pmUSD and the in-situ gold collateral chain

pmUSD's backing runs through three layers, each abstracting away from the asset below it. At the top, pmUSD is the stable fToken in an f(x)-style design; xPM is the paired token that is meant to soak up gold-price volatility so pmUSD can hold a stable net asset value. Below pmUSD sits TokenBlender (TB), a base token held in RAAC's RWf(x) treasury. TB in turn is minted against ION.au, the gold-linked digital security held in the TokenBlender contract. Only at the bottom of this chain does one reach gold — and even there it is not vaulted metal.

ION.au represents what I-ON Digital describes as a senior-secured claim on proven in-situ gold reserves, structured as a tokenized asset-backed security rather than a claim on bullion in a vault. The issuer's framework cites a roughly 5:1 over-collateralization ratio and an approximately 80% haircut to spot when valuing the underlying gold, intended as a buffer against price moves and recovery costs. In-situ gold is un-mined ore in the ground; its value rests on geological reserve classifications and the legal enforceability of mineral-rights claims, not on metal that can be weighed and delivered on demand.

Each layer adds distance between a pmUSD holder and anything liquid. A discount or solvency question at the gold layer propagates up through ION.au to TB to pmUSD, and the holder's recourse runs through smart-contract logic and off-chain legal instruments rather than a redemption window for physical gold. That layering is the defining structural feature of this case.

A stablecoin holds par when arbitrage is cheap and symmetric in both directions: when the token is below $1, someone can profitably acquire it and redeem or swap for a dollar of value; when it is above $1, someone can mint and sell. pmUSD's design weakens both legs of that loop. Minting is manager-only — system operations run through authorized silo multisigs rather than open, permissionless minting — so ordinary market participants cannot freely create supply to arbitrage a premium, and the supply side of the peg is governed by a small number of controllers.

On the discount side, the primary defense is a Peg Stability Module (PSM) that lets holders swap pmUSD into sUSDS at $1 of face value when pmUSD trades below par on-chain. But that swap is one-directional and reserve-gated: it draws down a finite sUSDS reserve and is configured to pause when that reserve falls below 20% of PSM assets. A reserve-capped, one-way module can absorb a steady trickle of sellers, but it does not arbitrage the token back to a hard par. Once the PSM is depleted or paused, the only remaining buyer of last resort is the open market — and pmUSD's open market is a thin set of Curve pools.

The result is exactly what the record shows: a token that can clear sellers most days but only at a standing discount, because the mechanism that defends the floor is finite and cannot be replenished by permissionless arbitrage the way an over-collateralized, freely redeemable design can. The persistent 100-to-200 bps drift is the price of that asymmetry in normal conditions.

On May 2, 2026, the same asymmetry produced a much larger move. pmUSD fell roughly 55.7% intraday to about $0.443. In a deep, freely arbitraged market, a 55% gap in a dollar token would invite overwhelming buy-side pressure; here it did not close, and Pharos has no recorded recovery print for the event. The crater is best read as the chronic fragility expressed under stress rather than as a new, separate failure mode.

Two structural facts make a move of this size mechanically possible. First, the reserve-gated PSM has a hard limit: once its sUSDS reserve crosses the pause threshold, the engineered floor simply switches off, and price discovery reverts to a thin secondary market that can gap far below par on modest flow. Second, the collateral chain offers no fast, public redemption path to gold; a holder cannot convert pmUSD into deliverable metal to enforce a price, so confidence — not arbitrage — sets the level. When confidence in the layered backing wavers, there is little to catch the price until it finds whatever bid the Curve pools will support.

Pharos does not assert a cause for the specific trigger on that day, and the public record does not establish one. What the crater revealed is structural: the depth of the peg defense, the thinness of the market beneath it, and the absence of a redemption backstop that could enforce par independently of sentiment.

Several elements of pmUSD's stack are genuinely checkable on-chain or in public filings. The pmUSD contract, its supply, and its trading history are observable; the f(x)-fork mechanism, the manager-controlled operations pattern, and the PSM's reserve-gated behavior are documented in RAAC's materials and visible in contract logic. I-ON Digital is a reporting public company, and its disclosures, audit opinion, and reserve-classification references can be examined directly. The on-chain price record — including the chronic discount and the May 2 crater — is recorded and is the firmest fact in this study.

Other elements rest on issuer assertion and cannot be independently confirmed from on-chain data. The specific in-situ reserve quantities, the exact title and lien documentation over the underlying mineral rights, and the controls that are said to prevent over-issuance are described by the issuer rather than provable by inspecting the chain. The headline coverage figures — the 5:1 ratio and the 80% spot haircut — describe how ION.au's gold layer is valued, not pmUSD's live on-chain solvency, and a conservative reader should treat them as a model of the deepest layer rather than a guarantee at the token a holder actually owns.

The Chainlink Proof of Reserve feed and the Instruxi attestation are real components, but a proof-of-reserve feed verifies that an attested quantity exists at its named source; it does not transform an in-situ gold claim into deliverable bullion, nor does it close the gap between the gold layer and the pmUSD layer. Pharos flags this asset's custody as institutional-unregulated and its reserve as high-risk for exactly these reasons: the structure is partly verifiable and partly asserted, and the unverifiable parts sit closest to the actual collateral. None of this implies fraud or bad faith; it is a statement about what an outside observer can and cannot confirm.

Persistent sub-peg drift is itself a signal, not noise. A token that lives at a 100-to-200 bps discount for months is telling the market that its peg defense is finite or its backing is doubted; PegScore and DEWS treat sustained drift as a standing condition rather than waiting for a single dramatic print. The 337 recorded sub-peg events here are not 337 surprises — they are one continuous structural fact.

Layered collateral concentrates opacity at the layer hardest to verify. The more steps between a stablecoin and a liquid, deliverable asset — pmUSD to TB to ION.au to in-situ gold — the more the holder depends on assertions rather than on an enforceable redemption. A reserve-gated, one-directional PSM can hold a soft floor in calm conditions but cannot manufacture par, and manager-only minting removes the symmetric arbitrage that normally pins a healthy peg. When confidence in the deepest layer slips and the floor mechanism hits its limit, a thin secondary market can gap far below par. pmUSD remains live, but its record is a clear illustration of how exotic backing and asymmetric peg defense produce chronic fragility long before — and during — any single crater.