Design an Algorithmic Stablecoin

Problem statement

Design a stablecoin protocol that holds a $1.00 peg without holding fiat in a bank: when the market price prints above the band, the protocol expands supply; when it prints below, the protocol contracts supply or buys back tokens. The peg is therefore a control loop, not a redemption promise backed by cash. That single sentence contains the entire difficulty: the loop's sensor is an on-chain price oracle that attackers can bend, its actuator is token supply whose credibility depends on market belief, and its failure mode is reflexive — loss of confidence raises the very supply or discount that confirms the loss of confidence.

The system we design has four planes. The mechanism plane is the set of smart contracts: stablecoin token, epoch controller, bond registry (contraction coupons), share ledger (seigniorage claim), reserve vault (partial collateral backstop), and governance timelock. The oracle plane blends a decentralized exchange time-weighted average price (TWAP) with an independent oracle network feed, applies deviation and freshness guards, and fails closed by freezing expansions rather than minting into a manipulated print. The operations plane is off-chain: keeper fleets that execute epochs and auctions, an indexing pipeline that mirrors on-chain state into low-latency reads, a risk monitoring service that pages on peg deviation and reserve-ratio breach, and a treasury operations desk that rebalances the reserve. The governance plane changes parameters through a timelock with bounded guards and a pause guardian that can stop minting but never start it.

Why this is distinctive as a systems problem

A payments backend retries a failed write. A stablecoin cannot retry a mint: an erroneous expansion during a manipulated oracle print is irreversible and dilutes every holder. Correctness therefore dominates liveness in the mint path, which inverts the usual availability-first instinct. Conversely, the read path (peg dashboards, reserve attestations, holder balances) must stay available and honest during a bank run, precisely when traffic peaks at 10-20x baseline. The design must also survive its own success: expansions create holders whose exit becomes next quarter's contraction demand.

Public operating baseline versus design assumptions

Public history defines the hazard surface. Terra's UST peaked near an $18B market cap with roughly $17B deposited in Anchor at a fixed 19.46% APY before collapsing in May 2022, when UST traded near $0.65 and LUNA supply inflated from hundreds of millions to trillions of tokens within days. MakerDAO's DAI, collateral-backed but peg-managed through the Peg Stability Module, peaked above $10B supply and printed near $0.88 in March 2023 when its dominant reserve asset (USDC) itself depegged. Frax launched in December 2020 as fractional-algorithmic with an algorithmically adjusted collateral ratio and peaked near $1.6B supply before governance moved it to full collateralization. Ampleforth demonstrated that daily supply rebasing changes supply, not price. Ethena's USDe grew past $5B by packaging staked ETH with perpetual shorts, showing that a synthetic dollar's collateral can be a basis trade. These are cited public figures, not requirements for our fictional protocol.

For capacity planning this answer explicitly assumes a mid-size protocol: $500M target supply, 80,000 holders, 12,000 daily active addresses, hourly epochs, and a 10-20x stress multiplier during a depeg event. Unless tied to a citation, every number is a stated assumption, target, or budget.