Unwind and Peg Module

Unwinds close unsafe accounts by selling collateral and burning rwaUSD to extinguish liability.

Unsafe condition

An account is unsafe if:

• collateralValue < currentLiability * safetyFactor

Using risk-adjusted prices (haircut included) and freshness policy.

Who can trigger

Anyone can trigger an unwind. This is deliberate. The system does not depend on a privileged actor for solvency.

Unwind Engine (UnwindEngine)

Responsibilities

• verify unsafe condition via Ledger + PriceRouter

• freeze account operations

• determine amount of collateral to seize (enough to target full settlement + penalty, using conservative price)

• initiate auction(s)

Interfaces

function trigger(uint256 accountId, bytes32 profileId) external returns (uint256 auctionId);
function getStatus(uint256 accountId) external view returns (...);

Incentives for callers (keepers)

To avoid relying on altruism, add a keeper reward:

• fixed “call fee” paid from reserve buffer (bounded), and/or

• percentage of recovered value (capped)

Reward must be parameterized per profile and capped to prevent griefing.

---

Auction system

Auction House (AuctionHouse)

Sells seized collateral for rwaUSD (or for a reference stablecoin that is immediately converted and burned, implementation choice). Preferred mechanism here is descending-price sale with partial fills.Why:

• fast convergence

• simple keeper strategy

• handles volatile conditions better than thin order books

1. Auction parameters (per profile)

Stored in RiskRegistry:

• startPremium: multiplier on reference price at start (e.g., 1.05×)

• decayCurve: price decay function over time

• duration: max auction time

• lotSize: collateral per lot (or debt target per lot)

• minFill: minimum purchase size

• restartThreshold: if auction runs too long or price too low, allow restart

2. Auction lifecycle

1. Kick

   • Unwind Engine calls AuctionHouse.kick(...)

   • collateral is transferred from adapter to auction custody

   • auction state created:

     • collateralRemaining

     • debtTarget (liability + penalty)

     • startTime

     • startPrice

2. Take (purchase)

   • bidder calls take(auctionId, collateralAmtWanted, maxPrice)

   • contract computes current price

   • bidder pays cost = collateralAmtWanted * price

   • rwaUSD is transferred from bidder and burned via Ledger

   • collateral transferred to bidder

   • debt target reduced accordingly

3. Settle

   • if debt target is fully covered:

     • remaining collateral returned to original account owner (or kept to cover fees; policy)

     • Ledger marks the account cleared for that profile

   • if auction expires with remaining debt:

     • record deficit

     • resolve via buffer/recap

3. Restricted collateral holders (allowlists)

If a tokenized RWA requires allowlisted holders:

• Auction House must be an eligible holder

• Bidders must be eligible holders or

• Auction transfers a receipt/wrapper token representing claim on the collateral, redeemable through an eligible channel

v1 avoids “receipt complexity” unless unavoidable; it introduces a second custody layer.

---

Peg anchoring rails

A peg rail provides a deterministic conversion between rwaUSD and a reference stablecoin to tighten market price.

1. Peg Rail (PegRail)

Concept

• swap reference stablecoin ↔ rwaUSD near 1:1 with a fee spread

Functions

function swapIn(uint256 stableIn, address to) external returns (uint256 rwaUsdOut);
function swapOut(uint256 rwaUsdIn, address to) external returns (uint256 stableOut);

Rules

• swapIn mints rwaUSD and holds stable in reserves (or routes to buffer)

• swapOut burns rwaUSD and releases stable from reserves

Safeguards

• per-day outflow limits

• depeg breakers: if reference stable price < threshold, disable swapOut

• governance-controlled fee bands within caps

The peg rail is not a substitute for solvency. It is a market tool.