The return to the gold standard.

Introduction

$WOOD is a reserve-backed currency governed by a single issuance constraint: no unit is ever sold below the reserves behind it.

The backing is blended from exactly three assets: bitcoin, tokenized gold, and protocol-owned liquidity for $WOOD, meaning LP positions the treasury holds itself. The first two are scarce stores of value; the third gives the protocol trading depth it owns outright. Any liquid asset can be added as a bondable asset over time.

Supply enters four ways: a public bonding event at parity, capped per wallet, Dutch auctions floored above backing, staking rewards, and team options struck at backing itself. Auctions raise backing with every fill, while the bonding event and options settle exactly at it, never below. Rewards are the exception, and section 09 puts a budget on them.

Section 02 sets out the arithmetic of how the last backed system ended.

This system puts the constraint where a contract can hold it: at issuance. A contract verifies it on every sale; no operator applies a policy.

What broke in 1971

Bretton Woods is a village in New Hampshire. In July 1944, with the war still running, the Allied nations met there to design the monetary order that would follow it. The system signed in that room fixed the world's currencies to the dollar and the dollar to gold, created the IMF and the World Bank to police the arrangement, and governed global money for the next twenty-seven years. This protocol takes its name, and its lesson, from how that system ended.

Forty-four nations, the Mount Washington Hotel, July 1944. Keynes proposed a supranational unit called bancor, with creditors and debtors both pressed to correct. White proposed a simpler arrangement, more favorable to the United States, which then held the majority of the world's official gold.

White's proposal prevailed. The agreement fixed the dollar to gold at thirty-five dollars an ounce and every other currency to the dollar, leaving convertibility alive at exactly one window: foreign central banks, presenting dollars to the United States Treasury.

It held for two decades. Then the arithmetic caught up.

The coverage identity

Let R be the gold reserve in ounces, S the outstanding dollar claims, and p̄ the price fixed in advance. Coverage is the fraction of claims the gold on hand can actually honor:

Robert Triffin named it in 1960. Supplying the world with dollars meant running deficits, so S grew by design. Geology set R. Treaty fixed p̄. Two of the three terms moved against the third.

American gold fell from nearly twenty-two thousand tonnes in 1949 to about nine thousand by 1971. Foreign claims grew to several times what that covered at thirty-five dollars. Convertibility stayed legal long after it stopped being possible.

Everyone who ran the numbers understood the imbalance. France converted steadily through the sixties and shipped the metal home; the London Gold Pool spent itself defending the price and collapsed in 1968.

On a Sunday evening in August 1971, from Camp David, Nixon suspended convertibility and called the measure temporary. It stayed suspended.

The United States did not exhaust its gold. It still holds the largest official reserve in the world. What failed was the ratio between claims and reserves.

Most read the episode as proof that money needs backing. The record says something narrower: the redemption promise failed first, and the government cut the anchor loose to protect the reserve.

The defect was not convertibility itself. It was the fixed redemption price p̄.

Who does what

Six parts make up the system: a token, the treasury, operations, an auction, a callback, and a staking vault.

Traders and holders. No permission is needed to hold, transfer, stake, or buy from a funded auction.

Treasury to channels. Minting happens for exactly four reasons: auction inventory, the bonding event, a reward epoch, an option exercise (section 10). Every mint is published.

Channels to reserve. Event payment and auction proceeds land in the treasury and the callback.

The reserve

The backing is blended, and the blend is fixed at three assets: wrapped bitcoin, tokenized gold, and protocol-owned liquidity, meaning LP positions for $WOOD pools that the treasury owns itself rather than rents from mercenary providers. Bonding is broader, since the treasury can configure any liquid asset as bondable over time. There is no target composition and no rebalancing mandate.

Net asset value

We compute NAV off chain and publish it. The definition never moves, so nobody can improve the number by redefining it.

Staked $WOOD stays circulating. The staker still owns it, as shares.

Each subtraction removes supply that exists but has never been sold. Counting it would overstate the float and let the protocol sell too cheap. The definition only ever errs toward a higher floor.

Prices come from Chainlink on Ethereum for gold and bitcoin, cross-checked against the local bitcoin feed. LP positions are valued from the pool's reserves at those same prices, counting only the non-$WOOD side. The $WOOD portion is worth zero to NAV, so the reserve never counts its own token as backing. The system rejects any price older than the feed's maximum update interval plus fifteen minutes.

Every reserve asset must match what the canonical bridge reports before the treasury accepts it.

Accretion

Four lines of algebra carry the whole design.

Sell Δs new units at price p, denominated in reserve units per token. Reserve and supply both move:

Subtract the old backing and the result collapses:

Numerator: S(R + pΔs) − R(S + Δs) = Δs(pS − R) = Δs S (p − b). Divide through by S(S+Δs).

Both Δs (units sold) and S + Δs (supply after the sale) are positive, so the sign of the whole expression is the sign of one bracket:

Issuance raises backing per unit if and only if it is priced above backing per unit. There is no third case.

That is the entire policy. Set the auction floor above b (backing per unit) and every fill raises backing by construction. With a margin μ (the floor's premium over backing):

The bonding event runs at p = b₀, price exactly equal to backing, so it is neutral. Strictly it is the starting condition and not a use of the rule: before it, (4.1) divides by zero. Emissions run at p = 0, section 09. Team options exercise at p = b, section 10: neutral, like the event.

Additional accretion channels

The auction is the first accretion channel, not the last. Additional channels are planned, each taking value in above backing and passing it to the reserve, so that backing per unit compounds from more than one source.

Whatever form they take, each must satisfy (5.3) before it ships. A mechanism that cannot prove p > b, a price above backing, at the door does not become a channel.

Issuance

Only the treasury can mint. That authority is fixed the moment the token is created, so no deployer or intermediary ever holds it.

There is no supply cap.

Bond markets

Bond markets are the principal issuance channel: a sequential Dutch auction run by Bond Protocol v1.0.0, a release audited by Sherlock and Zellic.

Price opens above the floor, decays while nobody buys, jumps on each fill, and re-tunes at intervals. The market cannot transact below the floor at any point.

Vesting: 24 to 48 hours

Payouts vest on a two-day term. Bond Protocol sets every expiry to midnight UTC, rounding down, so the actual wait depends on when in the day you buy: anywhere from 24 hours to 48. Every buyer receives the same bond token. The guaranteed minimum is 24 hours, and that is the number to plan around.

Vesting does structural work. The reserve gets paid on day zero; the supply arrives a day or two later. A bond buyer cannot sell into the auction that issued them.

Custody moves while a bond vests. The payout sits in the teller, not the callback, until the holder redeems it. Nobody else has a path to that balance.

The bonding event

The bonding event is one public round at a fixed price of 0.10 USDG per $WOOD, open to anyone with a wallet and no allowlist to clear. The window is open for six hours. Each address can spend up to 2,000 USDG across as many transactions as it likes, buying until the clock runs out, the inventory runs out or the treasury closes the event early. Once closed, it stays closed.

A buy settles in three lines: the payment y fixes how many tokens you get, the cap checks that your running total stays under 2,000 USDG, and the vault converts the tokens into shares at whatever rate holds in that block:

What lands in your wallet is $sWOOD. The tokens you buy go straight from the treasury into the staking vault within the same transaction, so you are a staker from the block you bought in and rewards vest into your shares from the first epoch. Nothing is locked. Leaving means the same one-day cooldown every other staker faces, section 09.

The first price

Every later issuance is measured against a backing figure that already exists. The bonding event has nothing to measure against. Circulating supply is zero, so (4.1) has no value and (5.3) has nothing to compare.

Any b₀ (the starting backing per unit) is internally consistent. The treasury picks it, the round fixes it, and everything in section 05 is measured from there.

Payment passes directly to the treasury and tokens come directly from it. The event contract checks the cap; it never holds funds.

Terms are immutable. Price, window and cap are fixed in the contract and cannot be changed by the treasury.

The cap follows the caller, who is always the receiver. Nobody can spend another address's allowance. Nobody can be handed tokens they did not buy.

Treasury controls. The treasury can pause new purchases or close the event permanently. Earlier purchases remain valid.

Staking and emissions

Staking is a share vault. Put $WOOD in and the vault hands back $sWOOD, its share token: the receipt for your stake. Each epoch the treasury mints a reward to Ops, Ops pushes it into the vault, and the vault vests it into the share price over one day. There is no claim button. Rewards show up as each share buying more $WOOD than it did yesterday, and you collect them by leaving.

The vault is a fork of Ethena's sUSDe contract. The only change is vesting, lengthened from eight hours to a day.

Nothing in the vault can stream principal. The reward function pulls R (the epoch's reward) from Ops and vests exactly that; it never streams from its own balance, so the accounting trap that haunts single-asset pools does not exist here. Ops is fee-exempt by construction, which is what makes the amount promised equal the amount delivered.

The emission budget

Rewards are the one channel priced below backing, so a budget binds them. Over a reward period with auction sales Δs (units sold) at price p and emissions Δm (units streamed to stakers), backing keeps rising when

From b′ ≥ b (backing after the period at least backing before) with S′ = S + Δs + Δm: Δs(p − b) ≥ b Δm.

Emissions per reward period may not exceed the auction premium, measured in units sold times the fraction by which they cleared above backing.

Swap fees, section 10, sit outside this budget entirely. They mint nothing, and the reserve share only raises R (the reserve).

The cooldown

Leaving takes one day. Start a withdrawal and your position enters cooldown. A day later, withdraw your WOOD. An exit already queued keeps the timer it started with, whatever the treasury does to the setting afterward.

The treasury controls the cooldown duration. If it sets it to zero, the vault behaves like a standard ERC-4626: withdraw and redeem work immediately, and anyone already waiting can leave at once.

There is no pause. A holder always has a way out.

The token and the fee

A standard, battle-tested ERC-20 with one addition: swaps through registered pools pay a 5% fee. Most of it buys reserves; the rest funds the team.

The condition is the presence of a pair, not the identity of a counterparty. Wallet transfers, mints, burns, staking, bonds and the bonding event carry no fee, and none of them needs an individual exemption.

One rule is absolute: no system contract is ever registered as a pair, so staking, bond purchases and the bonding event always settle in full.

The vault and its silo are neither pair nor exempt. Both take a receiver address, so an exemption would be an untaxed sell straight into a pool. Ops, which funds rewards, is exempt, and that is the exemption that lets every epoch arrive whole.

Where the fee goes

The fee splits two ways. 80% buys reserve assets for the treasury: gold, bitcoin, and liquidity the protocol owns outright. The remaining 20% funds the team, operations and growth.

The larger share works like an accretion channel of its own. Fee revenue is existing supply changing hands, not new units entering, so by (5.2) it moves neither Δs (units sold) nor Δm (units emitted); every purchase it funds raises R (the reserve) against a fixed S (circulating supply), and backing per unit climbs.

Team options: pWOOD

One more instrument pays the team: pWOOD, an option token in the pOHM tradition with two corrections: a hard cap and automatic vesting.

The strike does the alignment work. Every exercise deposits b (the backing per unit) into the treasury for every unit minted, so backing per unit holds through exercise by construction; the option is worth exercising only when $WOOD trades above backing. The team earns nothing at the floor and everything above it, which is exactly the part the team is supposed to build.

Vesting is automatic. No cliff, no schedule to administer, no admin setter: one on-chain clock, the vested fraction v, opens the option gradually over the first 30 days.

v runs from 0 to 1 and stays there. At any moment, cumulative exercised $WOOD may not exceed v × 15% × circulating supply. Ten days in, the team can have exercised at most a third of its cap; at day 30 the full 15% is open. The contract enforces the bound on every exercise, so nothing can be front-loaded.

Circulating supply is defined conservatively, which keeps the cap small. It counts staked units and units in pools, and excludes everything the protocol holds or escrows. If holders cannot sell it today, it does not count.

Custody and authority

The auction teller's protocol fee is fixed at zero and its sink is the treasury, not Ops, because any fee it took would come out of the quote asset, and quote proceeds belong to the treasury.

Immediate execution

Treasury actions execute immediately, without a timelock. The treasury can stop new sales and recover unsold inventory and proceeds from the callback.

Stopping sales does not change existing holdings. Staking has no pause; holders can exit through the cooldown.

The specification

Deployed code

Disclaimer

Bretton Woods is an experiment. It takes no deposits and keeps no accounts. Nothing here is advice about what to buy.

$WOOD is not a deposit and has no pegged or guaranteed price. It relies on the custodians, issuers and infrastructure beneath it.

We promise the reserve, not a price.

Smart contracts