satUSD (SATUSD) is two stablecoins glued together

Satoshi Stablecoin trades under the ticker SATUSD on its SATUSD market page, while the protocol itself brands the asset as satUSD. The important part is not the name. It is the architecture.

satUSD supply expands through (1) overcollateralized borrowing and also through (2) a fixed-price swap vault. The Omni-CDP path looks like a familiar CDP system, except it is built to let users deposit collateral on one chain and mint satUSD on another using LayerZero messaging. The Swap path lets users exchange USDT or USDC for satUSD at a fixed 1:1 rate, with the incoming stablecoins held in a protocol vault and satUSD minted to the user.

That hybrid matters for sustainability. The CDP leg is endogenous and reflexive. Its health is dominated by collateral volatility, oracle quality, liquidation throughput, and user leverage discipline. The swap-vault leg is exogenous. It is dominated by custody and solvency of the vault, plus operational governance around whatever “securely held” ends up meaning in practice.

Finally, satUSD is designed to be “productive” inside its own ecosystem. Users can stake satUSD and receive satUSD+, a liquid ERC-20 that represents staked satUSD and accrues protocol revenue over time. That yield claim is the real tokenomics story. It creates an internal bid for satUSD that is not purely transactional.

History: V1 to V2, then River, then contract migrations

Satoshi Protocol publicly positioned “V2” as the move to an Omni-CDP model integrated with LayerZero, enabling cross-chain minting and native transfer mechanics. The V2 announcement is dated February 9, 2025.

The migration guide for moving positions from V1 to V2 is dated February 11, 2025. It also calls out a satUSD token address upgrade for V2 and notes V1 tokens remain operational in their original liquidity pools, but users are encouraged to adopt the V2 satUSD contract for cross-chain utility.

Later, the project brand consolidated under “River,” framing satUSD as the omni-chain stablecoin inside a broader “chain-abstraction stablecoin system.” That matters because it makes satUSD less of a single-product stablecoin and more of a balance-sheet primitive that feeds other modules, especially satUSD+ and the incentive layer around $RIVER.

Coin listings also flag a token contract migration from an “old contract” to a “new contract,” with explorer links shown directly on the asset page. In practice, you should treat satUSD/SATUSD as a multi-contract, multi-chain asset where “the right contract” depends on the chain and the era. The most reliable canonical list is the project’s own “Deployed Contracts” page.

Supply: elastic mint/burn, unified across chains, infinite ceiling

satUSD is not distributed like a typical fixed-supply token. It is minted when users borrow against collateral through Omni-CDP, and it is also minted when users swap USDT/USDC into satUSD at 1:1 through the Swap Module.

On the burn side, satUSD is destroyed in at least three ways:

The max supply is effectively uncapped. Coin listings display Max Supply: ∞ for SATUSD. That is normal for a CDP stablecoin. The cap is economic, not numeric. It is whatever collateral the system can safely intermediate and liquidate.

For on-chain contract footprint, River publishes deployed contract addresses across many chains, including Ethereum, BNB Chain, Base, Arbitrum, Sonic, BOB, BSquared, Hemi, BEVM, Bitlayer, and X Layer. This matters because cross-chain fungibility is not “free.” It is an ongoing risk-management problem.

Coin listings also report circulating and total supply figures for SATUSD in their statistics panels. Treat those as a snapshot, not a parameter. The structural parameter is that supply is demand-driven and collateral-constrained.

Fees and fiscal flows: who pays, who gets paid

satUSD economics are mostly fee-driven, not interest-driven. The three explicit cost components for opening debt are defined in the minting fee model.

Base Rate is not a governance knob you can hand-wave away. It is the internal “stress pricing” lever that responds to redemptions. River describes Base Rate dynamics including a decay factor of 0.944 applied hourly, chosen to produce a 12-hour half-life. This creates a regime where heavy redemptions can temporarily raise minting and redemption costs. That is stabilizing for solvency. It is also destabilizing for growth if the system relies on cheap leverage to keep usage high.

On redemptions, River states redemption fees are computed as (baseRate + 0.5%). It also states redemptions are allowed only when the Total Collateral Ratio (TCR) is above 110% and not within the first 14 days post-protocol launch.

Liquidations are designed to be instant and permissionless, with positions eligible for liquidation below a 110% collateral ratio in normal conditions. Liquidators receive 0.25% of the collateral plus 2 satUSD gas compensation.

The Stability Pool is the key internal buyer of liquidation flow. It uses satUSD to clear liquidated debt and receives collateral, distributing those collateral gains pro-rata to Stability Pool depositors. This is the main “native yield” mechanism that does not require external strategy risk. It is also inherently cyclical. If there are fewer risky positions, there are fewer liquidation gains, so Stability Pool deposit yield compresses.

satUSD+ wraps that whole fee stack into a liquid yield-bearing token. River describes satUSD+ as redeemable at any time for underlying satUSD, accruing protocol revenue automatically, and sourcing yield from “protocol-level fees,” explicitly including minting, redemption, and liquidation fees.

The Swap Module is the other major supply rail. River describes swap vault mechanics as fixed 1:1 swaps between USDT/USDC and satUSD, with incoming stablecoins held in a vault and satUSD minted 1:1 to the user. The docs also describe arbitrage where traders swap satUSD back for USDT/USDC at 1:1 if satUSD trades below $1, which implies two-way convertibility through that module.

Here is the sustainability tension. A CDP stablecoin usually wants a deep secondary market and credible redemption. A swap-vault stablecoin wants clear reserve management, operational security, and ideally transparent attestations. River’s docs emphasize the vault is “held securely” but do not specify reserve transparency standards or segregation mechanics on that page. If you are modeling SATUSD, you should treat “swap-backed satUSD” and “CDP-backed satUSD” as two backing modes sharing the same ticker.

For a contrast case, compare it to a reserve-backed stablecoin in our GUSD tokenomics review.

Governance and control surface

River claims “all core protocol contracts are immutable and non-upgradeable.” In isolation, that sounds like credible commitment. In practice, the system still has a large control surface because risk settings can be adjusted by changing what collateral is accepted, how it is priced, and what limits apply.

On risk settings, the Risk Management docs describe “Isolated Risk Control,” with parameters like LTV, interest rates, and safety coefficients customized per collateral type. It also states the protocol imposes minting caps per collateral type to prevent overexposure.

On systemic stress behavior, Recovery Mode is triggered when TCR drops below 150%. In Recovery Mode, positions below 150% collateral ratio become eligible for liquidation and the protocol sets the minting fee to 0% as an incentive for actions that improve TCR.

On oracle risk, River publishes an oracle table showing collateral-by-chain providers and the staleness parameters it checks, expressed as deviation thresholds and heartbeat intervals. Examples include 0.5% / 3600s for WETH and WBTC on Ethereum, and various other settings across chains and assets. That is good operational hygiene. It also increases the number of external dependencies that must behave correctly under stress.

$RIVER sits on top as governance and incentive plumbing. River defines $RIVER as the “governance and incentive token” with total supply 100,000,000 and publishes an allocation and vesting schedule. It also states Stability Pool revenue sharing goes to staked $RIVER holders.

River’s own $RIVER page describes staking lockups of 3, 6, 9, or 12 months with voting power multipliers of 1x, 2x, 3x, 4x. Separately, an official governance forum thread dated December 1, 2025 describes a staking mechanism proposal with multipliers 1x, 2x, 4x, 8x for those same durations. This mismatch is not fatal, but it is real. It reduces confidence in parameter stability for anyone trying to model post-incentive equilibrium. The mechanism may still be evolving.

On audits, River links to a repository that contains third-party audit PDFs for multiple protocol components and versions, including “River_Protocol_v1” and “River_Protocol_v2” reports. Treat audits as a necessary condition for serious stablecoin infrastructure. Not a sufficient one.

$RIVER allocations (as published) are shown in the tokenomics allocation table.

Risk analysis

Dominant risk: satUSD demand is being engineered, not discovered, and the design has a sharp post-incentive equilibrium problem.

The protocol is building a closed loop where satUSD is minted (CDP or swap), then staked into satUSD+ for fee revenue, then pushed into ecosystem integrations, while $RIVER and points systems reward behaviors that “move the network forward.” That is coherent as a growth engine. It is structurally fragile as a long-run equilibrium.

We frame these tradeoffs using the same tokenomics principles guide we apply to incentive loop analysis.

Start with yield. satUSD+ yield is explicitly sourced from protocol fees, including minting, redemption, and liquidation fees. That makes yield proportional to system activity. It is not exogenous yield. If mint volumes fall, redemption volumes fall, and liquidation volumes normalize downward, satUSD+ yield compresses. When yield compresses, the incremental reason to hold satUSD instead of a “plain” stablecoin weakens. That reduces satUSD demand again.

Now add the “0% interest” positioning. River states the annual interest fee is currently 0%. That is attractive when chasing adoption. It removes the slow bleed that forces leveraged borrowers to delever over time. It also removes a stable, non-cyclical revenue stream that many CDP systems rely on to pay for security, operations, risk management, and incentives without depending on churn. River is leaning harder on one-time fees, swap flows, and episodic liquidation income.

The minting fee is dynamic, bounded between 0.5% and 5%, with Base Rate decaying with a 12-hour half-life and rising with redemption pressure. This is a credible stabilizer. It is also a growth brake exactly when the system is stressed. Under stress, you want users to recapitalize the system quickly. Higher fees discourage that, except in Recovery Mode where minting fees are set to 0% when TCR is below 150%. That is a reasonable emergency valve. It still means “normal times” revenue is cyclical and “bad times” revenue is waived.

Finally, incentives. $RIVER has a large multi-year ecosystem incentives allocation with a defined 60-month linear vest. This is the standard DeFi playbook. It buys liquidity and attention early. The question is what happens when that incentive spend becomes marginal and the system is forced to compete on raw utility and net-of-fees returns.

In a post-incentive regime, satUSD has to win on three fronts simultaneously:

If any one of those legs weakens, you get a negative feedback loop. Liquidity thins, spreads widen, swap arbitrage becomes less reliable, and the stablecoin becomes “stable when it is already stable.” That is the failure mode that matters. Not a single liquidation bug. A slow demand unwind that eventually makes stress events harder to absorb.

Top 3 risks

  1. Cross-chain accounting and messaging risk (LayerZero / OFT). Trigger: a cross-chain messaging outage, reorg, misconfiguration, or exploit affecting burn/mint synchronization. Mechanism: satUSD relies on “burn/lock on source, mint/unlock on destination” plus LayerZero messaging for unified supply. Who bears it: satUSD holders and LPs first, then borrowers via emergency parameter shifts or liquidity freezes. Measurable indicators: bridge failure rates, message delays, unexpected per-chain supply divergence, and growing price dispersion between satUSD pools on different chains.

  2. Swap vault solvency and operational opacity. Trigger: loss of funds in the swap vault, depegs in the stablecoin reserves, or governance actions that impair redemption/convertibility expectations. Mechanism: the Swap Module mints satUSD 1:1 against USDT/USDC deposited into a protocol vault, and the docs position it as central to peg maintenance. Who bears it: satUSD holders who treat swap-based backing as equivalent to CDP collateral backing, plus integrators relying on 1:1 convertibility. Measurable indicators: public reserve disclosures (if any), on-chain vault balances, and persistent satUSD price discounts despite “1:1” swap claims.

  3. Oracle and liquidation throughput under fast BTC/ETH moves. Trigger: sharp collateral drawdowns combined with oracle staleness or delayed updates, plus insufficient liquidator competition. Mechanism: the protocol depends on timely oracle updates with deviation/heartbeat constraints and instant permissionless liquidation below defined collateral ratios, with the Stability Pool absorbing debt. Who bears it: borrowers near MCR, Stability Pool depositors during stressed liquidations, and satUSD holders if bad debt emerges. Measurable indicators: oracle “last update” age during volatility, liquidation volume spikes, Stability Pool utilization, and TCR approaching Recovery Mode thresholds.

If you are allocating serious balance sheet to satUSD, you should model it like infrastructure, not like a farm token. That means scenario testing around TCR falling below 150% (Recovery Mode) and how quickly the system can re-capitalize without relying on fresh incentive spend. For adjacent work, see our crypto research reports.

If you need independent help pressure-testing satUSD’s incentive loop and post-incentive equilibrium, this is the kind of work a tokenomics advisor or tokenomics design services team should do with explicit stress scenarios, not just spreadsheet APYs. Keep the work mechanism-first. Anything else is marketing.



This article is part of our Tokenomics Deep Dive series.