IRON Finance & TITAN: the algorithmic prequel to Terra

IRON Finance ran a fractional-algorithmic stablecoin on Polygon, modeled on Frax. Minting one IRON required depositing USDC plus an amount of TITAN set by the target collateral ratio; redeeming one IRON returned the same split of value. The design had walked the ratio down from fully collateralized toward roughly 75% USDC and 25% TITAN, so a meaningful slice of every redemption settled in a token whose only support was protocol demand.

The collapse came in two waves on 16 June 2021. The morning sell-off pushed IRON off peg and TITAN from the mid-sixties toward $30 before both recovered, which read as an ordinary correction. The afternoon wave did not recover. Renewed selling drove sustained sub-dollar redemptions, and within hours TITAN had gone from a mid-sixties dollar price to effectively zero, with supply expanding far beyond its planned ceiling.

The economic damage tracked the run-up: value commonly cited at roughly $2 billion evaporated against a multi-billion-dollar peak in total value locked, with much of that headline loss representing unrealized TITAN gains rather than fresh dollars committed. IRON itself did not vanish — its USDC reserve survived — but TITAN's destruction made the share token worthless and left IRON redeemable only for the cash leg, around $0.74 to $0.75. The protocol was decommissioned. Pharos shadow-tracks IRON for Pharos Stability Index calibration without surfacing a public coin page.

The fatal property was that redemption did not merely transfer TITAN — it minted it. When IRON traded below a dollar, anyone could buy the discounted stablecoin and redeem it for roughly $0.75 in USDC plus $0.25 in newly issued TITAN, then sell that TITAN immediately. Each pass through the loop printed fresh supply into a market that was already falling, so the more aggressively arbitrageurs closed the discount, the faster TITAN diluted toward zero.

A lagging oracle turned the loop reflexive. The redemption price for TITAN used a ten-minute time-weighted average, so during a fast decline the contract valued TITAN well above its spot price. That gap was a guaranteed spread: redeem at the stale, higher oracle value, sell at the lower live price, and pocket the difference. On Polygon, where blocks clear in seconds, a ten-minute average lagged badly enough that the spread persisted as long as anyone kept selling.

The result was a self-reinforcing feedback loop with no natural floor above zero. Falling TITAN meant each redemption had to mint more TITAN to deliver the fixed dollar value, which depressed the price further, which widened the oracle spread, which invited more redemptions. Supply that was meant to be capped near a billion tokens expanded into the trillions. Only the hard USDC reserve — the part that was never algorithmic — set a real floor under IRON itself.

TITAN was to IRON what LUNA would become to UST: a volatile share token absorbing the stablecoin's demand shocks through a mint-and-burn redemption mechanism. In both systems the stabilizing arbitrage was symmetric only in calm markets. Once confidence broke and redemptions ran one way, the mechanism that was supposed to defend the peg instead minted the share token into hyperinflation — the same reflexive death spiral, differing mainly in scale and in the absence of an oracle lag in Terra's case.

IRON ran the experiment first, in June 2021, roughly eleven months before UST broke in May 2022. It was smaller and partially collateralized, so it kept a USDC backstop that Terra lacked, but the failure mode was identical in structure: a token whose supply is endogenous to its own price cannot anchor a peg through a panic. The lesson was available, documented in a public post-mortem, and largely set aside as a Polygon-specific accident rather than a category warning.

For Pharos this is why IRON is preserved rather than discarded. Its series is one of the inputs used to calibrate how the Pharos Stability Index scores reflexive, share-token-backed designs, alongside the later and far larger Terra collapse. The two events bracket the same structural flaw, and reading them together makes the pattern legible rather than treating each as a one-off.

A stablecoin whose collateral includes its own protocol's share token carries the peg's stress directly into that token's supply. When the share token is minted on redemption, selling pressure on the stablecoin becomes inflationary pressure on the share token, and the two reinforce each other downward. Partial collateralization softens the landing — IRON holders kept a cash claim — but it does not remove the reflexive core.

Oracle design is not a detail in these systems; it is part of the attack surface. A time-weighted average chosen for manipulation resistance can, in a fast crash on a fast chain, hand arbitrageurs a standing spread between stale redemption prices and live spot. The same averaging window that protects against a single malicious block can subsidize an orderly drain when the whole market is moving one direction.

Finally, the first wave's recovery was the trap. The morning bounce on 16 June read as resilience and bought the system credibility hours before the afternoon wave proved that the recovery had only reloaded the same mechanism. A design that survives a tremor is not proven safe; it has merely not yet met selling large and sustained enough to keep the loop spinning past the point of return.