Transparent SOST-side accumulation today. Tokenized gold reserve planned. Governed spending is not active. Every mined block allocates 25% of issuance to an on-chain Gold Vault by consensus. The design below — sale governance, an Ethereum custody vault, tokenized-gold rails — is the roadmap, not something running today.
Governance detail: the accumulation side is consensus-enforced. The spend side (gates G1–G5) is scaffolding + audit only, sentinel-disabled on mainnet. G3b (accumulated cap / rate-limit) is the current technical blocker before any activation. Full policy: GOLD_METALS_RESERVE_POLICY.md.
What has been called the "Gold Vault" is, more precisely, one Protocol Strategic Reserve — the SOST the protocol accumulates on-chain — with two clearly separated compartments. Everything below is planned / NOT ACTIVE. Nothing is partitioned, sold or moved today.
The split is a floor/ceiling policy, not a physical partition: gold ≥ 50%,
growth ≤ 50%. Reserve status today: LOCKED / NOT ACTIVE
— the spend path is disabled at the consensus level (activation height INT64_MAX),
not merely by policy.
GVOTE signal is a non-binding temperature check only.The mother rule: nothing leaves the reserve on a single key — not the founder, not a whale, not a simple majority alone. It leaves only with weighted holder approval + allowlisted destination + weekly cap + timelock + public registry + no guardian veto. Full policy: GOLD_METALS_RESERVE_POLICY.md.
SOST/PAXG and SOST/XAUT are not the vault. They are future OTC / Atomic-Swap conversion rails. The real reserve is the Ethereum Safe where the tokenized gold ends up. No public AMM at the start — first small, founder-controlled operations with a public record.
Ethereum mainnet is the initial choice for the Safe because of issuer nativeness (PAXG/XAUT are ERC-20 on mainnet), liquidity, and mature custody tooling. No single key should be able to move reserve assets. This vault does not exist yet. Technical design: Safe multisig design (Safe 3/5 + timelock + allowlist).
The Gold Reserve Forge converts a limited amount of the SOST Gold Vault balance into tokenized gold reserve assets (PAXG / XAUT), progressively and verifiably. It is a reserve-conversion framework — not a token sale. Settlement is atomic (a SOST↔PAXG/XAUT atomic swap), the gold leg lands directly in the Tokenized Gold Safe, and every operation is published as a Forge Proof. We are not selling SOST; we are forging a verifiable tokenized-gold reserve.
It does not mint new SOST. It does not create a claim on gold. It is not a peg. It is not a dividend, yield or investment return. It is planned / not active. A Founder Test is targeted no earlier than block 20,000, subject to Safe setup, legal review and internal approval; a limited mode may be considered no earlier than block 25,000, only if the founder test, legal review and registry process are successful; public participation remains future / legal-review dependent. None of these are commitments or guaranteed activation dates.
| Window | Forge #001 |
| Mode | Founder Test |
| Status | Planned / earliest target — NOT ACTIVE |
| Block | no earlier than 20,000 (subject to review) |
| Max amount | 100 SOST |
| Settlement | PAXG only (atomic swap) |
| Destination | Tokenized Gold Safe |
| Public participation | disabled |
Example only — no window is open, all figures are illustrative/planned (not commitments), nothing executes today.
Every completed conversion publishes a Forge Proof — an on-chain-verifiable record (the proof is the point, not a countdown): SOST txid · Ethereum txid · PAXG/XAUT amount · Safe address · timestamp · status.
Factual metrics only. This is not a peg, implies no backing guarantee, redemption right, or guaranteed value, and confers no claim on the reserve.
Optional public recognition only — a participant may choose to be acknowledged in the Protocol Registry. No financial rights, no priority profit, no claim on the reserve.
Not an investment return, claim on gold, equity, dividend, yield, or guaranteed profit; no gold-backed SOST; no new SOST minted. Full design: Gold Reserve Forge design.
| SOST txid | EVM txid | Token | Amount | Price/ref | Vault | New balance | Status |
|---|---|---|---|---|---|---|---|
| No tokenized-gold reserve operations have been executed yet. | |||||||
When operations begin, each row will publish: SOST txid · EVM txid · token received · amount · price/reference · vault address · resulting balance · notes/status. See the full Protocol Registry.
A planned voting section in the explorer where SOST holders signal approval for strictly limited reserve operations using signed wallet votes. Voting is by wallet signature, weighted by SOST held at a snapshot block — not by mining, hashrate or coinbase. A dominant miner gains no voting power. The Signal can only approve operations inside fixed safety rails; it never grants open spending power.
This is a non-interactive design preview. No vote is live; early phases are
off-chain signed signalling (advisory + publicly verifiable), not consensus. 1 SOST at
snapshot = 1 vote · 1 wallet = 1 signed vote.
| Action | Convert up to 100 SOST into PAXG |
| Destination | Tokenized Gold Safe · verified when live (NOT CREATED YET) |
| Snapshot | voting_start − 1 |
| Your voting power | — (connect wallet, Phase 2) |
| Status | Preview / NOT ACTIVE |
Every proposal is bounded by the reserve rails: only PAXG/XAUT · only allowlisted verified Safe destinations · weekly cap · timelock · Protocol Registry entry · emergency stop · no AMM · no CEX · no personal wallet. The vote never decides "do anything" — only YES/NO inside safe rails.
The tokenized gold belongs to the protocol's reserve — no individual redemption right for holders/miners/buyers; not a peg; not gold-backed SOST; not a dividend/yield/equity; no new SOST minted; NOT ACTIVE. Full design: Gold Vault Signal design.
The Funding Vault needs operational flexibility (sell SOST, buy gold tokens). The Reserve Vault needs maximum immutability (Heritage sealed). Splitting them achieves both without mixing “hot” and “cold” functions.
Hardcoded destination in genesis consensus rules. Receives exactly 25% of each
block subsidy (q = reward // 4). Any block without the correct vault
output is invalid. Accumulated SOST is periodically converted to
tokenized gold exposure via the TWAP execution pipeline.
| Allocation | 25% of every block reward // q = reward // 4 |
| Enforcement | Consensus validation // invalid block if missing |
| Year 1 accumulation | 103,160 SOST |
| 30-year total | 1,167,300 SOST |
| Default split | 50/50 XAUt / PAXG // adjustable for future purchases |
| Staging assets | USDC + USDT // ≤72 hours temporary only |
TWAP (Time-Weighted Average Price) would execute a daily sell budget as many small, evenly spaced limit orders over time, so the realized price approximates the market’s average and minimizes impact. No discretionary “sell whenever we want” behavior. This describes the planned model; it is not active today.
| Clips per day | 48–96 micro-orders // every 15–30 min |
| Max slippage | 0.5%–1.0% per clip |
| Cooldown trigger | −8% intraday drawdown // pause or halve |
| Purchase start | ≥8 months after public launch // + market readiness |
| Audit trail | Mandatory per-batch report // public, verifiable |
The Reserve Vault is an Ethereum mainnet smart contract holding allowlisted precious-metal tokens (XAUt and PAXG). Default state is Heritage: sealed, perpetual, untouched while SOST exists. No outbound transfers in normal operation. “Decades of collective work — converted to gold exposure — preserved.”
| Location | Ethereum mainnet smart contract |
| Default state | HERITAGE — sealed, perpetual |
| Allowed assets | XAUt, PAXG // allowlisted precious-metal tokens |
| Outbound transfers | NONE in normal operation |
| Movement authority | Emergency Catastrophe dual-gate only |
Reserve movements require both gates to pass — neither alone is sufficient. This prevents unilateral protocol action and ensures miner consensus backs any reserve operation.
If the chain dies and no Emergency Catastrophe was authorized before blocks stopped, the reserve remains in Heritage state. The absence of consensus activity cannot authorize reserve movements. Heritage is the default — always.
| Day 0 | Last block mined |
| Day 30 — Watch | Liveness Alert · recovery begins // no liquidation |
| Day 60 — Critical | Full incident report // no liquidation |
| Day 90 — Dissolution | Public notice starts // 60-day window begins |
| Day 150 — Execution | Wind-down execution // network lifecycle shutdown |
| G1 | Every valid block MUST pay Gold Vault exactly q = reward // 4 |
| G2 | Two-vault separation: Funding (operational) + Reserve (cold) |
| G3 | Reserve Vault is Heritage sealed; no outbound in normal operation |
| G4 | Purchases begin ≥8 months after public launch + market readiness |
| G5 | TWAP batch execution only — no discretionary market-timing |
| G6 | Allowlisted assets only: XAUt, PAXG; USDC/USDT staging ≤72h |
| G7 | Default 50/50 split; adjustable for future purchases only |
| G8 | Issuer risk: redirect future purchases without consensus |
| G9 | Emergency dual-gate: ≥60% miner signaling + Protocol Execution Order |
| G10 | All vaults, batches, and proofs publicly published |