00 · The instrument
U + A ≡ B + L + E
∫ log z dz = z log z − z
Autonomous smart-contract driven balance-sheet operations that separate the transactional utility of a liquid stablecoin from its risk-bearing capital.
CapStone is Tokenisys's licensable balance-sheet architecture for issuing stable-value instruments with a structurally separated risk market.
Stablecoin structures typically sit between two familiar models. A fully reserved coin preserves straightforward backing, but the return on the Reserve generally accrues to the issuer. A yield-bearing coin can pass economic return to holders, but may also pass through the investment exposure used to generate that return.
CapStone separates these functions. The liquid instrument is designed for transactional use and senior-secured ranking. Risk-seeking capital is expressed separately through dated Bond positions and Bondholder driven monetary expansion. This bifurcation ensures a clean delivery of the utility function required by token holders.
Risk is treated as an asset that somebody should deliberately buy. The party choosing to carry that risk is distinct from the party using the liquid instrument as money.
Stablecoin holders' rights are rarely stated with precision. Their claim on assets remains subject to legal interpretation, resolved after the fact rather than defined in advance.
CapStone establishes a clear ranking of claims on the Reserve and on risk assets, with security and distribution processes encoded rather than described.
The ranking, encoded
Claims on assets and rights to distributions are encoded, tamper-proof and fully immutable.
In most stablecoins, redemption at parity is a promise rather than an obligation, because liquidity against an invested Reserve is limited.
CapStone keeps the balance sheet permanently visible and provides a partial tender mechanism alongside full liquidation for returning Reserve assets to liquid holders at parity. The purpose is to maintain balance-sheet efficiency, not to guarantee parity to Reserve price.
Returning Reserve at parity
An expansionary-only balance sheet needs a mechanism to contract. The quantum of contraction is variable, but the price is always parity.
kUSD is the first reference configuration: a dollar-denominated instrument in which liquid kUSD is the senior, spendable claim, while investors who actively choose risk hold dated Bond positions beneath it.
CapStone and kUSD are related but not interchangeable terms. CapStone is the underlying architecture; kUSD is the first instrument and reference configuration built on it.
The reference configuration
A licensee can adopt the CapStone model while configuring the product around its own market, Reserve, governance and regulatory requirements.
Open the kUSD testnet console — The reference implementation running live on Base Sepolia. Alpha, and a compressed calendar: caveat utilitator.
U + A ≡ B + L + E
Assets
Claims · senior first
Valuation. Reserve value accrues from instrument terms and time. Risky quantities are measured from custody the model itself controls; only values are marked.
Custody. It is not outsourced. Strategy providers direct allocation within a mandate; appointment confers trading discretion, not possession.
Stage one · risk is specifically purchased
Stage two · supply expands
The Reserve is not spent to create the risk portfolio.
Risk-bearing assets are created only when investors have first committed capital to carry that risk. Every Bond staked creates 50% new deployed assets, so expansion is bounded by investor risk appetite rather than issuer discretion.
Forty quarterly maturities run to ten years and positions are transferable, so exit runs through a secondary market. Entry is priced against the state of the balance sheet: as risky capital rises against the Reserve, price rises with it and the premium stays in the Reserve as buffer.
Loss waterfall
Profit waterfall
Hazard is the price of balance-sheet capacity. It accrues daily against the Bond book and is credited to liquid holders, formulaic rather than negotiated: more risk relative to the Reserve raises the rate, longer duration lowers it. Bondholders recover Hazard paid through the Hurdle at 2x.
Absorbed losses become preferential recovery claims on later profit, decaying 50% each cycle. Equity distribution is gated by a minimum capital threshold set before the outcome is known, so Equity cannot defer a senior obligation and extract capital in the same window.
Day 0 – 90
Accrual. Reserve and Hazard accrue, no settlement.
Day 91
24h settlement window
Inside the window, in order
The sequence is deliberate. Bondholders commit only after the book has been valued and the period's economics attributed.
◇ Base Chain (Solidity)
Public and permissionless
The balance sheet is publicly readable and ordinary lifecycle actions can be performed without relying on a privileged operator for liveness. Open verification, composable with public liquidity, no operator dependency for settlement.
◈ Canton Network (DAML)
Confidential and institutional
Participant positions stay private to the relevant parties while product rules remain common. Valuation can use two-party attestation, which matters where a regulated issuer requires stronger separation of duties.
CapStone distinguishes quantities measured from system state from those requiring an authorised assertion. Ledger primaries are written solely through admitted accounting flows, so managers can allocate and trade without the power to write arbitrary accounting values.
What a licence gives you
Invariant throughout: the conserved balance-sheet model, separation of senior claims from risk-bearing capital, the admitted accounting-flow discipline, the economic ordering of claims, and the distinction between measured state and authorised assertions.
Configuration axes
Is the liquid token redeemable?
There is no redemption mechanism into USDC during the normal course of business. The Reserve is backing, not a redemption window. Convertibility is a configuration axis: a licensee may specify redemption functionality separately.
What stops a manager marking its way out of a loss?
Quantities are measured from custody the model itself controls; only values are asserted, through the valuation process. Managers can be authorised to allocate and trade without being given the power to write arbitrary accounting values into the ledger.
Can Equity withdraw ahead of a bad cycle?
No. The minimum capital threshold is fixed at the start of each cycle, before the outcome is known, and Equity cannot defer a senior obligation in a cycle and simultaneously extract its own capital.
What happens in a wind-down?
A specified terminal path rather than mechanics designed during a crisis. Triggers are voluntary liquidation by Equity, events of default, or a partial tender always at par. The Reserve is applied through the seniority order, the risky portfolio goes to auction-based price discovery rather than going-concern marks, Bond positions stay transferable and Equity ranks last.
Does it have to be a dollar?
No. The model is denominated in a unit of account. A separate instance can be configured around another denomination, with its own Reserve, allowlists, bond market and governance. Instances stay economically separate: each maintains and closes its own balance sheet.
What verification exists?
Tokenisys has completed the proof programme for the CapStone architecture. Verification materials, formal specifications and conformance evidence can be made available to licensees and their auditors under the applicable licensing and confidentiality arrangements.
Tell us what you intend to issue and where. We will send the licensee overview and arrange a technical session.