In 1873 a journalist named Walter Bagehot published a book called Lombard Street. It is a slim, dry, deeply unromantic accounting of how the Bank of England actually behaved during the financial crises of the nineteenth century. The line that matters runs four words long: lend freely, at a penalty rate, against good collateral. Bagehot wrote it as a description, not a prescription. Central banks had been doing the move for decades before he named it. He just had the discipline to write down what worked.
That sentence is the entire reason functioning monetary systems function. Every currency that lasts more than a generation has some version of it baked in. Every currency that doesn’t, doesn’t.
When I served at the FDIC I watched the corollary at work. Banks under stress did not want graduated intervention. They wanted a circuit breaker — a hard stop, an injection, a rescue, a clean switch flipped. That is not what a regulator gives a bank under stress. What a regulator gives a bank under stress is the next step on a known ladder: capital action, asset action, supervisory action, receivership. The order is published. The trigger conditions are published. The commitment to walk down the ladder is the entire game.
You can disagree with which rungs are on the ladder. You cannot remove the ladder.
This post is about why every decentralized stablecoin to date has been built without one, and what it costs to build one back in.
What’s on the table
- Terra / UST: peak supply ~
$18.7B, collapsed to ~$0in roughly seven days, May 2022 - DAI on Black Thursday: March 12, 2020 — keeper auctions cleared at zero, ~
$8Mof bad debt entered the system from oracle latency and gas spikes - USDC during the SVB weekend: March 10–13, 2023 — depegged to ~
$0.87on news that ~$3.3Bof reserves were held at a failing bank - Bagehot’s principle: lend freely, at a penalty rate, against good collateral. Lombard Street, Henry S. King, 1873
- The L1 I’ve been building: a five-layer graduated stability regime with one cap that matters and one waterfall that matters
- The cap:
15%of collateral may come from the protocol’s own token. The number is the entire ballgame - The proof: in the worst case, where the protocol’s own token goes to zero AND every other piece of exogenous collateral loses fifty percent of its value at the same time, maximum dilution is bounded at
43.75%. Bounded. Convergent. Survivable.
The problem
Every stablecoin failure that mattered was a failure of escalation, not a failure of code.
Terra was the most spectacular and the most instructive. The stability mechanism was a one-step move: if UST traded below a dollar, you could burn it for a dollar of LUNA. The mechanism was elegant and proved through quiet markets. It had no second step. When the trade got large, the dollar of LUNA became a dollar of LUNA-falling, then a dollar of LUNA-collapsing, then a dollar of nothing. There was no rung two. Anchor’s yield exit accelerated the run. The system did not have a ladder. It had a ramp.
DAI’s near-failure on Black Thursday was a different shape and the same lesson. Maker had a single auction mechanism for liquidating undercollateralized vaults. It worked when the network worked. Under network stress — gas spikes, oracle delays, keepers offline — auctions cleared at zero and the protocol absorbed the loss. The mechanism was correct in steady state. It had no escalation in the state where steady state had broken. The recovery was a hand-built MKR auction stitched together over weeks. That was a rescue. That was Bagehot in the breach. The thing the protocol was missing wasn’t intelligence. It was a written next move.
USDC’s SVB weekend was the most polite of the three. The peg recovered. Circle made depositors whole. The asset that matters never zeroed. But the depeg — three days at eighty-seven cents — happened because the system had no advertised escalation between full backing in cash equivalents and waiting for the FDIC to figure out who gets what. The market priced the gap. The market always prices the gap.
The pattern is the same in all three cases. The mechanism worked at the design point. It had no second mechanism. It had no third. Stability was treated as a state to be maintained, with one circuit breaker for when the state was lost. That is not how a currency stays a currency. That is how a currency wins on quiet days and loses on the day that matters.
Here’s the part I want you to read precisely.
A monetary system is not credible because of the mechanism it operates in steady state. It is credible because of the mechanisms it has committed to deploy as conditions deteriorate. The commitment is the credibility. The mechanism is the implementation of the commitment.
Bagehot is one sentence about three rungs of a ladder. Modern central banks operate ladders with a dozen rungs each. Their credibility comes from the public knowledge that the ladder exists, that the trigger conditions are written down, and that the ladder cannot be removed by anyone in the room when the room is on fire.
Every decentralized stablecoin to date has shipped without that ladder. They have shipped a circuit breaker, dressed up as a mechanism, with a marketing line that called it innovation. Innovation is the wrong word. Stability is the oldest unsolved problem in money. It does not yield to clever code. It yields to credible commitment.
The decision
The L1 I’ve been building has a five-layer escalation regime. I’ll walk it once. Each layer is a rung of a ladder. The ladder is published, immutable, and the trigger conditions live in code.
Layer 1 — Over-collateralization. Every unit of the dollar-pegged asset is backed by at least 150% exogenous collateral at issuance. This is the steady-state buffer. Maker did this. It works.
Layer 2 — Algorithmic adjustment. When the peg deviates beyond a threshold, the protocol begins automatic operations: bond issuance to soak up supply, reserve deployment to defend the peg, fee adjustments. The point is not that any single tool is decisive. The point is that the move is automatic, sized, and visible.
Layer 3 — Emergency facilities. If Layer 2 doesn’t restore the peg, the protocol elevates required collateral ratios on new issuance and offers fee incentives for users to redeem out of the system. This is Bagehot literally — penalty rate, good collateral. It widens the spread until the trade becomes attractive enough to clear.
Layer 4 — Dilutive backstop. If the peg is still under threat, the protocol mints and sells the protocol’s own token (SZK, in the L1 I’ll name in the next post) into a market-clearing auction, with proceeds purchasing the dollar-pegged asset to defend the peg. This is the rung that ate Terra. The difference is in two parameters and one proof.
Layer 5 — Resolution waterfall. If the system cannot defend the peg even with dilution, the priority order for loss absorption is immutable: the dollar-pegged asset is made whole first, the bond instrument absorbs second, the protocol token absorbs last. The order is in code. It cannot be changed by governance during a crisis. The next post is about why.
The whole thing only works because of two parameters and one proof.
The first parameter: the protocol’s own token is capped at 15% of total collateral. It is the rung that exists, with a ceiling. Terra’s design had no ceiling — UST was effectively backed by LUNA without limit, and LUNA’s value was supported by the demand for UST. That is a circle, not a ladder. A ceiling on self-collateralization breaks the circle.
The second parameter: the minimum collateral ratio is enforced at a hard floor of 130% and that floor cannot be lowered by governance. Not voted down. Not adjusted under stress. The floor is in code, the same as the waterfall is in code.
The proof: under the worst joint scenario this design admits — the protocol’s own token goes to zero, every other piece of exogenous collateral loses fifty percent of its value, and the dilution mechanism runs to its bounded limit — the maximum deficit relative to outstanding supply is 43.75%. Bounded. Convergent. The math is in chapter four of the cookbook.
Forty-three percent is bad. Bounded forty-three percent is survivable. Unbounded death-spiral is not. The difference between a number with a ceiling and a number with no ceiling is the difference between a haircut and a collapse. It is also the difference between something a central bank could underwrite and something no serious institution will go near.
This is the entire ballgame. The number is 15%. The proof is the proof. Without them you have a ramp. With them you have a ladder.
What this looks like under the post-quantum decision
Earlier in this series I argued the architecture treats post-quantum resilience as a property of the whole stack. The ladder is part of the stack. Every signature that triggers an escalation — every governance call that adjusts a parameter, every oracle update that crosses a threshold, every auction transaction that mints SZK — is itself a cryptographic commitment. If those primitives can be forged after Q-Day, the ladder becomes a vector. The defender’s escalation machinery becomes the attacker’s escalation machinery.
This is why post-quantum migration cannot be deferred for a stability protocol the way it can sometimes be deferred for a payments protocol. Payments fail per-transaction. Stability fails per-system. A single forged escalation against a stability ladder is not a transaction loss. It is a peg loss. Nothing about that recovers.
The cookbook chapter on cryptographic primitives covers which signature schemes are load-bearing for escalation transactions specifically and which are along for the ride. The migration path is staged so that the escalation surface gets PQ first.
What this isn’t
This is not a claim that the design is perfect. There are open problems I argue with myself about, and one is Layer 4 reflexivity. The fifteen-percent cap closes the Terra loop. It does not eliminate every reflexive dynamic. In a sufficiently brittle market, dilution at the cap may still feed back into protocol-token price in ways the model can’t fully bound a priori. The cookbook spells out where the model holds and where it relies on assumptions that have to be tested in production. I am not pretending the math is the world. The math is a constraint on how badly the world can behave.
It is also not a claim that this is the only design that works. Bagehot’s principle is older than blockchains and more general than any specific implementation. There are other ladders that would also satisfy it. This is the one I built because it is the one I think survives the constraints I care about — post-quantum durability, regulatory perimeter, MEV-free ordering, and central-bank adoptability without becoming a CBDC.
The last constraint is worth a sentence on its own. A monetary system that wants a central bank to credibly back it without becoming a CBDC has to operate the ladder a central bank already operates, in a form a central bank can underwrite. The ladder isn’t there to look like a central bank. It’s there to be one a central bank could use.
Closer
I’m not selling a token in this series. The protocol’s own token exists in the design — it has to, or the dilutive backstop has nothing to dilute — but no allocation is being raised against the run of these posts. If that changes I will tell you in plain text in the post where it changes, before the rest of the post.
Pick a recipe. If you operate a stablecoin and your stability section is one paragraph long, your stability mechanism is probably one rung of a ladder. Find your second rung. Write down its trigger condition. Publish it. If you can’t, you have a circuit breaker, not a system. There is a difference, and the market knows.
Bagehot was right.
Originally published on Sultan Meghji’s Substack (May 12, 2026). Sultan Meghji is the founder of Virtova, the inaugural Chief Innovation Officer of the U.S. FDIC, and a Fellow at the George Mason University National Security Institute.