdraw after the lock, claim at any time.

The auction teller's protocol fee is fixed at zero and its sink is the treasury, not Ops, because any fee it took would come out of the quote asset, and quote proceeds belong to the treasury.

The preflight

A preflight check gates funding. It refuses any market that is:

not live, or not owned by Ops;
not pointed at the callback;
paying out anything other than $WOOD;
quoted in an asset the treasury has not configured for bonding;
wrong on scale or floor;
handed a zero floor, which would make the floor test vacuous.

That last one matters more than it looks. The floor is the treasury's own NAV-derived number, checked against the floor Ops set on the market, and it is the one condition in the handshake that two parties have to reach independently. A zero passes every market ever made. So the check rejects it, prints both floors, and prints the margin between them in basis points, which puts the margin in the signed record instead of a bare pass.

Immediate execution

Treasury actions execute immediately, with no timelock queue in the way.

Speed matters here. The emergency ladder below works best when it can move without delay, and the treasury sits offline behind monitoring that pages on every privileged event.

Emergency ladder

In order, stopping at the first step that contains the problem: blacklist the market at the callback, revoke Ops callback authorization to halt every Ops market at purchase time, close markets and forbid new ones, sweep the callback, revoke the sale allowance, pause new stakes, set the fee to zero.

None of these touch a holder's balance or stop a staker exiting. We never renounce callback ownership, so inventory and proceeds stay recoverable.

The specification

KNOB	AT LAUNCH	BOUND
Chain	Robinhood Chain · 4663	n/a
Name · ticker	$WOOD	deploy parameter
Supply cap	none	n/a
Genesis wallets	1,000	allowlist
Genesis allocation	500 USDG each	all-or-nothing
Genesis round size	500,000 USDG	at NAV parity
pWOOD strike	backing b	paid to treasury
pWOOD cap	15% of circulating	at each exercise
pWOOD vesting	30 days	linear from launch
Swap fee φ	500 bps	≤ 1000 bps
Fee ceiling, immutable	1000 bps	≤ 1000 bps
Bond vesting	48 hours	fixed term
Bond debt buffer	10 000	≥ 10 %
Bond referrer	0	named takes ≤ 5 %
Withdraw lock	24 hours	≤ 7 days
Reward duration D	7 days	> 0
Teller protocol fee	0	sink = treasury

Deployed code

COMPONENT	ORIGIN
Token	OpenZeppelin 5.7.0
Allowlist sale	original
Rewards notifier	original
Staking	Synthetix 2.101.3
Auction stack	Bond Protocol v1.0.0

The auction stack runs its audited upstream code unmodified. The staking pool carries one small patch, the surplus guard in (9.1), and every commit re-verifies it against pristine upstream. Every parameter above is final at deployment.

Disclaimer

Bretton Woods is an experiment. It takes no deposits and keeps no accounts. Nothing here is advice about what to buy.

$WOOD is not a deposit and has no pegged or guaranteed price. It relies on the custodians, issuers and infrastructure beneath it.

We promise the reserve, not a price.