# The Fund (Mechanism)

NET is a reserve-backed token mirroring the OlympusDAO v1 architecture —
Token, rebasing staked token, Treasury, BondDepository, Distributor — plus
five NetNet-specific contracts: TaxCollector, GenesisBond, InverseBond,
PremiumSeller, and pTEAM. This page covers the dividend engine: how new NET
is issued and distributed to the Shareholder Dividend Program (staking),
and how the standard Primary Offerings (bond sales) are priced.

## 1. The Shareholder Dividend Program (staking)

Shareholders stake NET and receive sNET, a rebasing token whose balance grows
every epoch. An **epoch is 8 hours** — three dividend distributions per day.
Each epoch, the Distributor mints new NET at the algorithmic rate below and
the staking contract rebases sNET so every staked balance grows
proportionally. The cumulative growth is tracked by the **dividend index
(rebase index)**, `sNET.index()`, which starts at 1.0 at launch and
compounds monotonically with each rebase — the "growth since launch" figure
in the shareholder terminal.

The rebase call is permissionless once an epoch has elapsed: anyone may turn
the crank; no one may adjust it.

## 2. The emissions formula (immutable at deploy)

There are **no owner functions anywhere on the emissions path**. Every
parameter below is immutable or constant in the Distributor. The dividend
rate is a pure function of the premium of market price over NAV (backing
per token — see [Treasury & NAV](/treasury); treasury-owned NET is valued
at its 1 USDG floor, never at market price):

```
P    = marketPrice / NAV                       // premium multiple
rate = R_MAX × clamp((P − 1) / (K − 1), 0, 1)
```

with:

| Constant | Value |
|---|---|
| `EPOCH_LENGTH` | 8 hours (3 rebases/day) |
| `R_MAX` | 0.45% per epoch |
| `K` | 1.75 |

In words:

* **At or below NAV (P ≤ 1.0): the dividend is zero.** The fund does not
  dilute holders when the market pays no premium.
* **At a 1.75× premium or higher (P ≥ K): the dividend runs at the full
  0.45% per epoch.**
* Between the two, the rate is linear in the premium.

### The price oracle: fail-closed by design

`marketPrice` is a TWAP from the canonical Uniswap v2 NET/USDG pair,
computed from cumulative-price observations — spot price is never used, and
the source pair cannot be changed by any admin. The observation design:

* `checkpoint()` is **permissionless** and stores the pair's cumulative
  price, with a minimum **30 minutes** between checkpoints.
* A TWAP read is valid only over a window **between 30 minutes and 4
  hours**. Outside that band, **every dependent operation reverts**: the
  Distributor skips the epoch (mints nothing), and the Buyback Program
  (inverse bonds) and PremiumSeller refuse to settle.
* **A stale oracle pauses minting and market operations** — the protocol
  never trades on an old price. Fund-run bots checkpoint hourly as a
  convenience; anyone can revive a stale oracle with one poke plus a
  30-minute wait.

## 3. Price → dividend rate → APY

The table below is the entire dividend policy. There is no other lever.
Rates compound per 8-hour epoch; daily = 3 epochs, APY = 1,095 epochs.

| Premium P (price ÷ NAV) | Rate per epoch | Daily | APY (theoretical max) |
|---|---|---|---|
| ≤ 1.00× | 0% | 0% | 0% |
| 1.10× | 0.060% | 0.180% | ~93% |
| 1.15× | 0.090% | 0.270% | ~168% |
| 1.24× (founding-offering premium) | 0.145% | 0.437% | ~391% |
| 1.375× (midpoint) | 0.225% | 0.677% | ~1,072% |
| 1.50× | 0.300% | 0.903% | ~2,558% |
| 1.60× | 0.360% | 1.084% | ~5,016% |
| ≥ 1.75× | 0.450% | 1.356% | ~13,552% |

> THE APY COLUMN IS ARITHMETIC, NOT A PROMISE. IT ASSUMES THE PREMIUM HOLDS
> CONSTANT FOR A FULL YEAR AND THAT THE RESERVE CAP (BELOW) NEVER BINDS.
> NEITHER ASSUMPTION SURVIVES CONTACT WITH MARKETS. APY COMPOUNDS IN NET
> UNITS; IT SAYS NOTHING ABOUT THE USDG PRICE OF NET.

Sanity bound: at the full rate, supply grows ≈ 1.356%/day ≈ ×1.5 per month
compounded. In practice the reserve cap binds long before the formula does
whenever the premium collapses.

## 4. The reserve cap (the floor under everything)

The Distributor cannot mint past reserves: if a mint would push
`totalSupply × 1 USDG` above the Treasury's risk-free value (RFV), the mint
reverts or clamps to the cap (the deployed behavior is documented in the
contracts' natspec). This enforces the fund's core invariant, on-chain,
every epoch:

> **Every NET is at all times backed by at least 1 USDG of risk-free
> value.**

Dividends are therefore self-limiting: emissions can never issue a share the
treasury cannot stand behind at the 1 USDG floor.

The invariant suite enforces a broader statement — **global accretion**: no
protocol operation may decrease NAV, with exactly two named structural
exceptions, both of the "dilutes the premium, never the floor" shape — the
Distributor epoch mint (bounded by the premium gate and the RFV cap) and
pTEAM exercise (bounded by its 15% float cap, with each exercise paying the
1 USDG floor into the treasury). Everything else — bonds, buybacks, premium
sales, fee conversion, Morpho rebalancing, the founding offering itself —
is weakly accretive, unconditionally.

## 5. Primary Offerings (bond sales): never below NAV

Post-genesis, the BondDepository sells NET for USDG or NET/USDG v2 LP
tokens under a pricing rule with no discretion in it:

```
price = max(TWAP × (1 − BOND_DISCOUNT_BPS), NAV)
```

* **The floor is NAV, not 1 USDG** — the depository never sells NET for
  less backing than it already has, so every bond sale is strictly
  accretive to NAV.
* Capacity is capped per epoch (`BOND_EPOCH_CAPACITY_BPS` of supply, fixed
  at deploy). No control variable, no debt-ratio controller, no policy
  levers.
* LP payments are valued by the same `2·sqrt(x·y)` convention as the
  Treasury's own POL — the NET leg at its 1 USDG floor, never at market.
* Together with the Buyback Program's standing bid at NAV − 1.5%
  ([Treasury & NAV](/treasury)), the protocol always quotes around NAV from
  both sides: it buys below, sells at or above.

## 6. Rebase accounting

sNET follows the OHM v1 gons model literally: total gons are fixed and each
rebase scales `gonsPerFragment` (`balance = gons / gonsPerFragment`), so all
staked balances grow pro-rata with no per-holder writes. Total sNET
fragments always equal staked NET — the NET ⇄ sNET peg is conserved by
construction, and the invariant test suite holds the protocol to it. There
is no wrapped (wsNET-style) token at launch; the index makes adding one
later trivial.

## 7. No operators required

Every operational entrypoint is **permissionless**: the oracle checkpoint,
the rebase, the Buyback Program (which is seller-initiated), the premium
seller's `execute()`, the fee conversion, and the treasury's Morpho
rebalance. Every precondition is enforced on-chain — if the formula says
no, the call reverts, regardless of who calls. **No allowlisted keeper
exists anywhere; the protocol has zero liveness dependency on the fund's
management.** Team-run bots poke these functions on schedule as a
convenience; anyone can run the same bots.

## 8. What management cannot do

For the avoidance of doubt, no admin, multisig, or "policy team" can
change: the epoch length, `R_MAX`, `K`, the TWAP source pair, the total
trading fee, the fee-split formula, the bond pricing rule, or the pTEAM
strike, cap, or vesting schedule. The only permissioned surface in the
entire protocol is the trading-fee pair mapping and whitelist — and it is
add-only, with no removal functions in code ([fee schedule](/FEES.HTM)).
The only way to change the dividend policy is to deploy a different fund.