The first on-chain stage: a Solana program that mints GLU against the real basket and redeems it into the holder's coin of choice — with every thin or missing leg handled honestly instead of pretended away.
Companion to the design spec and methodology · chain selection research 2026-08-13 (Solana vs TON vs Robinhood Chain)
The mint's job is to buy the basket. That requires each leg to exist as a token, with liquidity or an issuer mint, plus FX oracles to price what's missing. Only Solana clears more than one leg.
| Requirement | Solana | TON | Robinhood Chain |
|---|---|---|---|
| USD stable | USDC ~$10B native | USDT $670M | USDG $353M |
| EUR stable | EURC native (top-2 chain) | none | ~2 tokens of dust |
| JPY stable | none credible (JPYC not yet deployed) | none | none |
| GBP stable | VGBP (thin, issuer-mintable) | none | none |
| CHF stable | CHFAU ~CHF 50M (Aug 2026) | none | none |
| Gold / treasuries / TIPS | PAXG+XAUt0 · USDY $740M · TIPon | XAUt0 ($230k depth) | tokens exist, no liquidity |
| FX oracles | Pyth EUR/JPY/GBP/CHF/XAU | feeds exist, assets don't | zero FX feeds |
| Verdict | 4 of 5 legs buyable today | 1 of 5 | 1 of 5 |
V1 mints the FX layer of GLU: a token backed by the five-currency basket in index weights, priced by the live index. It does not yet pay the CPI drip — that requires the yield sleeves (USDY / TIPon) of phase 2. The distinction is disclosed on the mint page, not buried.
40 USDC · 30 EURC-usd · 15 synthetic-JPY (held as USDC, valued via Pyth USD/JPY) · 10 VGBP-usd · 5 CHFAU-usd
Each leg carries a mode badge that the program enforces: DEX swapped on Jupiter at mint-time bands · INVENTORY pre-minted from the issuer, replenished in batches · SYNTHETIC no token exists; exposure is oracle-valued, collateral held in USDC and disclosed as unhedged.
| Leg | Weight | Token | Mode | Execution / notes |
|---|---|---|---|---|
| USD | 40% | USDC | DEX | stays as deposit currency, no swap needed |
| EUR | 30% | EURC | DEX | Jupiter route, max 30 bp slippage vs Pyth EUR/USD; Circle Mint as batch backstop |
| JPY | 15% | — (USDC held) | SYNTHETIC | valued via Pyth USD/JPY; swapped to real JPYC the day it deploys on Solana — registry slot is ready |
| GBP | 10% | VGBP | INVENTORY | program vault pre-stocked via VNX primary mint; mints pause the leg to synthetic if inventory runs dry |
| CHF | 5% | CHFAU | DEX → INVENTORY | DEX while the new pools hold; AllUnity primary mint as fallback |
| SOL rail | — | SOL | DEX | accepted for mint deposits and redemption payouts, swapped at the edge via Jupiter — never held as backing (70%/yr real volatility fails the same test as BTC in methodology §M3) |
The rule from the methodology page applies verbatim: disclose the lag, don't fake the leg. A synthetic-JPY slice valued by a real oracle is honest; a "JPY token" with $3k of liquidity is not.
Anchor program owning the GLU mint (Token-2022) and one vault ATA per leg. Enforces NAV bands, fee, caps, staleness and drift checks. Holds no admin power over user funds beyond the published rules.
The glu-index server (glu.booga.me) gains a poster keypair and writes W(t) + the 30-day forward drip into a NavState PDA daily. On-chain checks cap NAV movement at 5 bp/day vs the posted path — a stolen poster key cannot rug the NAV.
A cron bot (same Fly box) that tops up VGBP/CHFAU inventory, executes Jupiter rebalances back to target weights when drift > 1pp, and reports vault composition to the dashboard's audit table.
Client fetches NavState → price = NAV × (1 + fee). Fee 25 bp to the buffer. NAV staleness > 48h ⇒ mints halt (redeems never halt). Deposits in SOL are swapped to USDC via Jupiter in the same transaction before the deposit lands.
User transfers USDC; program mints GLU immediately at quoted NAV. No swaps in the user's transaction — deposits land in the USDC vault. Cheap, atomic, no slippage attribution problems.
Keeper sweeps USDC into EURC/CHFAU via Jupiter within its band, pulls VGBP from inventory, leaves the JPY slice in USDC. Vault drift vs target weights is public state.
User burns GLU; payout value = NAV × (1 − fee).
If the chosen coin (USDC / EURC / VGBP / CHFAU) sits in the vault in size: direct transfer at Pyth cross-rate. Always available: USDC. Payout in SOL is also offered — vault USDC is swapped to SOL via Jupiter at redemption time, within the same slippage band.
If the chosen leg's vault balance is short, the payout falls back to USDC automatically — and the quote says so before the user signs. Redemption is never gated, only re-denominated.
// account sketch
Config { admin, poster, fee_bp: 25, supply_cap, per_tx_cap, paused_mints }
NavState { nav_usd_e9, drip_bp_day_e2, posted_at, forward_path_hash }
Leg[5] { mint, weight_bp, mode: Dex|Inventory|Synthetic, pyth_feed, band_bp }
Vault { ata_usdc, ata_eurc, ata_vgbp, ata_chfau } // + buffer ATA
// instructions
init · post_nav · mint_glu · redeem_glu · rebalance(keeper) ·
set_leg(admin, timelocked) · pause_mints(admin) — no pause_redeems exists
| Risk | Guardrail |
|---|---|
| Poster key stolen → fake NAV | On-chain drift cap: NAV may move ≤ 5 bp/day from the previously posted path; larger moves need the timelocked admin path |
| Oracle staleness | NAV > 48h old: mints halt, redeems continue at last NAV − a widening haircut band |
| Thin-leg liquidity crunch (VGBP/CHFAU) | Legs flip to synthetic mode automatically; composition change is an on-chain event the dashboard surfaces |
| Depeg of a component stable | Pyth cross-checks each leg vs its FX rate; a leg trading > 150 bp off peg freezes that leg's payouts (USDC fallback) and stops keeper buys |
| Program bug drains vault | v1 caps: $50k supply, $2k per tx, upgrade authority behind a 48h timelock, then burned at phase 3 |
| Legal | This is the regulated object the spec's §7 describes. v1 ships devnet-first, then a capped mainnet pilot with a geo-notice; no yield is paid in v1 (currency basket only), which keeps it maximally distant from a security while still proving the machine |
| Stage | Ship | Proves |
|---|---|---|
| O-1 | Devnet program + mint page. Anchor program with mock legs (devnet SPL stand-ins), NAV posted from the real glu-index server, mint/redeem UI added to glu.booga.me behind a devnet banner | The full loop: index → posted NAV → mint → burn → payout choice |
| O-2 | Mainnet pilot, $50k cap. Real USDC/EURC/CHFAU legs, VGBP inventory, synthetic JPY, keeper live, vault composition in the dashboard audit table | Real-asset execution inside the slippage bands; the honest-legs design under real liquidity |
| O-3 | Phase 2 alignment. USDY/TIPon yield sleeves fund the CPI drip → v1 "currency GLU" upgrades toward true index GLU; JPYC leg activates when it lands on Solana | The purchasing-power guarantee, not just the FX basket |