HAVEN

A closed economy, denominated in gold

HAVEN is a closed monetary economy with one currency ($HAVEN), one market (the HAVEN ⇄ GLD pool on Uniswap v4), one signal that moves policy (net gold flow through that market), and one authority — the central bank, immutable code that answers to no board or committee.

Because HAVEN is paired directly against tokenized gold (GLD), the fee currency is gold. Every buy pays the bank in gold, so the reserve stacks a hard asset with zero conversion. Capital flowing in banks gold; when that gold sets a fresh backing high — and only then — the bank issues. Capital flowing out flips the regime to defense and prices the exits. The reserve's gold leaves for exactly one purpose: to buy $HAVEN below its gold floor and burn it. Every path through the economy either burns $HAVEN or brings the bank hard assets. Most do both.

Six entities, one relationship each

Hard cap, one pre-mint, burns everywhere

The remaining 900,000,000 is the issuance budget. It is credited to branches each epoch — and only on a new gold-backing high — as ledger balance; actual tokens mint only when a banker withdraws. When cumulative issuance reaches the budget, issuance stops for good and the economy runs on recycled fees.

$HAVEN is burned by expansion licenses (100%), buyback fills (100%), and half of every resolution fee. Circulating supply is therefore a receipt: S = 100M genesis + withdrawal mints − burns, and the maximum supply that can ever exist only falls.

Net gold flow sets the regime

The hook on the pool meters, each epoch, the gold that enters from buys and the gold that leaves from sells, from the real settled swap deltas. Net flow is the bank's regime signal — the fast half of policy.

Net flow drives the fast lever: the current epoch's sign sets the regime — where fees route and how exits price — so defense reacts the moment gold turns net-outward. The issuance press answers to a separate, slower signal (§05): the reserve's gold-backing high-water mark, which real gold must arrive and stay to lift — so no single epoch of flow can swing it.

The bank prints against gold, or it prints nothing

Issuance is backing-gated. Each epoch the bank measures its backing ratio — FBR = reserve gold ÷ $HAVEN supply, the gold each token is worth in reserve — and mints new $HAVEN only when that ratio sets a fresh high-water mark. No new high, no issuance: not a slower rate, zero. The press cannot run unless real gold has arrived and stayed.

When a new high is struck the mint is bounded: ΔS = ¾ · S · (FBR / FBR_hwm − 1), hard-capped at 2% of supply per epoch, after which the mark advances to the post-mint ratio. The mark only ever ratchets up, and since ¾ < 1 each mint is more than covered by the gold that unlocked it — so gold-per-token can never fall through its own floor. One invariant carries the whole promise: dilution can never outrun backing.

A second, faster signal — this epoch's net gold flow — sets the regime, which decides where fees route and how exits are priced. Flow flips defense the moment gold turns net-outward; backing gates the printing press. Two levers, two speeds — and issuance answers only to the second.

One charter, ten branches

A charter is a soulbound NFT: the license to operate a bank and receive issuance. It opens with one branch and grows to ten. Each branch is one equal share of every epoch's issue, credited to a ledger balance at each epoch tick — a new branch earns from the next tick after it opens. Your yield is your branches divided by total branches; more seats divide the pie, they never grow it.

Genesis: 300 founding charters, one per wallet, first branch included. Up to 60 (20%) may be pre-allocated to the founder before public claim opens; the remaining ≥240 are a free public claim — which the contract force-opens by itself one day after launch if it is not opened sooner. There is no sale — the claim is the launch. When they are gone, the only door in is the daily charter auction.

A charter lives until its last branch is retired, at which point it burns. There are no revolving doors — the only way back is a new charter at auction. Charters are soulbound at launch; a one-way switch can enable seat sales later, so a whole bank can change hands with zero sell pressure on $HAVEN.

Two daily falling-price sales, zero admin

Both sales run on one mechanism: a daily Dutch auction. The price opens high, decays to a floor over 24 hours, and purchases execute instantly at the current price, first come first served. No bids, no escrow, nothing to snipe. Every floor is computed from live protocol state; every schedule is hardcoded — no lever to find.

A bank run, inverted

Issuance accrues to a charter's balance continuously. To take profit, a banker retires a branch: its pro-rata share of the balance mints to their wallet, minus the resolution fee, and the vehicle is gone for good. You cannot extract value and keep the branch that produced it. Retiring the last branch dissolves the charter.

The resolution fee is congestion pricing at the exit door — a quadratic curve from a 2% floor to a 25% ceiling, driven by system-wide exit pressure over a trailing 7-day window. It saturates when roughly a third of the bank tries to leave in a week.

This inverts the payoff of a bank run. Heavy exit volume raises the fee on the exiters themselves, and half of what they pay flows to the positions that stayed. Mass exits transfer value from the impatient to the patient. Withdrawals are never paused or queued at any fee level — the cost of leaving is the only brake.

The fee tracks the whole bank's exit pressure over the trailing window, not your position's size, and every exit is priced including itself. So splitting a withdrawal across wallets or into many small exits cannot dodge the curve — every exit pours into the same shared window and lifts the rate the next one pays. Quiet, orderly exits stay near the floor; a stampede is dear by construction.

Gold, natively — and nothing else

Because HAVEN trades against gold, the bank's fee currency is gold. Every buy stacks the reserve with a hard asset — no conversion, no market order, no slippage, no counterparty. Each expansion epoch, 70% of that gold flows to the ReserveVault, where it stays — with exactly one way out, described below.

The reserve holds gold and only gold. This is not a policy choice that could later be reversed; it is a property of the bytecode. The ReserveVault has no owner, no admin, no withdraw, no sweep, no pause, no upgrade path, and no delegatecall. It can make exactly one kind of outbound move: when $HAVEN trades at least 2% below its gold backing floor, anyone may trigger a bounded buy-and-burn — the vault spends ≤2% of its gold per call, at most once every five minutes, at a price the code forces to land under the floor, to buy $HAVEN in the protocol's own pool and destroy it. No wei of gold ever reaches a human — including the author. It leaves only as burned $HAVEN, which lifts the very floor it defends.

An earlier design rotated a bounded slice of the reserve into silver and semiconductors. It was deliberately removed before launch. Diversification was upside, but it was also the only code in the system that could move reserve assets, and it dragged in dependencies on outside pools — routing, slippage, oracle surface, dead-pool risk. Cutting it deleted that entire attack surface. A gold-denominated bank whose reserve is 100 % gold is both the simpler contract and the more honest claim: reserves() reports 10000 bps gold — not a target, an invariant.

Nothing here is discretionary. The fee split (70/10/20) is a routing constant sealed at launch. No human chooses what the reserve holds, when, or how much; the 20% development share is a fixed tax on flow, not a lever over policy, supply, or the vault.

Two standing bids beneath the floor

The reserve itself is a bid at the floor. HAVEN's backing floor is the gold each token can claim in reserve — gold held ÷ supply. Whenever spot sits at least 2% under it, anyone may call defend(): the ReserveVault spends a bounded slice of its gold — ≤2% per call, once every five minutes — to buy $HAVEN in the protocol's own pool and burn it. Permissionless, with nothing to drain: each wei of gold returns as burned $HAVEN.

The defense cannot backfire, and that is arithmetic rather than assurance. Spending g gold to burn h tokens moves the floor from G/S to (G−g)/(S−h), which is higher precisely when g/h < G/S — when the average price paid lands under the floor. So the contract prices its minimum fill off the floor itself, not off spot: it demands at least the $HAVEN that floor-price buys, or the swap reverts and no gold moves. The average paid is therefore ≤ the floor by construction, and the floor can only ratchet up. A thin or manipulated book cannot turn a defense into a leak; it can only stop it from firing.

The second bid is the contraction vault. When gold turns net-outward, the fee stream flips to BidWall. Rather than firing telegraphed market buys anyone can sandwich, BidWall parks that gold as standing bids just below spot — real pool depth the instant it lands. When price falls into them, the HAVEN they catch is burned. Defense becomes book depth first and a buy second; there is nothing to front-run.

Separately, 10% of all gold flow always compounds protocol-owned liquidity — half swapped to HAVEN, paired, and added to a full-range position that only ever grows. It is a floor of exit liquidity no one can pull.

None of this makes HAVEN immune to reflexivity — no reserve-backed asset is. What it changes is the floor: because the reserve is exogenous gold accrued at zero conversion, the POL is locked and un-pullable, and every sell burns supply, a loss of confidence converges price toward the growing gold floor rather than toward zero. That floor is only as deep as the reserve accumulated so far — the risk is front-loaded, largest just after launch and thinning with every epoch of fees. It is a bound on the downside, not its abolition.

Furlough, not confiscation

A charter idle for 45 days can be furloughed by anyone: its branches simply stop accruing, and its share flows to the active banks. Yield earned up to the furlough moment is checkpointed and stays fully claimable — only future issuance is redistributed: the same daily emission now divides among fewer branches, so every active banker's rate rises. Principal is never seized; reactivation is free and simply rejoins at the current rate with no back-pay; and a zero-cost check-in exists for bankers who just want to hold. Lost keys and abandoned wallets stop diluting the active; nobody is robbed.

The float gets scarcer while the balance sheet gets harder

Written in the code, not the whim

HAVEN is an experimental, immutable on-chain protocol. It is not a bank, holds no customer funds, offers no accounts, and is not a regulated financial institution of any kind. It has no owner, no admin, no pause, and no upgrade path. Nothing here is investment advice. Tokens can lose value, including all of it. Participate at your own risk.